Privacy Policy

1. Information we collect

We collect different types of data depending on how you use Xonaplay. Some of it you provide directly (when you create an account or upload a video) and some is generated automatically as you use the service.

• Account data: email, password (stored hashed, never in plain text), optional name or username, your plan (Starter, Pro or Enterprise) and billing details handled by our payment processor.
• Videos and metadata: the video file you upload and its associated metadata (title, description, duration, resolution, codecs, size, generated thumbnails, transcripts/subtitles if you enable that feature, and the HLS variants 360p/480p/720p/1080p we generate).
• Usage and analytics data: plays, watch time, quality served, player events, playback errors, bandwidth and aggregate metrics for your videos so we can show you statistics in your dashboard.
• Technical data: IP address, device and browser type, operating system, session identifiers and server logs, for security and diagnostics.
• Cookies and similar technologies: we use cookies for the session (httpOnly login / SSO cookie) and to remember preferences. See the Cookies section and our /cookies page.
• Guest uploads: if you upload a video without creating an account, we associate it with a temporary session and an IP; that video is deleted automatically after 24 hours unless you register and keep it.

2. How we use your data

We use data to provide and improve the service, always with a legal basis under GDPR (performance of the contract, legitimate interest, consent or legal obligation, as applicable).

• Provide the service: receive your video, transcode it to adaptive HLS, store it, encrypt the segments and deliver it through the player and the CDN.
• Manage your account: authentication, cookie session, guest-to-customer conversion, support and operational communications about your videos.
• Billing: process payments and subscriptions for the Pro and Enterprise plans through our payment processor.
• Analytics and improvement: measure playback performance, detect errors, optimize transcoding and show you statistics about your videos.
• Security and compliance: prevent abuse, fraud and unauthorized use, and respond to legal requests and copyright claims (DMCA).
• Communications: transactional notices (confirmations, processing alerts, billing). We do not send marketing without your consent.

We do not use your videos to train our own or third-party AI models.

3. Who we share with: subprocessors

We do not sell your data. To operate Xonaplay we rely on external providers (subprocessors) that process data on our behalf, under contract and with the safeguards required by GDPR. The main categories are:

Where a subprocessor is located outside the European Economic Area, transfers rely on standard contractual clauses or another valid mechanism under GDPR. The exact list of subprocessors and their locations is available on request at [email protected].

4. Retention and deletion

We keep data only for as long as necessary for the purposes described or as required by law.

• Guest videos: automatically deleted 24 hours after upload, unless you register and associate them with an account.
• Videos in registered accounts: kept while the account is active and you have not deleted them.
• User deletion: when you delete a video we begin removing it from storage and the CDN; copies may remain in backups for a limited period [backup retention window to be confirmed] before final purge.
• Account closure: when you close your account we delete or anonymize your data within a reasonable period, except data we must keep for legal or billing obligations.
• Logs and analytics: retained for limited periods for security and diagnostics [exact window to be confirmed].

5. Security

We apply reasonable technical and organizational measures to protect your data and your videos.

• Encryption in transit: all traffic travels over TLS (HTTPS).
• Content encryption: HLS segments are encrypted with AES-128, so the delivered video is not accessible in the clear outside the authorized player.
• Passwords: stored hashed using [algorithm to be confirmed]; we never store passwords in plain text.
• Access control: direct upload to the engine via a short-lived token and an httpOnly cookie session.
• Operational best practices: access restricted on a need-to-know basis, activity logging and monitoring.

No system is 100% secure; in the event of an incident affecting personal data we will act in accordance with GDPR notification obligations.

6. Your rights

If you are in the European Economic Area or another jurisdiction with equivalent rights, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data (right to be forgotten), subject to applicable legal limits.
• Restriction and objection: restrict or object to certain processing.
• Portability: receive your data in a structured, commonly used format.
• Withdraw consent: where processing is based on your consent, you may withdraw it at any time.
• Complain: lodge a complaint with your data protection supervisory authority.

To exercise any of these rights, write to us at [email protected]. We may ask you to verify your identity before responding.

7. Cookies

We use strictly necessary cookies to maintain your session (httpOnly login / SSO cookie) and preference and analytics cookies to improve the service.

You can manage your preferences and see full details on our Cookies page.

More information at /cookies.

8. Changes to this policy

We may update this policy to reflect changes in the service, in our subprocessors or in applicable law. When we make material changes we will update the "last updated" date and, where appropriate, notify you by email or within the product.

Continued use of Xonaplay after the changes take effect means you accept the revised policy.

9. Contact

If you have questions about this policy or about how we process your data, write to us at [email protected].

For legal matters: [email protected]. For copyright claims: [email protected]. For general support: [email protected].

Data controller: Xonaplay.