Privacy Policy
How xonPlus collects, uses, and protects your data
Your Privacy Matters to Us
TL;DR
We don't sell your account or monitoring data. We use cookies for analytics, and our marketing site uses a visitor identification service that may associate your visit with a business email address — you can opt out of that below. We comply with GDPR. You can delete your account anytime by emailing us. For details, read below.
Last Updated: 02-August-2026
This document explains how we handle your data. We aim to keep things clear so you can use our services with confidence.
How We Collect Information
- Direct InformationWhenever you sign up for our Alert Me or Domain Monitoring service, we request details like your email. This lets us get in touch and serve you better by alerting you of data breaches.
- Device & Usage MetricsWhen you visit xonPlus, we automatically fetch non-personal data like your IP address, device type, and browser. This is standard for most websites and helps us optimize our platform for users like you.
- Behavior AnalyticsWith the aid of cookies and tools, notably Google Analytics and PostHog, we dive deep into usage patterns. These tools tell us which features are hits and which need improvement, not who you are as an individual.
- Visitor IdentificationOn our public marketing pages, we use a business visitor identification service to see which companies are evaluating xonPlus. Unlike the analytics above, this can associate a visit with a named professional and a work email address. Full details and opt-out links are in the Visitor Identification section below.
How and Why We Use Your Data
- Safety Protocols: We'll promptly alert you about any data breaches.
- Service Enhancement: We're always looking to level up. Your data guides our improvements.
- Demographics and Analysis: By understanding our audience, we can tailor-make experiences, but we'll never misuse this privilege.
Your Privacy: Our Commitment
We do not sell the data you entrust to us. Your account details, monitored domains, employee identifiers, and breach alerts stay between you and us, and we'll shield them from third parties unless there's a legal imperative. And even then, we'll fight for your right to privacy.
We want to be straight with you about the one exception. On our public marketing pages — not the product itself — we use the visitor identification service described below, and that service works by matching site visits against third-party identity data. If that isn't something you're comfortable with, the opt-out links are right there and we'd rather you use them than be surprised later.
Visitor Identification on Our Marketing Site
We use RB2B, a business visitor identification service, on our public marketing pages to understand which companies and professionals are evaluating xonPlus. It runs only on those marketing pages. It is not part of the xonPlus product, and it has no access to your account, your monitored domains, or your breach alerts.
When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.
If you are in the EEA or UK, you can also opt out of this collection under GDPR at https://www.rb2b.com/rb2b-gdpr-opt-out. Browser tracking protection and most ad blockers will also prevent it from running, and we don't try to work around them.
Security Measures
At xonPlus, ensuring the safety of your data isn't just a commitment, it's our ethos. Our approach to data security is multifaceted:
Technical Measures & Administrative Protocols:
- Encrypted Connections: All communication between your device and our servers benefits from advanced encryption, providing a secure channel for your data.
- Firewall Protections: Our platform runs on Google Cloud, with Cloudflare's web application firewall in front.
- Up-to-date Security: Our API runs on Google's infrastructure, while static pages are hosted on Cloudflare.
- Minimal Data Interaction: We restrict data access to a need-to-know basis, ensuring that only API can interface with user data.
Harnessing these comprehensive measures, we aim to make your experience with xonPlus not just beneficial but also secure.
GDPR Compliance & Data Protection
xonPlus is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws. We process personal data lawfully, transparently, and only for specified, legitimate purposes.
For all GDPR-related requests, data subject access requests, or privacy concerns, please contact us at help[@]xposedornot.com. We will respond to your request within 30 days as required by GDPR.
Your Data Rights Under GDPR
We acknowledge and uphold your data rights. Here's how they apply to our platform:
Right to Access
To view any data associated with your email, simply use the search function on our homepage or our authenticated search if you're logged in. For a comprehensive data export, contact help[@]xposedornot.com.
Right to Rectification
Discovered discrepancies in your personal data? Contact us at help[@]xposedornot.com and we'll take steps to rectify them promptly.
Right to Erasure (Right to be Forgotten)
Given the nature of our breach monitoring platform, completely erasing breach data isn't feasible as it serves public security interests. However, we offer a Privacy Shield feature that ensures your email address isn't publicly searchable while maintaining security monitoring capabilities.
Right to Restrict Processing
If you'd rather certain data not be processed or displayed, activate the Privacy Shield. This acts as a protective barrier, preventing your email address from appearing in public searches while maintaining essential security functions.
Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format. Contact help[@]xposedornot.com to request a data export.
Right to Object
You can object to processing of your personal data for direct marketing purposes at any time. For monitoring services, you can unsubscribe or enable Privacy Shield to limit public visibility.
Lawful Basis for Processing
We process personal data based on the following lawful grounds under GDPR:
- Consent: When you sign up for alerts or monitoring services, you provide explicit consent for data processing
- Legitimate Interests: Processing publicly available breach data serves legitimate security interests in protecting individuals and organizations from cyber threats
- Contract Performance: Processing necessary to deliver the services you've subscribed to
- Legal Obligations: Compliance with applicable laws and regulations governing data security and breach notifications
Data Retention
- Account Data: Retained for as long as your account is active or as needed to provide services
- Breach Data: Historical breach records are retained indefinitely for security research and threat intelligence purposes — see Our Data for sourcing, verification, and the legal basis, and Privacy Shield below for the individual remedy
- Monitoring Subscriptions: Alert preferences and monitoring configurations are retained until you cancel the service
- Analytics Data: Anonymized usage data may be retained for service improvement and security purposes
- Legal Retention: Some data may be retained longer when required by law or for legitimate legal purposes
To request deletion of your account data, contact help[@]xposedornot.com. Please note that publicly sourced breach data will remain for security purposes but can be shielded from public searches via Privacy Shield.
Sub-processors & International Transfers
A current list of our sub-processors (hosting, CDN, email, payments, and analytics) is maintained in Annex 3 of our Data Processing Agreement, with at least 30 days' notice before any addition or replacement. For customers in the EEA and UK, cross-border transfers are safeguarded by the Standard Contractual Clauses incorporated into the DPA.
Policy Evolutions
Our commitment to you means our Privacy Policy might change, reflecting new best practices or legal requirements. Whenever this happens, we'll communicate directly and transparently. So, keep an eye on our official policy page.
Acceptable Use Policy (AUP)
xonPlus is a platform rooted in ethical values. We're all about promoting awareness around data breaches. By engaging with our services, you pledge to do so responsibly, abiding by our standards and the prevailing laws in your jurisdiction.
Contact Us
For questions or concerns about this Privacy Policy, GDPR requests, or data protection inquiries, please contact us at:
Email: help[@]xposedornot.com
Twitter: xonPlus