Privacy Policy

Welcome to Xheris, operated by Xheris OÜ, a company registered in Estonia (hereinafter "Xheris," "we," "our," or "us").

This Privacy Policy describes how we collect, process, use, store, share, and protect your information when you use our websites, mobile applications, platforms, services, and tools (collectively, the "Services").

We comply with the General Data Protection Regulation (EU 2016/679 - GDPR) and other relevant international and national privacy laws.

This Privacy Policy applies to all users of Xheris, including but not limited to:

• Tenants and property owners
• Property managers and syndics
• Contractors and subcontractors
• Material and service suppliers
• Visitors to our website

The data controller responsible for your information is:

We may also act as data processor on behalf of property managers, suppliers, or contractors, depending on the services they use.

We collect several types of information in order to provide, improve, and secure our Services:

We may collect information from third-party sources to enhance our Services:

• Contractors, suppliers, and managers integrated into the platform
• Payment providers (Stripe, PayPal, banks)
• CRM systems (Salesforce) and compliance systems (Peppol, VAT databases)

We use your personal data for the following purposes:

• To create and manage your account
• To provide our Services (reporting issues, managing repairs, invoicing, supplier marketplace)
• To communicate with you (notifications, support, contract updates)
• To process and track payments securely
• To comply with legal and tax obligations (Peppol e-invoicing, AML checks)
• To improve user experience (UX/UI optimizations, personalization)
• To provide analytics and reporting to managers, suppliers, and contractors
• To ensure platform security and prevent fraud
• For research and development, including testing AI-based features
• For marketing and promotional communications (with consent)

We may share your information with:

• Other users of the platform (tenants, contractors, suppliers, managers) when necessary for services
• Service providers (hosting providers, email services, payment processors, IT support)
• Affiliated companies within Orivian Group Inc.
• Authorities and regulators where legally required
• Potential investors or buyers in case of merger, acquisition, or restructuring

We retain personal data only as long as necessary:

• User accounts: while active + 3 years after closure
• Financial and billing data: 7 years (legal requirement)
• Technical logs: 12 months (security)
• Cookies: 12 months or until cleared by user

Under GDPR, you have the following rights:

• Access to your data
• Rectification of inaccurate data
• Deletion ("right to be forgotten")
• Restriction of processing
• Data portability
• Objection to processing

Xheris uses cookies and similar technologies for:

• Authentication and session management
• Analytics (Google Analytics, internal tools)
• Personalization
• Advertising (only if you consent)

You can disable cookies in your browser, but some features may not work.

We may transfer data outside the EU/EEA (e.g., to hosting providers, support teams).

Safeguards: Standard Contractual Clauses (SCCs), adequacy decisions, or equivalent protections.

We implement industry-standard security measures:

• SSL/TLS encryption
• Encrypted databases
• Access controls
• Regular security audits and penetration testing

Our platform integrates with:

• Stripe, PayPal – for payments
• Google Maps API – for geolocation and mapping
• Bitrix24 CRM – for workflow automation
• AWS or DigitalOcean – for hosting

We may use automated systems, including AI, to:

• Match contractors with jobs
• Suggest suppliers and products
• Predict maintenance needs

We may send you marketing emails if you consent. You can unsubscribe at any time.

Our Services are not directed to children under 16. We do not knowingly collect their data.

We may update this Privacy Policy. Updates will be posted on our website and, when necessary, notified by email.