Privacy policy

Who is responsible for your data?

Dr Xu-Priour EI, trading as XP Consulting (SIREN 805 379 138), established in France. Send any question about this page to contact@xp-consulting.org.

What do we collect?

Only what we need to do the work:

• What you send through a form: your name, email, your answers and any files.
• Payment records. Stripe handles your card, and we never see the number.
• Your email, if you sign up for the newsletter. Nothing is sent until you confirm it.
• What our booking calendar needs to hold a call.
• Your institution and funding, if you apply to the Global South Scholar Fund. Please do not send details of your personal circumstances; we never need them.
• Your doctorate, field and a link to your CV, if you apply to work with us.
• A one-way hash of your IP address with each form you send, to stop abuse.

Why do we use it?

To deliver the service you asked for (a contract), to keep the accounting records the law requires (a legal obligation), to send the newsletter you confirmed (your consent, which you can withdraw in one click from any email), to consider an application to work with us (steps you asked us to take before a contract), and to keep our forms free of abuse (our legitimate interest). No decision about you is made by software alone.

Do we use cookies?

No tracking or advertising cookies, and no analytics at present. If that changes, this page will say so first.

Who else sees it?

Only the specialist working on your project, who may be a freelance member of our team bound by a confidentiality and data processing agreement, and these services, each under a data processing agreement:

• Hostinger, which hosts the site and stores your files in the European Union.
• Stripe, for payments.
• Cal.com, for booking calls.
• Resend, for sending emails.
• Sanity, for the site’s text and newsletter sign-ups.

Do AI tools see my work?

They may. We use AI services to check language and to support the review of a draft, and the specialist makes every judgement. Each service used on your work is named in your report, none may use it to train a model, and we remove your name and contact details from text before it goes to them.

Does it leave the European Union?

Your files are stored in the European Union. Stripe, Cal.com, Resend, Sanity and the AI services we use may process data outside it, including in the United States, under the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

We never sell your data, never say you are a client, and never use your work to train AI.

How long do we keep it?

• Uploaded files: deleted 30 days after your project is delivered, or 90 days after submission if you never went ahead. A scheduled job does this and records each deletion. Our host keeps short-term backups, so a deleted file lasts until its backup expires.
• Your details and our report: 5 years after the project ends, in case either of us needs them for a claim.
• Enquiries that never became a project: 12 months.
• Applications to work with us: up to 2 years after our last contact.
• Accounting records: 10 years, as French law requires.
• Newsletter: until you unsubscribe. After that we keep only your address and the date, so that we never email you again.

How do we protect it?

Files are stored outside any public folder, under names that do not reveal yours. A link we email you for uploads expires after two weeks and can only add a file, never read one. Pages and uploads travel encrypted.

What are your rights?

You can ask to see, correct, delete or take a copy of your data, or object to how we use it. Email us and we will reply within one month.

You can also complain to the CNIL, the French data protection authority (cnil.fr), or to the authority where you live.