Privacy Policy
Effective July 26, 2026 · version 3
How X Dragon Technologies handles personal information on xdragon.tech — what is collected, why, who else sees it, and what you can ask us to do about it.
1. Scope
This policy covers the website at xdragon.tech only. It does not cover other websites that X Dragon Technologies builds or operates for its clients; those sites publish their own privacy policies, and the client is the organisation accountable for personal information collected there.
X Dragon Technologies is based in Canada and this policy is written around the Personal Information Protection and Electronic Documents Act (PIPEDA).
2. What we collect
Information you give us directly
When you submit the contact or demo-request form, we collect the name, email address, optional phone number, and message you enter. The form also records which page you opened it from, so we know which product you were reading about.
If you use the chat widget, we collect the content of your conversation. If you choose to share them in chat, we also collect your name, email, phone, company, website and preferred contact method.
Information collected automatically
When you submit a form or chat message, we record technical information attached to the request: your IP address, an approximate country derived from it, your browser user-agent, and the referring page. This is used to operate the service and to detect automated abuse.
Analytics — only if you accept
Website analytics are off until you accept them via the consent banner. If you accept, we record a randomly generated session identifier and page-level activity: pages viewed, time engaged, performance measurements, and any campaign (UTM) parameters in the link you arrived through. This is not linked to your name or email. If you decline, these events are not collected.
3. Why we collect it
- To answer your enquiry and arrange a demo.
- To provide and operate the website and its chat feature.
- To protect the site from spam and automated abuse — this is why a bot-detection challenge and IP-based rate limiting are applied to form submissions.
- With your consent, to understand how the site performs and improve it.
We do not sell personal information, and we do not use it for advertising or behavioural profiling.
4. Cookies
| Cookie | Purpose | Lifetime |
|---|---|---|
| Analytics consent | Remembers whether you accepted or declined analytics. | 180 days |
| Analytics session | Groups page views into a single visit. Set only after you accept analytics. | 30 minutes |
| Sign-in session | Keeps you signed in to the partner, sponsor or administrative areas. Set only if you sign in. | Session |
You can withdraw analytics consent at any time by clearing cookies for this site, which returns the banner so you can decline.
5. Who else receives your information
We use the service providers below. Several operate outside Canada, primarily in the United States, which means your information may be stored or processed there and could be subject to lawful access requests under the laws of those countries.
| Provider | What it receives |
|---|---|
| OpenAI (or Google, depending on configuration) | The content of chat messages, in order to generate a reply. Do not enter sensitive personal information into the chat. |
| Resend | Your name, email and message, to deliver the notification email to us. |
| Cloudflare | Request metadata including IP address, for the bot-detection challenge on forms. |
| Vercel | Hosting and request logs, including IP address. |
| Neon | Database hosting for the information described above. |
We require our providers to protect personal information and to use it only to deliver the service we have engaged them for.
6. How long we keep it
We keep enquiries and the records associated with them for 14 days, after which they are deleted. Where an enquiry is still being reviewed or acted on at that point, we keep it until that review is finished, and then delete it.
Promotional entries are handled separately and are purged after the retention window set for each promotion.
You can ask us to delete your information sooner at any time using the contact details below, and we will do so unless we are legally required to keep it.
7. Your rights
Under PIPEDA you may:
- Access the personal information we hold about you, and be told how it has been used and who it has been disclosed to.
- Correct information that is inaccurate or incomplete.
- Withdraw consent, subject to legal or contractual restrictions and reasonable notice.
- Complain about how we have handled your information.
Write to [email protected] and we will respond within 30 days, as PIPEDA requires. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.
8. Security
The site is served over HTTPS. Access to the systems holding personal information is restricted to authorised personnel, protected by individual accounts with two-factor authentication, and separated so that each brand's data is scoped to that brand. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
9. Children
This site is intended for businesses. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
10. Changes
If we change this policy we will update the effective date above. Material changes affecting how we use information already collected will be brought to your attention on the site.
11. Contact
X Dragon Technologies
Privacy enquiries: [email protected]
General enquiries: [email protected]
This policy is governed by the laws of British Columbia and the federal laws of Canada that apply there.