Privacy Policy.

Effective Date: January 1, 2026
Last Updated: October 11, 2026

This Privacy Policy explains how XRYTE BYTE TECHNOLOGIES LLC ("Company", "we", "us", or "our"), operating the Xmellow CRM platform (https://xmellow.com), collects, processes, and protects personal data.

1. Data Roles: Controller vs. Processor (GDPR & CCPA)

• Xmellow as Data Controller: We act as the Data Controller for information directly provided by our business subscribers (such as account login details, billing records, and direct technical support interactions).
• Xmellow as Data Processor: We act strictly as a Data Processor / Service Provider for customer leads, personal information, and messaging records that our subscribers import, manage, or automate within their individual CRM accounts ("Subscriber CRM Data"). Our subscribers maintain independent legal responsibility as Data Controllers for establishing a lawful basis for processing.

2. Information We Collect

• Account Credentials: Business legal name, administrative contact name, email address, physical billing address, and phone numbers.
• Payment Card Data: All payment transactions are encrypted and tokenized directly via PCI-DSS Level 1 compliant payment gateways (such as Stripe). We do not process, store, or transmit full credit card numbers or security CVV codes on our servers.
• Telecommunications Telemetry: Delivery receipts, IP addresses, browser user-agents, campaign verification records, and carrier opt-out histories required to demonstrate statutory messaging compliance.
• Subscriber CRM Data: Contact names, email addresses, phone numbers, custom data fields, sales pipelines, and campaign interactions stored within subscriber sub-accounts.

3. Cookies and Tracking Technologies

We use cookies, web beacons, tracking pixels, and related identifiers to enhance platform performance, analyze traffic patterns, and deliver tailored advertising.

• Essential / Strictly Necessary Cookies: Required for technical operation, user authentication, security verification, and session continuity. These cannot be disabled through our consent banner.
• Analytics and Performance (Google Analytics 4): We utilize Google Analytics 4 (GA4), operated by Google LLC, to gather aggregate information about site interactions, user engagement, and traffic sources. GA4 collects pseudonymous data, including IP address hints (with standard IP anonymization), device specifications, browser environment, and user actions. This data is processed only after explicit opt-in consent where required by applicable law.
• Advertising, Conversion Tracking, and Retargeting (Meta Pixel): We use the Meta Pixel (operated by Meta Platforms, Inc.) to measure campaign effectiveness, analyze conversion events, and display personalized advertising on Meta platforms (including Facebook and Instagram). The Pixel tracks browser interactions and visitor events to match activity with user profiles on third-party networks, subject to your prior consent.
• Managing Consent: Visitors can modify or withdraw their consent for non-essential cookies (Statistics, Marketing, and Preferences) at any time by opening the Cookie Preferences link in our website footer or interacting with our automated consent management banner.

4. Vetted Infrastructure Sub-Processors

We utilize vetted enterprise sub-processors bound by statutory confidentiality and data security obligations to deliver core platform services:

• Hosting, Infrastructure & Data Storage: We host, store, and process customer data using high-security, enterprise-grade cloud computing environments and infrastructure facilities, including tier-1 providers such as Amazon Web Services (AWS) and Google Cloud Platform (GCP). All underlying databases, network architectures, and server environments maintain stringent physical, technical, and organisational security controls, including: Compliance & Audits: SOC 2 Type II compliance, ISO/IEC 27001 certifications, and regular independent vulnerability audits. Data Encryption: Industry-standard encryption protocols applied to all personal data both in transit (TLS 1.2/1.3) and at rest (AES-256). High Availability & Redundancy: Distributed data storage and automated backups designed to maintain uptime, data integrity, and disaster recovery.
• Telephony & Messaging Gateways: To deliver platform functionality, authenticate users, and maintain software reliability, we partner with vetted third-party technical vendors who act strictly as data processors on our behalf. These partners are bound by strict data processing agreements and confidentiality obligations: Cloud Infrastructure & Database Management: Enterprise cloud hosting, virtual computing instances, and distributed database services. Telecommunications & Message Delivery: Global telecommunications carrier gateways, transactional email networks, and SMS delivery aggregators used to transmit verification codes, notifications, and customer messages. Payment Processing: Certified PCI-DSS Level 1 compliant payment gateways to process transactions securely. We do not store credit or debit card numbers on our local systems.
• Security & Operational Monitoring: Automated firewall security, intrusion detection systems, platform performance monitors, and crash reporting diagnostics. These service providers are granted access only to the minimum data necessary to perform their technical duties and are strictly prohibited from using, sharing, or retaining personal information for any other purpose.
• Billing & Merchant Services: Stripe, Inc.
• Operational Monitoring: Cloudflare, internal error tracking, and secure support ticketing systems.

5. International Data Transfers & Standard Contractual Clauses (SCCs)

Personal data processed through Xmellow is hosted within secure data centers located in the United States. For personal information originating from the European Economic Area (EEA), United Kingdom, or Switzerland, transfers are conducted pursuant to standard contractual protections, technical encryption standards, and European Commission-approved Standard Contractual Clauses (SCCs).

6. Children's Online Privacy Protection Act (COPPA)

Xmellow is exclusively an enterprise B2B platform. It is not designed for or directed to individuals under the age of 18. We do not knowingly collect personal data from children under 13 years of age.

7. US State Privacy Rights (CCPA / CPRA)

Residents of California and US states with comprehensive consumer privacy legislation hold the following rights:

• Right to Know & Access: Request details regarding the categories and specific pieces of personal information collected.
• Right to Correct & Delete: Request correction of inaccurate information or deletion of personal data, subject to lawful business retention exemptions.
• Non-Sale of Information: We do not sell, rent, or lease personal information to third parties for monetary or commercial consideration.

To submit a verified privacy request, email privacy@xmellow.com.

8. Contact Information

XRYTE BYTE TECHNOLOGIES LLC
Attn: Data Protection & Privacy
30 N Gould St, Ste N
Sheridan, WY 82801, USA
Email: privacy@xmellow.com