Privacy policy
Last updated: October 23, 2026. The French version is the reference.
XTAND Studio is the administration console that XTAND provides to its clients to manage the content of their website: writing and publishing news, monitoring search performance, configuring how their forms send email, and preparing the distribution of their content on social networks. This page explains which data XTAND Studio processes, why, for how long, and how to exercise your rights.
Who is responsible
XTAND SARL, 23 rue Catros, 33000 Bordeaux, France. SIRET 531 320 414 00018. Contact: contact@xtand.fr, +33 5 35 54 14 55.
XTAND is the controller of the data of XTAND Studio user accounts. For website content and data related to each client's business (their website, statistics and social networks), XTAND acts on behalf of that client, under the contract between them.
Data processed
| Data | Purpose | Retention |
|---|---|---|
| User account: username, password (never stored in clear, only its hash), linked website; for XTAND accounts, the two-factor secret, encrypted | Signing in to the console | As long as the account exists; deleted no later than three months after the end of the contract |
| Action log: which account did what, and when (publication, post approval, settings change) | Security, and knowing who decided what | One year at most |
| Web server technical logs: IP address, date, requested page | Security and troubleshooting | 14 days |
| Client website content: texts, images, links | Writing and publishing it on their website | Duration of the contract; returned to the client at its end |
| Social media posts prepared in XTAND Studio, their images, and who approved them | Preparing, approving and publishing the client's content | Duration of the contract |
| Social network connections (see below) | Publishing the posts the client approved on the client's page | Until disconnected; erased immediately |
| Search Console statistics of the website (pages, queries, clicks, positions) | Monitoring the website's search performance | Duration of the contract |
| Website form log: date, form, originating page, success or failure. No name, no address, no message | Detecting a broken form, counting requests | 36 months at most |
| Technical settings provided by the client: credentials used to send form emails, key of their artificial intelligence account. Encrypted, never displayed again | Running their forms and the writing assistant | Until disconnected |
Data received from social networks
When a client connects their Facebook Page, their Instagram professional account, their LinkedIn Page or their Google Business Profile location, they authorize the XTAND Studio application to publish on their behalf. XTAND Studio then receives and stores only:
- the identifier and name of the selected Page, account or location;
- the access token issued by the network, encrypted on our servers, never shown in the console nor shared with anyone;
- for each published post: its identifier, its URL on the network and, later, its statistics (views, clicks).
XTAND Studio does not read messages, comments, followers or the profiles of people who follow the Page. This data is only used to publish the posts the client approved and to report on them. It is never sold, never used for advertising, and never shared with another client.
For Google, XTAND Studio requests a single permission: managing the selected business location
(business.manage). A post's image is made available to Google through a signed URL, valid
for 24 hours. XTAND Studio's use and transfer of information received from Google APIs adheres to the
Google API Services User Data
Policy, including the Limited Use requirements.
What we do not use
The console sets a single cookie: the session cookie, required to stay signed in. No analytics, advertising or tracking cookies, no third-party analytics tools.
Legal bases
- performance of the contract between XTAND and its client (Article 6(1)(b) GDPR): accounts, content, connections, distribution;
- XTAND's legitimate interest in securing its service (Article 6(1)(f)): logs.
Service providers
| Provider | Role | Location |
|---|---|---|
| OVHcloud | Hosting of XTAND Studio's servers and data | France |
| XTAND's code forge (Forgejo) | Repository of website files (content, images), on XTAND's servers at OVHcloud | France |
| Anthropic | Writing assistant: texts to be written are sent to it when the client asks | United States |
| Meta, LinkedIn, Google | The networks on which the client chooses to publish | Per network |
Transfers outside the European Union are covered by the safeguards provided by the GDPR, under these providers' contractual terms.
Security
Encrypted connections (HTTPS); passwords stored as hashes; secrets and tokens encrypted; two-factor authentication for XTAND accounts, which can access several websites; each client website isolated in its own database.
Your rights
You can request access to your data, its rectification, erasure or portability, the restriction of its processing, or object to it, by writing to contact@xtand.fr. We answer within one month. To have the data of an account or of a social network connection deleted, see Data deletion. You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
Changes
This policy may change, in particular when new features open. The version in force is the one on this page, with its update date.