Privacy Policy

1. Scope

This Policy describes how Vivinn Tech Labs ("X2Bridge," "we") collects, uses, and protects personal data when you use X2Bridge — a shared workspace for vendor-customer collaboration around support and product issues. It covers both the vendor-side team members who run a workspace and the customer-side users they invite into it.

2. Information we collect

Directly, when you use the Service:

• Account data — email address, display name, and (for vendor-side accounts) a password. We don't ask for or store more than that to create an account.
• Content you submit — issues, comments, feedback items, and file attachments you or your organization create inside a workspace, plus who created or uploaded each one.
• Organization data — your organization's name, its verified work-email domain, and, if provided, a phone number and address for the account.
• Security and access logs — every login attempt (email, method, success/failure, timestamp, and, when available, IP address), and a log of workspace-admin actions (who changed what, when). These exist specifically so a workspace can answer "who logged in" and "who changed this setting" questions — see Section 7 for how long we keep them.
• Functional cookies — see Section 8. We don't use tracking, advertising, or analytics cookies; we don't run any analytics or tracking service at all.

3. How we use it

• To operate the Service — authenticate you, show you the workspaces you have access to, and sync content with a connected Jira project when your organization sets one up.
• To send transactional email — invitations, password/magic-link authentication, and notifications about activity in workspaces you belong to. We don't send marketing email through this system.
• To secure accounts and investigate abuse — the login-attempt log described above exists for this purpose.
• To provide optional AI-assisted features, where your organization has enabled them — see Section 6.

4. Legal basis for processing

Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we process personal data on the following grounds: (a) your consent, given when you sign up, accept a workspace invitation, or otherwise use the Service; and (b) certain legitimate uses recognized under the DPDP Act, such as maintaining account security, preventing fraud, and complying with legal obligations. Where we rely on consent, you can withdraw it at any time by deleting your account, though this may mean you can no longer use the Service.

5. Sub-processors and third parties

We rely on the following third-party service providers to operate X2Bridge:

• Supabase — authentication, our primary database, and file storage for attachments. Our database and storage are hosted in AWS's Mumbai (ap-south-1) region.
• Zoho — delivery of transactional email, including authentication emails.
• Anthropic and/or OpenAI — power optional AI-assisted features. Which provider is used is configurable per organization; content is sent to whichever provider is configured only when an AI feature is actively used.
• Railway — hosts the application itself.

Your own Jira is not a sub-processor of ours. If your organization connects a Jira project, that connection uses credentials your organization provides and controls; we relay data to and from it on your organization's instruction, but it's your organization's own integration, not a service we chose on your behalf.

We don't sell personal data, and we don't share it with anyone for their own marketing purposes.

6. AI-assisted features

Where an organization enables an AI-assisted feature, relevant content (for example, an issue's description) is sent to the configured provider (Anthropic or OpenAI) to generate the requested output. This happens only when the feature is actively invoked, not as background processing over all content.

7. Data retention

We keep account and content data for as long as your organization's workspace exists. When an issue is deleted, we redact its identifying content but preserve status, category, and other fields needed to keep shared statistics for the workspace accurate; low-value child records are permanently deleted. When an account is deleted, we anonymize the profile (email, display name) and best-effort revoke sign-in access, but content that account authored — comments, attachments, sign-offs — remains attributed to an anonymized identity rather than being erased, because it may still be relevant to other members of the workspace. You can request account deletion and a data export yourself from your account settings at any time.

8. Cookies

We use a small number of first-party, functional cookies — none are used for advertising or cross-site tracking:

• Supabase session cookies, to keep you signed in.
• A theme preference cookie (light/dark).
• A sidebar-width preference cookie.
• Short-lived intent cookies used only mid-flow, for things like completing a workspace invitation or a password-recovery step.

9. Data security

Access to workspace data is enforced at the database level, scoped to the specific vendor-customer relationship you've been invited into, not your organization as a whole. File attachments are stored in a private bucket, not publicly accessible by default. Any third-party integration credentials your organization provides (such as Jira credentials) are encrypted at rest.

10. Your rights

Depending on where you're located, you may have rights to access, correct, export, or delete your personal data. You can self-serve an export or deletion of your own account from account settings at any time. Under the DPDP Act, you also have the right to: access a summary of your personal data and the processing activities we carry out on it; request correction or completion of your personal data; request erasure of your personal data (subject to any legal retention requirement); withdraw consent at any time, without affecting the lawfulness of processing before withdrawal; and file a complaint with us, and if unresolved, with the Data Protection Board of India. For anything not self-serviceable in account settings, or to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, contact us at hello@x2bridge.com.

11. International data transfers

Your personal data is primarily hosted in India (AWS's Mumbai region, via Supabase). Where your organization enables an optional AI-assisted feature (Section 6), relevant content may be sent to the configured AI provider (Anthropic or OpenAI), which may process it outside India. Under the DPDP Act, we may transfer personal data outside India except to countries restricted by the Central Government by notification; no such restriction currently applies to our sub-processors. We take reasonable steps to ensure any sub-processor that receives personal data protects it consistently with this Policy.

12. Children's privacy

X2Bridge is a business-to-business tool intended for use by working professionals, not children. We don't knowingly collect personal data from children.

13. Changes to this policy

We may update this Policy from time to time. If a change is material, we'll provide reasonable notice (e.g. email to workspace Admins) before it takes effect.

14. Contact

Questions about this Policy, or a request relating to your data: hello@x2bridge.com. Vivinn Tech Labs, Rayasandra main road, Bangalore. See also our Terms of Service.