xonPlus Logo
Free Check

Privacy Policy

How xonPlus collects, uses, and protects your data

Your Privacy Matters to Us

TL;DR

We don't sell your account or monitoring data. We use cookies for analytics, and our marketing site uses a visitor identification service that may associate your visit with a business email address. You can opt out of that below. We comply with GDPR. You can delete your account anytime by emailing us. For details, read below.

Last Updated: 02-October-2026

This document explains how we handle your data. We aim to keep things clear so you can use our services with confidence.

How We Collect Information

  • Direct InformationWhen you create an xonPlus account or register domains or email addresses for monitoring, we collect your work email address and the identifiers you choose to monitor. Sign-in uses passwordless magic links, so we never store a password for you. This lets us alert you to data breaches and operate your subscription.
  • Device & Usage MetricsWhen you visit xonPlus, we automatically fetch non-personal data like your IP address, device type, and browser. This is standard for most websites and helps us optimize our platform for users like you.
  • Behavior AnalyticsWe use cookies and analytics tools, notably Google Analytics and PostHog, on our marketing site and inside the xonPlus dashboard to understand usage patterns. They show us which features are used and which need improvement, and are configured to minimise the capture of identifiable data. Both are listed as sub-processors in our DPA.
  • Visitor IdentificationOn our public marketing pages, we use a business visitor identification service to see which companies are evaluating xonPlus. Unlike the analytics above, this can associate a visit with a named professional and a work email address. Full details and opt-out links are in the Visitor Identification section below.

How and Why We Use Your Data

  • Safety Protocols: We'll promptly alert you about any data breaches.
  • Service Enhancement: Usage data guides improvements to the platform.
  • Demographics and Analysis: Audience insights help us tailor the product, and we do not use them for any other purpose.

Your Privacy: Our Commitment

We do not sell the data you entrust to us. Your account details, monitored domains, employee identifiers, and breach alerts stay between you and us, and we'll shield them from third parties unless there's a legal imperative. And even then, we'll fight for your right to privacy.

There is one exception worth stating plainly. On our public marketing pages, not the product itself, we use the visitor identification service described below, and that service works by matching site visits against third-party identity data. If you are not comfortable with that, please use the opt-out links in the section below.

Visitor Identification on Our Marketing Site

We use RB2B, a business visitor identification service, on our public marketing pages to understand which companies and professionals are evaluating xonPlus. It runs only on those marketing pages. It is not part of the xonPlus product, and it has no access to your account, your monitored domains, or your breach alerts.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

If you are in the EEA or UK, you can also opt out of this collection under GDPR at https://www.rb2b.com/rb2b-gdpr-opt-out. Browser tracking protection and most ad blockers will also prevent it from running, and we don't try to work around them.

Security Measures

We take the security of your data seriously. Our approach covers several layers:

Technical Measures & Administrative Protocols:

  • Encrypted Connections: All communication between your device and our servers is encrypted, providing a secure channel for your data.
  • Firewall Protections: Our platform runs on Google Cloud, with Cloudflare's web application firewall in front.
  • Up-to-date Security: Our API runs on Google's infrastructure, while static pages are hosted on Cloudflare.
  • Minimal Data Interaction: We restrict data access to a need-to-know basis, ensuring that only API can interface with user data.

GDPR Compliance & Data Protection

xonPlus is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws. We process personal data lawfully, transparently, and only for specified, legitimate purposes.

For all GDPR-related requests, data subject access requests, or privacy concerns, please contact us at help[@]xposedornot.com. We will respond to your request within 30 days as required by GDPR.

Your Data Rights Under GDPR

We acknowledge and uphold your data rights. Here's how they apply to our platform:

Right to Access

To view breach exposure associated with your email, search at xposedornot.com or use the authenticated search in your xonPlus dashboard. For an export of your account data, contact help[@]xposedornot.com.

Right to Rectification

Discovered discrepancies in your personal data? Contact us at help[@]xposedornot.com and we'll take steps to rectify them promptly.

Right to Erasure (Right to be Forgotten)

Given the nature of our breach monitoring platform, completely erasing breach data isn't feasible as it serves public security interests. However, we offer a Privacy Shield feature that ensures your email address isn't publicly searchable while maintaining security monitoring capabilities.

Right to Restrict Processing

If you'd rather certain data not be processed or displayed, activate the Privacy Shield. This acts as a protective barrier, preventing your email address from appearing in public searches while maintaining essential security functions.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Contact help[@]xposedornot.com to request a data export.

Right to Object

You can object to processing of your personal data for direct marketing purposes at any time. For monitoring services, you can unsubscribe or enable Privacy Shield to limit public visibility.

Lawful Basis for Processing

If you use xonPlus on behalf of a business, we process the identifiers you submit and the results we generate for you as your processor, on your documented instructions, under our Data Processing Agreement. The DPA also explains the difference between stateless API lookups, where the identifiers you query are never retained, and persistent monitoring, where registered domains and email addresses are kept for the life of your subscription. For the processing where we act as controller, we rely on the following lawful grounds under GDPR:

  • Consent: When you register an email address for consumer breach alerts, you consent to receive notifications for that address
  • Legitimate Interests: Processing publicly available breach data serves legitimate security interests in protecting individuals and organizations from cyber threats
  • Contract Performance: Processing necessary to deliver the services you've subscribed to
  • Legal Obligations: Compliance with applicable laws and regulations governing data security and breach notifications

Data Retention

  • Account Data: Retained for as long as your account is active or as needed to provide services
  • Breach Data: Historical breach records are retained indefinitely for security research and threat intelligence purposes. See Our Data for sourcing, verification, and the legal basis, and Privacy Shield below for the individual remedy
  • Monitoring Subscriptions: Registered domains and email addresses, alert preferences, and monitoring configurations are retained until you cancel the service
  • API Lookups: The emails and domains you look up through the API are processed in memory and never stored. Request metadata (API key identifier, timestamp, source IP address, endpoint, and response status) is retained for a limited period for billing, rate limiting, security, and abuse prevention, and then deleted
  • Passwords: None. Sign-in uses passwordless magic links, so there is no password for us to store
  • Analytics Data: Anonymized usage data may be retained for service improvement and security purposes
  • Legal Retention: Some data may be retained longer when required by law or for legitimate legal purposes

To request deletion of your account data, contact help[@]xposedornot.com. Please note that publicly sourced breach data will remain for security purposes but can be shielded from public searches via Privacy Shield.

Sub-processors & International Transfers

A current list of our sub-processors (hosting, CDN, email, payments, and analytics) is maintained in Annex 3 of our Data Processing Agreement, with at least 30 days' notice before any addition or replacement. For customers in the EEA and UK, cross-border transfers are safeguarded by the Standard Contractual Clauses incorporated into the DPA.

Policy Evolutions

Our commitment to you means our Privacy Policy might change, reflecting new best practices or legal requirements. Whenever this happens, we'll communicate directly and transparently. So, keep an eye on our official policy page.

Acceptable Use Policy (AUP)

xonPlus exists to promote awareness of data breaches. By using our services, you agree to use them responsibly, in line with our standards and the laws of your jurisdiction.

Contact Us

For questions or concerns about this Privacy Policy, GDPR requests, or data protection inquiries, please contact us at:

Email: help[@]xposedornot.com

Twitter: xonPlus