Privacy policy
Xenmark AS, organisation number 937 996 799, Aurvågvegen 150, 6070 Tjørvåg, Norway, is responsible for personal data processed through Xenindex. Contact: support@xenindex.eu.
What we collect
If you submit or manage a listing: your email address, the company details you give us (legal name, registration identifier, country, and the registered address, which we use to check the company and never publish), the listing content and images you upload, the terms version you accepted with the time and IP address, and a record of our review. Other owners of the same listing see a shortened form of your address, such as th***@example.com, and the date you became an owner.
If you take over a listing: your full name and work email address. Only our team sees your name; it is never shown on the listing.
If you report a listing: the reason and details you give, and your email address if you choose to add it.
If you send a complaint about a listing: your name, your organisation, your email address, the listing, what you complain about and the evidence you send, and a scrambled form of your IP address. The listing owner is told which part of the listing the complaint is about and what we decided, never who sent it.
If you buy something: name and billing details, handled by Stripe. We never see or store your card number.
If you write to us: whatever you send.
If you only visit: see Visitors below.
For listings we created ourselves: company information from official public registers and from the company's own public website. No personal data beyond what a company publishes about itself, and never a named individual's email address.
Visitors
We do not use cookies for analytics, and we do not track you between visits.
We count daily totals of how many times the links on a listing were clicked. Those are numbers, stored per day per listing — nothing tied to a person or a device, and nothing that can be traced back to you. We cannot tell a listing owner who visited, because we do not know.
When you send us a form — a submission, a sign-in, a report, a request for access — Cloudflare Turnstile checks that a person is sending it, and we keep a scrambled form of your IP address (it cannot be turned back into the address) to stop one source from flooding us. When you accept our terms, at submission or at checkout, we keep the IP address itself as evidence of the acceptance.
The only cookies are functional ones: they keep a submission in progress, keep you signed in to Manage listing for up to 12 hours, keep the paid options page open for an hour after you open a purchase link or go to it from Manage listing, and remember a Fast-track choice while you pay. None is used for analytics or advertising, and none is shared.
Site analytics use Cloudflare Web Analytics, which is also cookieless.
This is why there is no cookie banner. Cookies that are strictly necessary for something you asked for need no consent, and we use no others.
Why we process it
| What | Why |
|---|---|
| Email, company details, listing content | To provide the service you asked for |
| The register check and its record | To support the one factual claim we make publicly |
| Terms version, time and IP at acceptance | To show what was agreed and when |
| Payment records | Legal obligation — bookkeeping |
| Your full name, when you take over a listing | To know who took a listing over, if that is ever disputed |
| Scrambled IP addresses and the Turnstile check | Our legitimate interest in keeping the forms free of spam and abuse |
| Copies of the emails we sent | To confirm what we sent you and when; decision and payment emails as the record of what we decided or charged |
| Review and enforcement records | To be able to explain a decision we made |
| Complaints and reports | To decide them, tell the people involved what we decided, and show why if the decision is questioned |
| Listings we created ourselves | Our legitimate interest in a useful directory, balanced by: public sources only, factual content only, opt-out honoured without question |
How long we keep it
| What | How long |
|---|---|
| Unfinished drafts | 14 days after expiry (copies of the emails we sent about them: 30 days) |
| Rejected submissions | 30 days |
| The record that a domain was rejected (domain, reason, date) | 12 months, or longer while the domain is blocked |
| Takeover attempts (address, scrambled IP address and the name given) | 90 days |
| The record that a takeover attempt was deleted | 24 months, holding only scrambled values |
| Your full name as an owner | While you are an owner of the listing |
| IP address at submission | With the submission; 30 days if it is rejected |
| IP address at checkout | With the payment record (see below) |
| Checkouts that were not completed (email and IP address) | 30 days after they expire |
| Messages from Stripe about a payment | 90 days (the payment record itself: see below) |
| An email address blocked from buying after a lost card dispute | 5 years after the block |
| Routine emails we sent (sign-in links, confirmations, reminders) | 30 days, as a note of the address, subject and date; we do not keep their text or the links in them |
| Decision and payment emails (approvals, reasons for a rejection, hide or archive, receipts) | 24 months |
| Dispute evidence (a snapshot of the listing and our records) | With the payment record (see below) |
| Archived listings | 12 months; then the content, images, links and owner records are deleted, and only the name and address of the listing stay |
| A company's registered address | While a listing of the company is published, hidden or waiting for review; deleted with the content of its last listing |
| Reports you send, and sources we block for abuse | 24 months after our decision |
| Complaints and our decision on them | 24 months after our decision |
| Sign-in and purchase links we email | Deleted 90 days after they expire |
| Record of actions taken on listings and accounts (it holds no email addresses, IP addresses, names, registered addresses or messages) | 24 months |
| Usage statistics | 24 months |
| Payment and billing records | 5 years after the end of the year of the payment |
Backups keep deleted data for up to 40 days after it is removed from the live system.
Who else processes it
| Who | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt) |
| Cloudflare | Hosting, images, spam protection (Turnstile), analytics, email forwarding | Global network, EU jurisdiction for stored images |
| Stripe | Payments | EU and US, standard contractual clauses |
| Resend | EU and US, standard contractual clauses | |
| Backblaze B2 | Backups | EU; the database copy is encrypted before upload |
| GitHub | Makes the backups | US, standard contractual clauses |
| Google (Web Risk) | Checks listed websites against its list of unsafe sites, when a listing is submitted and every week | Only the website's public address is sent |
We do not sell personal data. We do not share it for advertising. We do not use it to train anything. We give personal data to a court, the police or another public authority only when the law requires us to.
Your rights
Access, correction, deletion, restriction, objection, and a copy of your data in a portable form. Write to support@xenindex.eu.
One exception, stated plainly: we keep payment and billing records until five years after the end of the year they belong to, even if you ask us to delete everything else, because Norwegian accounting law requires it.
You can complain to your national data protection authority, or toDatatilsynet in Norway.
Listings we created that you did not ask for
Part of our opening catalogue was built by us from public sources. Those listings are marked as unclaimed and say we created them.
You can have yours removed, by asking, with no conditions and no questions. Write to support@xenindex.eu. You can also claim it and take over the content instead.
Changes
If we change this policy we email listing owners at least 15 days before it takes effect.
Version 1.0 · in effect from 30 September 2026