Privacy Policy

Last updated: 27 October 2026 • Questions: hello@xonik.com

1. Who we are

XONIKA3 is a business application run by XONIK ("we", "us"). This policy explains what personal data the service handles, why, and the choices you have. Contact us at hello@xonik.com about anything in it.

2. Two kinds of data

• Your account. When you sign up, accept an invitation or sign in, we handle your name, email address and password. For this data we decide how it is used.
• Your organization's records. Contacts, deals, invoices, tickets, bookings, form answers and other records that you or your team put in belong to your organization. We store and process them only to run the service for you, following your organization's instructions. Your organization is responsible for having a lawful reason to hold that data.

3. What we collect and why

• Account details (name, email, organization, role): to create your account, sign you in and let your team work together.
• Password: never stored as typed. We keep only a salted scrypt hash.
• Sign-in sessions (time, IP address, browser type): to keep you signed in, to let you or us end sessions, and to protect accounts.
• Security signals (IP address, request counts): to limit repeated sign-in, sign-up, password-reset and form attempts. For public form answers we store only a one-way hash of the sender's IP address.
• Consent record: the date you accepted these terms and which version.
• People who fill in a form or book a meeting through a link our customer shares: the answers they give (for example name, email, phone, message, chosen time), used to deliver that form or booking to the customer.

We do not sell personal data, we do not use it for advertising, and we do not add tracking or analytics cookies.

4. Emails we send

Only service emails: team invitations, booking confirmations, replies to support tickets, and password-reset links. Each is recorded so administrators can see whether it was sent. We do not send marketing email.

5. Services that help us run XONIKA3

• Cloud server hosting: stores the database and runs the application.
• Amazon Web Services (Simple Email Service, Mumbai region): delivers the emails above.
• Cloudflare: domain and network protection, and the "verify you are human" check (Turnstile) on sign-in, sign-up, password reset and booking pages. Cloudflare receives technical data about your browser for that check. See Cloudflare's privacy policy.

These providers process data only to provide their service to us.

6. Browser storage and cookies

The app keeps your sign-in in your browser's session storage, which is cleared when you close the tab. Cloudflare may set a strictly necessary security cookie. There are no advertising or analytics cookies.

7. How long we keep data

Account data is kept while your account is active. Your organization's records are kept until your organization deletes them or asks us to. Financial records (invoices, payments and accounting entries) cannot be edited after posting, because accounting rules require a complete history. To close an account or ask for deletion, email hello@xonik.com.

8. How we protect data

• All traffic is encrypted with HTTPS.
• Each organization's records are separated inside the database by row-level security, so one organization cannot read another's data.
• Passwords are hashed; password-reset links work once and expire after 1 hour; resetting a password signs you out on every device.
• Access inside an organization follows the roles its owner assigns.

9. Your rights

You can ask to see, correct or delete your personal data, or withdraw consent, by emailing hello@xonik.com. Depending on where you live, laws such as India's Digital Personal Data Protection Act, 2023 or the EU General Data Protection Regulation may give you further rights. If your data is in an organization's records (for example as one of their customers), please contact that organization first; we will help them respond.

10. Changes

If this policy changes, we will update the date above. If a change is significant, we will ask you to accept the new version.