Privacy Policy

Who is responsible

Daniel Haket, based in the Netherlands, operates XSDHub and is responsible for the personal data processed to provide this service. Contact support@xsdhub.com for privacy questions and requests. A payment provider or sign-in provider may separately be responsible for data it processes for its own purposes.

XML files and saved schemas

Default XSD 1.0 validation and formatting run on your device. Optional XSD 1.1, second-engine XSD 1.0 and Schematron validation send XML and schemas over HTTPS to our isolated Hostinger-hosted processing service only after explicit permission. These request contents are not logged or kept as an account record; temporary processing files are deleted when the request finishes or times out. Network metadata can appear in infrastructure logs. The validation API and CLI also process uploaded documents on the server. Closing or reloading the page can clear unsaved work; keep your own copies.

If you explicitly save a schema to your library, we receive its name, XSD content, account/workspace identifier and creation time. Those schemas are stored server-side so you can reuse them. Complete schema projects and their saved versions can also be uploaded to cloud storage when you choose Save project to cloud; XML documents are excluded. Team library content is available to the workspace's members. A schema can contain personal data or confidential information; consider its contents before saving or sharing it.

Accounts, sign-in and billing

Account data can include your name, email address, sign-in provider, provider account identifier, verification status and profile image supplied by that provider. Google and GitHub sign-in provide basic identity information; the GitHub integration requests email access, not repository access. Email/password sign-in is handled by Google Firebase Authentication. XSDHub does not store your password in its application database.

We store account links, workspace membership, invitation records, subscription identifiers, plan, billing interval and subscription status to enforce access rights. We send the selected plan and account reference, and may send your account email, to the checkout provider. Card details are entered into the payment provider's checkout and are not stored in the XSDHub application database.

Paddle processes new subscription purchases. Historical Lemon Squeezy test records may remain for account and integration support. The provider shown in a checkout processes information under its own privacy terms. Existing ChatGPT-based accounts also use OpenAI's sign-in services.

Aggregate tool usage

We count guide views, example-link clicks, example loads, validation outcomes and clicks towards plans by day and a fixed topic label. These counters contain no XML, XSD, filenames, error messages, email addresses or user identifiers. We do not join these events into personal browsing histories. Network requests still reach our infrastructure as described below. Counts may include repeat use or unrecognised bots and are not unique visitor counts.

We honour browser Do Not Track and Global Privacy Control signals for these optional counters. You can also change this browser’s preference below; only that preference is stored locally. Paid subscription records are counted separately after verified payment and are not linked to a guide visit.

Service logs and traffic measurement

Our website infrastructure receives connection information such as your IP address, request path, browser information, time and response status to deliver and protect the service. The dedicated XSDHub access log replaces the client IP address with a shortened hash and removes query strings and selected authentication and cookie headers. This reduces exposure but does not make the log completely anonymous.

We use these logs to estimate browser visits, sessions, popular public pages and recognisable bot traffic. We send aggregate traffic summaries to the operator through Telegram. Individual request records, account information and document contents are not included in those summaries. Infrastructure providers may maintain additional operational or security logs under their own retention rules.

Why we process data

We process account, library and subscription data to provide the service you request and perform our agreement with you. We use proportionate security logs, support records and aggregate usage information for our legitimate interests in operating, protecting and improving XSDHub. We retain records where needed to meet applicable legal obligations. If we introduce optional processing requiring consent, we will ask before enabling it; consent can be withdrawn without affecting earlier lawful processing.

Providing account information is necessary for account features. You can use the public XML tools without creating an account. We do not use these account and traffic records to make automated decisions with legal or similarly significant effects on you.

Providers and international processing

We use Hostinger for website infrastructure and support email, Google Firebase for authentication, and OpenAI Sites with Cloudflare-backed infrastructure for account APIs and stored libraries. Google, GitHub or OpenAI handle sign-in when you choose them. The checkout provider handles billing, and Telegram delivers aggregate operational reports.

Access is limited to what is needed for the relevant service, support, security or a lawful disclosure. We do not sell your personal information. Optional affiliate attribution is described below. Providers may process data outside the European Economic Area. Their service terms and privacy documentation describe processing locations and transfer safeguards. Contact us for information about the safeguards applicable to your data.

Cookies and browser storage

Authentication uses cookies or browser storage as needed to keep you signed in and complete a sign-in flow. Saved local schema projects and their last five revisions use IndexedDB on your device. Clearing site data deletes them; export backups first. The public tools do not require advertising or marketing cookies. External authentication and checkout pages may use their own necessary storage and fraud-prevention technologies. Signing out or clearing browser data can remove your local sign-in state but does not itself delete your server-side account.

Retention and deletion

The dedicated XSDHub access log is configured to retain rotated logs for up to 14 days. Aggregate daily traffic reports can be kept longer for comparison. Account and saved-schema data are kept while needed to provide the account and library; cancelling a subscription does not automatically erase them. An active subscription owner can remove saved schemas through the library. Cloud project and version deletion is currently handled through support. Other account or schema deletion requests can be sent to support.

We keep support and transaction-related records only as long as needed to handle the request, maintain the service, resolve disputes or meet applicable legal duties. Records subject to a legal retention duty or a legitimate unresolved dispute may need to be retained after a deletion request. Providers may have separate retention periods for their own records and backups.

Your choices and rights

Subject to applicable law, you can request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. Email support@xsdhub.com from the account concerned where possible. We may need to verify that the request is yours, and will respond within the applicable legal timeframe. You can also complain to the Dutch Data Protection Authority or your local supervisory authority.

Please do not email passwords, payment-card details or unnecessary identity documents. We will explain a suitable verification method if one is needed. Material changes to our data practices will be reflected here and communicated where required.

Optional affiliate attribution

If you follow a partner link, you can allow or decline FirstPromoter referral tracking. We load its tracking script only after you allow it. It receives the referral identifier, page URL, browser and connection information, and uses first-party referral cookies for up to 60 days. Your choice is stored on this device for 60 days. XML, schemas and editor contents are never sent to FirstPromoter.

With permission, we attach the referral identifier and your verified account email to the Paddle checkout. FirstPromoter receives customer identifiers, subscription and transaction amounts, status and refund information from Paddle to calculate and review commissions. The integration also receives billing events without a referral match; these do not earn commission. Card details are not shared with affiliates. Partners receive the referral and commission information necessary to administer the program.

Choose Referral privacy in the footer to withdraw permission for future tracking. This clears referral cookies on this site and stops new attribution from this browser; existing transaction and commission records may remain for reconciliation, disputes and legal obligations. You can use the tools and buy a subscription without allowing tracking. For deletion or a specific retention question, contact support@xsdhub.com. FirstPromoter privacy information.