GDPR — General Data Protection Regulation
Last updated: June 2026
This page explains how Xonaplay processes the personal data of users in the European Economic Area (EEA), the United Kingdom and other regions covered by the GDPR. It complements our Privacy Policy and details the legal basis for each processing activity, your rights as a data subject and how to exercise them. Xonaplay is a video hosting and streaming platform: you upload a file, we transcode it to encrypted adaptive HLS and give you an embeddable player and a shareable link.
1. Data controller
The controller of your personal data is Xonaplay (xonaplay.com).
For any data protection query, to exercise your rights or about this page, you can write to [email protected].
- Controller: Xonaplay
- Site: xonaplay.com
- Privacy contact: [email protected]
- Data Protection Officer (DPO): [to be confirmed if applicable]
If your jurisdiction requires an EU or UK representative under Art. 27 GDPR, their details will be published here: [representative to be confirmed].
2. Data we process
We process only the data needed to provide the video hosting service and operate your account. We group it into the following categories:
- Account data: email address, hashed password, your name or organization name if provided, plan in use (Starter, Pro, Enterprise).
- Uploaded content: the video files you upload, their technical metadata (resolution, duration, codec) and the HLS variants generated during transcoding.
- Service usage data: playback statistics, view counts, bandwidth and storage consumed, upload and processing events.
- Technical and session data: IP address, session identifier in an httpOnly cookie (SSO), browser and device type, access and error logs.
- Guest upload data: if you upload a video without an account, we temporarily link that content to an upload token; the trial video is deleted after 24 hours unless you register and keep it.
- Billing data: for paid plans, transaction data handled by our payment provider; Xonaplay does not store your full card details.
We do not request special categories of data (Art. 9 GDPR). Please do not upload content containing third parties' sensitive data without a valid legal basis.
3. Legal basis (Art. 6(1) GDPR)
Each processing activity relies on a specific legal basis under Art. 6(1) GDPR:
| Processing activity | Legal basis (Art. 6(1)) |
|---|---|
| Creating and managing your account; hosting and delivering your video; HLS transcoding | Performance of a contract (b) |
| Billing and charging for Pro and Enterprise plans | Performance of a contract (b) and legal obligation (c) |
| Keeping tax and accounting records | Legal obligation (c) |
| Platform security, abuse and fraud prevention, AES-128 content encryption | Legitimate interests (f) |
| Aggregated usage metrics and service improvement | Legitimate interests (f) |
| Non-essential cookies and marketing communications | Consent (a) |
| Handling legal or authority requests | Legal obligation (c) |
Where processing is based on consent (a), you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
4. Your rights
As a data subject, the GDPR grants you the following rights, which you can exercise free of charge:
- Access: obtain confirmation of whether we process your data and a copy of it.
- Rectification: correct inaccurate or incomplete data (for example, your email or name).
- Erasure (right to be forgotten): request deletion of your data and content when no longer necessary or when you withdraw consent.
- Portability: receive your data in a structured, commonly used format, or have us transmit it to another controller where technically feasible.
- Objection: object to processing based on our legitimate interests, including marketing.
- Restriction: ask us to restrict processing while a claim or challenge is verified.
- Withdraw consent: at any time, for processing that relies on it.
- Not be subject to automated decisions with legal effects: Xonaplay does not make such decisions about you.
You can exercise most of these rights directly from your account dashboard (edit profile, export content, delete account) or by writing to [email protected].
5. International transfers
To host and deliver your video we use S3-compatible storage and a content delivery network (CDN), which may involve processing data outside the EEA.
When we transfer data to a country without a European Commission adequacy decision, we apply appropriate safeguards under Arts. 44 to 49 GDPR.
- Transfer mechanism: Standard Contractual Clauses (SCCs) and/or adequacy decisions, depending on the provider.
- Infrastructure regions: [region/infra to be confirmed]
- Supplementary measures: encryption in transit (TLS) and of HLS content at rest (AES-128).
You can request more information about the safeguards applied or a copy of the transfer mechanisms by writing to [email protected].
6. Subprocessors
To operate Xonaplay we rely on providers that process data on our behalf (processors / subprocessors) under contracts compliant with Art. 28 GDPR. The following list is indicative and may be updated:
| Subprocessor | Purpose | Location |
|---|---|---|
| S3-compatible storage provider | Storage of original video files and HLS variants | [region to be confirmed] |
| CDN provider | Delivery and caching of the player and HLS segments | Global / edge |
| Engine infrastructure provider | FFmpeg transcoding and video serving | [region to be confirmed] |
| Managed database provider (MySQL) | Account data, plans and metadata | [region to be confirmed] |
| Payment provider | Processing of Pro and Enterprise plan charges | [provider to be confirmed] |
| Transactional email provider | Account verification, notifications and support | [provider to be confirmed] |
We keep an up-to-date list of subprocessors. You can request the current version and notification of changes by writing to [email protected].
7. Retention
We keep data only for as long as necessary for the purposes described or as required by law:
- Video content and metadata: while your account is active; after deletion or account closure it is removed from storage and CDN within [deletion window to be confirmed].
- Guest uploads: the trial video is automatically deleted after 24 hours unless you register.
- Account data: for the life of the account and a reasonable period after closure.
- Billing and tax data: for the applicable statutory retention period [tax period to be confirmed].
- Technical and security logs: for a limited period for security and diagnostics [log retention to be confirmed].
Backups may retain data for a short additional period until they are rotated.
8. Minors
Xonaplay is not directed at minors and we do not knowingly collect data from children below the applicable age of digital consent (16 under the GDPR, or the lower age set by your country, minimum 13).
If you believe a minor has provided us data without the consent of a parent or guardian, write to [email protected] and we will delete it.
9. Supervisory authority
If you believe the processing of your data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority of your country of residence, place of work or the place of the alleged infringement.
We would appreciate the chance to resolve the matter with you first at [email protected] before you contact the authority.
- Spain: Agencia Española de Protección de Datos (AEPD) — aepd.es
- Portugal: Comissão Nacional de Proteção de Dados (CNPD) — cnpd.pt
- Other EEA countries: your local supervisory authority
- United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
10. How to exercise your rights
To exercise any of the rights described you can:
- Use your account dashboard: edit your data, export your content or delete your account on your own.
- Write to [email protected] stating the right you want to exercise and the data it concerns.
We may ask you to verify your identity before responding. We will handle your request without undue delay and, in any case, within one month, extendable by a further two months in complex cases (Art. 12 GDPR). Exercising your rights is free, except for manifestly unfounded or excessive requests.
11. Changes to this page
We may update this page to reflect changes in our processing activities, subprocessors or applicable law.
We will publish the current version at this same URL and update the "Last updated" date. If the changes are substantial, we will notify you by email or through the dashboard.
Any questions about this page: [email protected] or [email protected].