Privacy Policy

XATHARI PRIVACY POLICY

‍

EFFECTIVE DATE: September 4, 2026

LAST REVISED: September 4, 2026

‍

THIS PRIVACY POLICY (“POLICY”) DISCLOSES THE DATA PROTECTION, PRIVACY, AND TELEMETRY

 PRACTICES OF XATHARI, LLC, A CALIFORNIA LIMITED LIABILITY COMPANY (“XATHARI,” “WE,” “US,” OR “OUR”). THIS POLICY APPLIES TO ALL INDIVIDUALS, VISITORS, SMB CUSTOMERS, ADVERTISERS, VENUE HOSTS, AND END USERS (“YOU” OR “DATA SUBJECTS”) WHO ACCESS OUR WEBSITE ([https://www.xathari.com](https://www.xathari.com)), UTILIZE OUR SOFTWARE-AS-A-SERVICE (“SaaS”) PLATFORM, INTERACT WITH OUR DIGITAL SIGNAGE DISPLAYS, ENGAGE WITH OUR CUSTOMER ENGAGEMENT PLATFORM (“CEP”), OR ENTER VENUES OPERATING XATHARI HARDWARE AND SENSOR INFRASTRUCTURE.

PLEASE READ THIS POLICY CAREFULLY TO UNDERSTAND HOW WE COLLECT, USE, PROCESS, STORE, DISCLOSE, AND PROTECT YOUR INFORMATION ACROSS OUR ENTIRE UNIFIED PRODUCT SUITE.

‍

1. SCOPE & APPLICABILITY

• 1.1 Unified Architecture: This Policy governs data processing activities across all Xathari operational modules, including:
  
  • Xathari Web & Dashboard Platforms: Account creation, billing, campaign management, SSO authentication via Microsoft Entra ID, and support ticketing;
  • Ads Platform & Demand-Side Engine: Ad serving (powered by adserver.online), ad creative moderation (via SightEngine), impression logging, QR code scans, dynamic banner engagements, and fraud detection (via IPASIS), and programmatic exchange integrations with third-party demand partners;
  • Customer Engagement Platform ("CEP") Analytics: Dynamic QR code redirects, NFC tap tracking, geolocation resolution (via ipgeolocation.io), and UTM attribution pipelines;
  • Content Management System ("CMS"): Xathari Intelligent Signage media storage, schedule distribution, player logs, and upstream Flipnode LLC (d/b/a Yodeck) processing;
  • Hardware-as-a-Service ("HaaS") & Network Telemetry: Media player health, cellular modem pings, power usage sensor status, and display diagnostics;
  • Communications & Impact Tracking: System/transactional email delivery via Brevo and earth-positive sustainability tracking via Conscious Ventures Ltd (d/b/a Greenspark); and
  • Managed Services: Creative asset management, custom campaign telemetry, and installation support.
• 1.2 Controller vs. Processor Roles
  
  • Xathari as Data Controller: We act as a Data Controller with respect to personal information collected directly from our website visitors, registered SMB customers, account administrators, advertisers, and prospective clients for billing, account management, marketing, and legal compliance.
  • Xathari as Data Processor / Service Provider: We act as a Data Processor (or Service Provider under US privacy laws) on behalf of our SMB Customers and Venue Hosts ("Controllers") with respect to venue analytics, QR/NFC interactions, and media content uploaded to the CMS. In these scenarios, our processing activities are governed strictly by our Data Processing Addendum ("DPA") and customer instructions.

‍

2. INFORMATION WE COLLECT ACROSS OUR PRODUCT SUITE

We collect information directly from you, automatically through your interactions with our digital platforms and venue hardware, and from third-party partners.

• 2.1 Information You Provide to Us Directly
  
  • Account & Registration Data: When you sign up for an Account, we collect your name, business name, and business email address. Single sign-on, multi-factor authentication, and identity verification are managed via Microsoft Entra ID. Optional additional profile information (such as job title or direct phone number) may be voluntarily provided upon request in order to facilitate improved communications or enable additional services.
  • Billing & Payment Information: All payment processing, bank account routing, credit card collection, billing addresses, and tax identification numbers are handled directly by our PCI-DSS compliant third-party payment processor (Stripe, LLC). Xathari does not collect or directly store raw payment card numbers, bank details, or full billing addresses on its servers. Xathari retains the truncated last four digits of a saved payment card, provided by Stripe, solely to allow you to identify and select which saved card to use for a transaction.
  • Customer Content & Media: Text, images, video files, logos, dynamic layout widgets, brand guidelines, and audio files uploaded to the CMS or Ads Platform for display on network screens or web properties.
  • Communications & Support Tickets: Records of email correspondence sent via Brevo, support desk requests, platform feedback, and communication logs submitted directly to Xathari.
• 2.2 Information Collected Automatically via Digital Signage & Hardware Infrastructure
  
  • HaaS Device & System Telemetry: Serial numbers, MAC addresses of Xathari media players, IP addresses, cellular modem identifiers, operating system build versions, CPU/memory usage, core temperature, storage health, display resolution, HDMI status, electrical power usage sensor status, and signal strength.
  • Proof-of-Play ("PoP") Event Logs: Cryptographic timestamps, campaign identifiers, screen location tags, creative file hashes, rendering duration, playback verification logs, and error codes associated with ad or content display.
  • CEP Presence & Engagement Telemetry: Technical and interaction data collected by venue hardware and redirection nodes, including:
    
    • Electrical Power Usage & Player Telemetry: Device power consumption logs and hardware telemetry used to verify active playback and screen operational status.
    • Dynamic QR Code & NFC Tap Interactions: Timestamps, aggregate IP addresses, user-agent strings, venue location tags, device browser languages, coarse geolocation metrics (resolved via ipgeolocation.io), and UTM tracking parameters captured when a venue visitor scans a dynamic QR code or taps an NFC emblem displayed on or near a network screen.
    • Fraud Verification Data: Request IP addresses and user-agent strings processed via IPASIS to verify campaign validity, detect invalid traffic (IVT), and evaluate email risk.
• 2.3 Web & Platform Analytics (Cookies, Consent Management, & Edge Infrastructure)
  
  • Cookies & Consent Management: When you access xathari.com, our Webflow front-ends, or our Xano-powered dashboards, cookie choices and consent states are managed and audited via Cookiebot (Usercentrics A/S). We use session and persistent cookies, web beacons, pixel tags, and local storage objects to authenticate users, maintain session state, remember preferences, and analyze traffic.
  • Analytics & Data Warehousing: We collect site navigation, telemetry, and platform usage metrics using Google Analytics 4 (GA4) and store long-term analytical records within Google BigQuery.
  • Edge Security & Web Risk: Traffic passing through our web properties is routed through Cloudflare for CDN delivery, DDoS mitigation, and edge filtering. Outbound links and user-submitted URL destinations are checked against Google Web Risk to identify malicious or deceptive destinations.
  • Log Data: Web browser type, language preferences, referring/exit pages, operating system, date/time stamps, clickstream data, and IP addresses.
  • Programmatic Advertising & Bid-Stream Data: When ads are served through connected exchange, header-bidding, publisher, or digital-out-of-home demand partners, bid requests and responses may include device advertising identifiers (such as IFA, GAID, or IDFA), IP addresses, precise geolocation (latitude and longitude) where transmitted, browser and device attributes, cookie-matched user identifiers, audience segment identifiers, and privacy preference signals (such as GPP strings).

‍

3. HOW WE USE YOUR INFORMATION

We process collected information strictly for legitimate business, legal, and operational purposes, including:

• Service Delivery & Platform Operation: To provision accounts, authenticate logins via Microsoft Entra ID, route media files, schedule screen playlists, render ads via adserver.online, moderate ad creatives via Sightengine, execute programmatic ad sales, process payments via Stripe, send transactional emails via Brevo, and calculate revenue shares.
• Proof of Play & Ad Attribution: To generate verifiable, cryptographic Proof-of-Play (PoP) logs, measure campaign impression delivery, verify ad loop integrity, process UTM attribution, and validate campaign engagement for advertisers.
• CEP Venue Analytics: To provide venue hosts and advertisers with aggregated, non-identifiable engagement metrics, QR/NFC interaction counts, coarse geolocation trends via ipgeolocation.io, peak activity times, and campaign conversion trends.
• Hardware Health & Network Maintenance: To monitor media player connectivity, power draw, and cellular signal; push remote firmware updates; diagnose hardware component failures; issue RMA dispatches; and optimize network band utilization.
• System Optimization & Security: To generate Anonymized & Aggregated Data used to optimize yield algorithms, benchmark industry conversion rates, detect invalid traffic (IVT) via IPASIS, audit platform URLs via Google Web Risk, and enhance software security across our Webflow, Xano, and Cloudflare architectures.
• Customer Support & Communications: To respond to technical support inquiries, deliver transactional messages and alerts via Brevo, communicate billing updates, and provide platform security notifications.
• Sustainability Tracking: To calculate, verify, and display earth-positive environmental impact metrics associated with platform usage via Conscious Ventures Ltd (d/b/a Greenspark).
• Legal, Compliance, & Fraud Prevention: To enforce our Master Terms of Service, Acceptable Use Policy (AUP), and contracts; detect and prevent ad fraud; and comply with legal obligations, tax laws, or court subpoenas.

‍

4. HOW WE SHARE AND DISCLOSE YOUR INFORMATION

Xathari does not sell personal data to third parties for monetary consideration. Where Xathari's programmatic advertising integrations are active, Xathari shares bid-stream data with advertising exchange and demand partners for cross-context behavioral advertising as described in Section 4.5, and you may opt out of that sharing as described in Section 7.1. We disclose processed data only under the following limited circumstances:

• 4.1 Sub-Processors & Service Providers: We share data with trusted third-party vendors, sub-processors, and infrastructure partners who perform operational services on our behalf, subject to strict contractual confidentiality, security terms, and Data Processing Addenda (DPAs):

‍

Note: Client-side rendering libraries (Chart.js, Tabulator, Leaflet.js) execute within your browser without sending personal data to external servers, and zipopotam.us is an anonymous public postal API, classified as a software dependency rather than a Data Sub-processor only to the extent it does not receive or process any personal information, persistent identifiers, or metadata linkable to a consumer or device. If it processes any such information, it shall instead be treated as a Sub-processor.

‍

• 4.2 Venue Hosts & Advertisers: We provide SMB venue hosts and advertisers with aggregated, anonymized reports, campaign performance metrics, impression totals, UTM conversion logs, and CEP engagement analytics. These reports do not contain personal information or individual device identifiers.
• 4.3 Corporate Transactions: In the event of a merger, acquisition, corporate reorganization, asset sale, bankruptcy, or insolvency, customer information and system database assets may be transferred to the acquiring or successor entity as part of due diligence and transaction execution. If the successor entity intends to materially alter how it uses or discloses personal information in a manner inconsistent with the practices described in this Policy at the time the information was collected, it will provide prior, prominent notice to affected individuals before implementing that change.
• 4.4 Legal Obligations & System Protection: We reserve the right to disclose personal or telemetry data to government authorities, law enforcement agencies, or private litigants if required to do so by law, court order, search warrant, or subpoena, or if we reasonably believe such disclosure is necessary to:

• Comply with applicable legal or regulatory mandates;
• Enforce our Master ToS, HaaS Agreements, or incorporated policies;
• Protect the safety, rights, or property of Xathari, our customers, venue visitors, or the general public; or
• Prevent, investigate, or address active security breaches, cyberattacks, or financial fraud.

• 4.5 Advertising Exchange & Demand Partners: When ad inventory is filled through exchange, header-bidding, or other programmatic demand partners, the bid-stream data described in Section 2.3 is disclosed to those partners, which may use it for their own purposes, including building or enriching user profiles across services. These partners are independent third parties, not service providers acting on Xathari's behalf. Xathari transmits applicable opt-out preference signals, including Global Privacy Platform (GPP) strings reflecting Global Privacy Control (GPC) opt-outs, with each bid request and requires demand partners to honor them.

‍

5. DATA RETENTION SCHEDULE

Xathari retains collected information only as long as necessary to fulfill the operational purposes for which it was gathered, satisfy legal requirements, resolve disputes, and enforce our contracts:

‍

‍

If a specific category of personal information is not listed above, we determine its retention period based on the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and whether we can achieve the purposes of processing through other means.

‍

6. DATA SECURITY & PROTECTION MEASURES

Xathari implements multi-layered administrative, physical, and technical safeguards engineered to protect personal and system data:

• Encryption Controls: All data in transit across public networks, APIs, Webflow front-ends, Xano backends, and CMS channels is encrypted using TLS 1.2/1.3 protocols. Data at rest across cloud databases, object storage, and media player devices is encrypted using AES-256 bit encryption algorithms.
• Authentication & Access Control: Access to administrative backends and production infrastructure is controlled via Microsoft Entra ID with multi-factor authentication (MFA), role-based access controls (RBAC), and strict principle of least privilege access.
• Edge-Level Privacy: Interactive engagements (QR scans and NFC taps) and network telemetry are stripped of unnecessary identifiers before cloud consolidation.
• System Vulnerability Audits: We conduct periodic vulnerability scans, code reviews, and infrastructure testing across our Webflow, Xano, Cloudflare, and ad server infrastructure to identify and remediate security risks.

While we employ industry-standard security safeguards, no cloud transmission, wireless network, or digital storage architecture can be guaranteed 100% secure.

‍

7. REGIONAL PRIVACY RIGHTS & JURISDICTIONAL DISCLOSURES

• 7.0 Data Subject Request Routing: Controller vs. Processor Data: Because Xathari acts in different roles depending on the data at issue (see Section 1.2), how we handle your rights request depends on which role applies:
  
  • Where Xathari is the Controller (e.g., your own SMB account, billing, and registration data), Xathari will respond to and fulfill your request directly, as described in this Section 7.
  • Where Xathari is a Processor or Service Provider (e.g., venue/publisher visitor data collected via CEP analytics, QR/NFC interactions, or CMS content on behalf of a Customer or Venue Host), Xathari does not have a direct relationship with you as the data subject. In accordance with DPA Section 6.2, Xathari will promptly route your request to the relevant Customer or Venue Host, who is responsible for responding to you as the Controller of that data, and will notify that party within the timeframe specified in the DPA.
• 7.1 California Consumer Privacy Rights (CCPA/CPRA): If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives you the rights described in this Section 7.1 to the extent the CCPA applies to Xathari's processing of your personal information.

• Right to Know / Access: You may request disclosure of the specific pieces and categories of personal information Xathari has collected about you, the categories of sources, the business or commercial purposes for collecting, selling, or sharing it, and the categories of third parties to which it has been disclosed.
• Right to Delete and Right to Correct: You may request deletion of personal information Xathari has collected from you, subject to legally recognized exceptions, and correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: Where Xathari's programmatic advertising integrations are active, Xathari shares bid-stream data (including device identifiers, IP addresses, and, where transmitted, precise geolocation) with advertising exchange and demand partners for cross-context behavioral advertising, which is "sharing" and may be a "sale" under the CCPA. You may opt out through the "Do Not Sell or Share My Personal Information" link on our homepage, by enabling a Global Privacy Control (GPC) signal in your browser, or by contacting us as described in Section 11.
• Right to Limit the Use of Sensitive Personal Information: Precise geolocation processed through programmatic advertising is sensitive personal information under the CCPA. Where Xathari uses or discloses sensitive personal information beyond the purposes the CCPA permits, you may direct Xathari to limit that use through the "Limit the Use of My Sensitive Personal Information" link on our homepage or by contacting us as described in Section 11.
• Non-Discrimination, Verification, & Submission: Xathari will not discriminate against you for exercising any CCPA right. You may submit a request by emailing [email protected] with the subject line "CCPA Consumer Request" or through our online contact form at https://www.xathari.com/contact. Xathari verifies account holders through account credentials or email verification, verifies non-account holders by matching the request against the interaction data available to it, and routes requests as described in Section 7.0.
• Minors: Xathari does not knowingly sell or share the personal information of consumers under sixteen (16) years of age without the opt-in consent the CCPA requires.

• 7.2 Reviewing and Updating Your Information: You may review the personal information tied to your Account and request corrections or updates by signing in to your Account dashboard or by emailing [email protected]. Xathari responds to verified requests from account holders. For information Xathari processes on behalf of a Customer or Venue Host, Xathari routes your request as described in Section 7.0.

• 7.3 Do Not Track and Online Tracking: Some web browsers transmit Do Not Track (“DNT”) signals. Xathari does not currently respond to DNT signals. Xathari honors Global Privacy Control (GPC) signals as a valid request to opt out of the sale or sharing of personal information for the browser or device sending the signal, and transmits the corresponding opt-out status to demand partners through Global Privacy Platform (GPP) signals. Third parties may collect personally identifiable information about your online activities over time and across different websites and online services when you use xathari.com and the Services, including through the analytics and advertising providers identified in Section 4.
• 7.4 European Economic Area (EEA), UK, & International Data Rights (GDPR): If you are located within the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, your privacy rights are governed by applicable data protection laws:
  
  • Legal Bases for Processing:
    
    • Contractual Necessity: To fulfill our Master ToS, process billing via Stripe, authenticate via Microsoft Entra ID, or deliver SaaS/HaaS services.
    • Legitimate Interests: To secure our network via Cloudflare, prevent fraud via IPASIS, moderate creatives via SightEngine, improve system performance, and analyze aggregate venue engagement.
    • Consent: Where required by law for specific marketing cookies, consent preference tracking via Cookiebot, or local venue notices.
    • Legal Obligation: To comply with tax, statutory, or regulatory requirements.
  • Data Subject Rights: You have the right to request access to, rectification of, erasure of, or restriction of processing of your personal data; the right to data portability; and the right to object to processing. You also have the right to lodge a complaint with your local Data Protection Authority (DPA).
  • Cross-Border Transfers: Personal data collected by Xathari is transferred to and processed in the United States and other international jurisdictions. Where cross-border data transfers occur, Xathari relies on Standard Contractual Clauses (SCCs) incorporated into our DPA and, where Xathari or the receiving party maintains an active certification, the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF.

‍

8. CHILDREN’S PRIVACY PROTECTION

Xathari Services, web platforms, and ad networks are designed strictly for commercial enterprises, business customers, and general public venue audiences. Our platforms are not directed to, and we do not knowingly collect personal information from, children under thirteen (13) years of age, consistent with the Children's Online Privacy Protection Act ("COPPA"). Separately, to the extent the California Age-Appropriate Design Code Act ("CAADCA") applies to any Xathari-operated online service likely to be accessed by children, Xathari will comply with the Act's currently enforceable requirements, including the coverage, age-estimation, default privacy-setting, and policy-transparency provisions left in effect by the Ninth Circuit's March 12, 2026 decision in NetChoice v. Bonta. Portions of the CAADCA, including its data-use restrictions, dark-pattern prohibition, and impact-assessment requirements, remain enjoined and subject to ongoing litigation as of the date of this Policy; this section will be updated as that litigation develops.

If we learn that we have inadvertently collected personal information directly from a child under thirteen (13) without verifiable parental consent, we will take immediate steps to delete such information from our active databases.

‍

9. THIRD-PARTY LINKS & VENUE SITES

Our websites, dashboards, dynamic QR code redirects, NFC landing pages, and CMS widgets may contain links to third-party websites, applications, or external services that are not owned or controlled by Xathari. This Policy applies solely to information collected by Xathari. We assume no responsibility or liability for the privacy practices, content, security, or policies of any third-party websites or services. We encourage you to review the privacy policies of any third-party platform you visit.

‍

10. POLICY MODIFICATIONS & NOTIFICATIONS

Xathari reserves the right to amend, update, or revise this Privacy Policy at any time to reflect changes in our business practices, technology deployment, legal requirements, or vendor relationships. When material updates are made, we will update the "Last Revised" date at the top of this Policy and post the revised version at [https://www.xathari.com/legal/privacy-policy](https://www.xathari.com/legal/privacy-policy).

For material changes that significantly affect how we handle personal information previously collected from registered SMB account holders, we will provide advance notice by sending an email via Brevo to the primary administrative email address registered on the Account or by displaying a prominent notification banner within the platform administrative dashboard at least thirty (30) days prior to the effective date of the change. Your continued use of the Services following the notice period constitutes your binding acceptance of the updated Privacy Policy. Where applicable law requires it, Xathari will obtain affirmative consent before a material change applies retroactively to personal information collected before the change.

‍

11. CONTACT US & PRIVACY INQUIRIES

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy, our data protection practices, or our telemetry processing, please contact our Privacy Office at:

Xathari, LLC

Attn: Privacy Office

785 Oak Grove Rd, STE E2 PMB4045

Concord, CA 94518

United States of America

‍

Email: [email protected]

‍