Privacy Policy

1. Overview

xengoroute is a product of Synvu Limited (UK company no. 15761962), the company behind the xengo platform. We do not sell your personal data, and we only use your information to operate the service.

2. What We Collect

We collect data when you create an account at app.xengoroute.com, use the service, scan or interact with GS1 Digital Link codes and short links, contact us, or engage with our marketing.

We process timestamps, IP addresses, approximate geolocation, device specifications, browser information and cookies. Scans of customer codes are processed as event data on behalf of the account that owns the code.

3. Purposes and Legal Bases (UK GDPR)

For each purpose we process personal data under one of the lawful bases in Article 6 UK GDPR:

• Providing the service (accounts, links, GS1 Digital Link resolution, billing) — performance of a contract (Art. 6(1)(b)).
• Security, fraud prevention and abuse monitoring — legitimate interests (Art. 6(1)(f)).
• Analytics and advertising measurement (Google Analytics, Microsoft Clarity, ad-click attribution) — your consent (Art. 6(1)(a)), collected via the cookie banner for UK/EU visitors; you can withdraw it at any time (see Cookies below).
• Marketing emails — your consent, with a working unsubscribe link in every message.
• Tax, accounting and legal obligations — legal obligation (Art. 6(1)(c)).

4. Cookies and Analytics

The specific tools and cookies this site uses are:

• Essential cookies — sign-in sessions and your cookie choice itself (xengo_consent). Required for the site to work; they do not track you.
• Google Analytics 4 (Google LLC) — aggregate usage statistics. Google collects and receives data where these cookies run; see the Google Privacy Policy. Until you consent, Google tags run in cookieless “consent mode” and set no cookies.
• Microsoft Clarity (Microsoft Corporation) — anonymised session analysis such as scroll depth and heatmaps. Microsoft collects and receives data where Clarity runs; see the Microsoft Privacy Statement.
• Advertising attribution — a first-party cookie (xengo_attr, 90 days) stores the click identifier from an ad you arrived through (for example Google Ads gclid or Microsoft Advertising msclkid) plus campaign UTM labels, so that if you later start a trial we can tell the advertising platform that its ad worked. We report the conversion event only — we never share your name, email or account contents with ad platforms, and no personal or sensitive data is passed to any tag in URLs or parameters.

Consent. If you are visiting from the UK or EU, none of the analytics or advertising cookies above are set until you choose “Accept all” on the cookie banner. Elsewhere they are on by default and you can switch them off with “Essential only”. Change your choice at any time via cookie preferences.

5. Sharing Your Data

We do not sell your personal data. We share data with vendors under contract (cloud hosting on AWS in London, payment processing by Stripe, the analytics tools above), legal authorities where required, professional advisors, and within the Synvu Limited group of companies.

6. Storage, Retention and Security

Data is hosted on AWS in London (eu-west-2). We retain personal data for as long as necessary to deliver the service, resolve disputes and meet legal obligations; billing records are kept as long as the law requires, and anonymised data may be retained indefinitely.

We implement encryption in transit and at rest, role-based access controls and audit logging. No method of transmission or storage is 100% secure.

7. Your Rights and Choices

Under UK GDPR (Articles 15–21) you can access, correct, delete, restrict the processing of, port, or object to the use of your personal data. To make a request, contact us at contact@xengo.io — we respond within one month.

Where processing is based on consent you can withdraw it at any time (Art. 7(3)): use the cookie preferences banner for analytics and advertising cookies, or the unsubscribe link in any marketing email.

If you are unhappy with how we handle your data you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk.

8. Children’s Privacy

xengoroute is a business service, is not designed for users under thirteen years old, and we do not knowingly collect personal data from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time and will note significant changes on this page.