Xarpen Privacy Notice

How Xarpen handles the personal data of subscribing studios and site visitors.

1. Data controller

This notice is issued under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations.

2. Two distinct roles, and why it matters

Xarpen handles personal data in two very different capacities, and this notice covers only the first:

• As controller, for the data of photographers and their teams who open an account. That is what this document describes.
• As processor, for the data each studio keeps about its clients: the couples, their gallery guests. There the controller is the studio, not Xarpen. The notice that applies to those people is their studio's, available at /privacidad-estudio.

The difference is not a formality: it determines who you turn to if something goes wrong. If you are a couple or a gallery guest, your counterpart is the studio that shared the link with you.

3. What we collect from studios

• Identification and contact: name, email address, studio name, phone and billing details if you provide them.
• Access: password (stored hashed, never in the clear) and, if you sign in with Google, the verified email and name Google shares with us.
• Service usage: access logs including IP address and browser, activity within the product, and AI assistant consumption.
• Payments: plan, subscription status and Stripe identifiers. We do not store card numbers.
• Your account content: what you write and upload while running your studio. That content is yours (section 7 of the Terms) and we handle it as your processor, not for our own purposes.

We do not intentionally collect sensitive data. If you choose to store sensitive information about your clients inside the product, you are the one answering for that decision as the controller of that data.

4. What we use it for

Necessary purposes, to provide the service:

• Create and maintain your account, authenticate you and protect access.
• Provide the product features you choose to use.
• Bill the subscription and keep payment records.
• Support you, and notify you of significant changes and incidents.
• Detect abuse, fraud and technical failures, and keep the platform secure.

Secondary purposes, which you can object to without losing the service:

• Send you product news and educational content.
• Ask for feedback or invite you to try new features.

To object to the secondary purposes, write to us at notifications@xarpen.com.

5. Who we share it with

We do not sell personal data. We rely on the following providers, each bound to an equivalent level of protection and only to the extent necessary:

• Cloudflare, Inc. — infrastructure: application runtime, database, file and video storage, and email delivery.
• Anthropic, PBC — the AI models powering the assistant.
• Stripe, Inc. — payment and subscription processing.
• Resend, Inc. — transactional email delivery, as a fallback to Cloudflare's.
• Google LLC — sign-in with Google and, if you connect it yourself, Google Calendar sync.
• Meta Platforms, Inc. (WhatsApp Business): messaging, only if you connect your WhatsApp number to Xarpen. It delivers and receives your contacts' messages, with their phone numbers, and lets you register your number.

If you embed third-party content on your public page (a YouTube or Vimeo video, or the Meta pixel), those services receive data from visitors to that page under their own policies. That is your decision as a studio, and you should reflect it in your own notice.

We may also disclose data when a competent authority requires it under the law.

6. Artificial intelligence

When you use the assistant, the content needed to answer your request is sent to Anthropic's API: your message, and whatever account information the requested tool needs (for example, a wedding's details if you ask for a summary of that wedding).

Under Anthropic's terms for API customers, that content is not used to train their models.

Your assistant conversation history is stored in your account to give it continuity, and you can delete it. If you turn the assistant off, no content is sent.

The Xarpen team's assistant. Separately from your own assistant, the Xarpen team may use an AI assistant (Anthropic models) to look up account data of subscribing studios: business name, the name and email of whoever manages the account, plan, subscription status, Xarpen's internal notes about the account, service usage (activity, storage and assistant consumption), and pending invitations, with their origin and the invitee's details (name and email) before they accept. This applies to every account, even if you turn your own assistant off. That assistant does not read what is inside your account: your clients, your weddings and jobs, your business's payments or your messages. Any change it proposes (for example, a free courtesy period or an invitation) is applied only when a person on the Xarpen team confirms it, and it is logged.

7. International transfers

The providers above are U.S. companies and information may be stored or processed outside Mexico. By using the service you accept those transfers, which are made solely for the purposes described and under contractual protection commitments.

8. How long we keep data

• Account data: while the account is active and for up to 30 days after the relationship ends, except what we must keep by legal or accounting obligation.
• Access and security logs: for a limited period, enough to investigate incidents.
• Gallery guest data (which we handle as the studio's processor): deleted when the gallery expires, or after a year of inactivity if it does not expire.
• Galleries under custody: kept for the 10 years the couple paid for, even if the studio's account is closed.

9. Your rights

You have the right to access your data, rectify it if inaccurate, cancel it when no longer needed and object to specific processing, as well as to withdraw your consent and to limit the use or disclosure of your data.

To exercise them, write to us at notifications@xarpen.com stating your request, your name and a way to reach you. We will respond within the periods set by law. If you believe your right was not honoured, you may turn to INAI, Mexico's data protection authority.

Many of these actions you can also perform yourself from Settings, without writing to us.

10. Cookies and similar technologies

We use one signed session cookie, strictly necessary to keep you signed in, and browser local storage to remember interface preferences (language, views). We do not use advertising or cross-site tracking cookies.

In galleries, viewing photographs requires leaving no data at all: visits are counted anonymously, with no IP address or device identifier.

11. Security

We apply reasonable administrative, technical and physical measures: encryption in transit, passwords stored with key derivation, signed sessions revalidated against the database on every request, strict separation between each studio's data, and second-factor authentication on administrative access.

No system is infallible. If a security breach significantly affects your data, we will notify you without undue delay.

12. Your personal space

Xarpen includes an optional, private space -- the Notebook -- for notes, a journal and personal goals, kept separate from your business information. You decide whether to turn it on; if you don't, nothing is created.

• What you keep there is yours, and no one else on your team sees it, regardless of role.
• The AI assistant only reads your personal space when you ask it to, inside the Notebook; that conversation does not enter its business memory or the history your team sees, and is not used for any other purpose.
• You can export or delete your entire personal space at any time from Settings, without writing to us.

One limit we would rather state plainly than oversell: as with the rest of the product, a studio's owner can recover a team member's account access (for example, if that person loses their password and no longer has the email they registered with). Your personal space is private from your teammates for as long as the account is still yours; it is not a compartment with a key not even the studio's owner can turn.

If you stop being part of a studio, your personal space is automatically deleted 30 days after you are deactivated.

13. Changes to this notice

We may update this notice. The current version, with its date, is always published at this address. When a change is significant, we will notify your account email.