Xavor does not sell your personal information to third parties for monetary consideration. We also do not share your personal information for cross-context behavioral advertising (as defined under California law) without your consent. However, we do share personal data with certain third parties under the following circumstances, and only as needed to fulfill the purposes described in this Policy:

• Service Providers: We share information with third-party service providers and partners who perform services on our behalf or assist us in operating our website and business. These include:
• Web Hosting and Infrastructure: Our website is hosted on WP Engine, a managed WordPress hosting provider. All data that you submit to our site or that is collected by our site (including personal information) will be stored on WP Engine’s servers. WP Engine may process personal data on our behalf as needed to provide their services – for example, they handle data storage, backup and recovery, caching, and security monitoring for the site. WP Engine may incidentally have access to personal information (such as in server logs or in database backups), but they are contractually prohibited from using it for any purpose other than providing hosting services to us. In other words, any personal data processed by WP Engine remains under Xavor’s control and instructions. WP Engine will only disclose such data to their own sub-processors as needed to deliver the hosting service (for example, cloud infrastructure providers), and they must do so in compliance with applicable privacy laws. WP Engine is a company based in the United States; however, it participates in the EU-U.S. Data Privacy Framework and UK Extension, which means it has certified to provide an adequate level of protection for personal data transferred from the EU/UK to the U.S. (See International Data Transfers below for more on how we safeguard data in such cases.)
• Analytics Providers: As noted, we use Google Analytics and Microsoft Clarity to collect usage information. These are third-party services provided by Google LLC (Google Analytics) and Microsoft Corporation (Clarity). The information generated by analytics cookies about your use of the site (e.g. your IP address, device identifiers, browsing actions, etc.) may be transmitted to and stored on Google’s and Microsoft’s servers (which could be in the United States or other countries). Google Analytics helps us understand website traffic and usage patterns; it reports aggregate trends and provides insight without identifying individual users. Microsoft Clarity captures user interaction data such as clicks, scrolls, and session replays, which we review to improve our site design and fix usability issues. These providers act as our data processors for analytics, meaning they are authorized to use the data collected only to provide analytics services to us and not for their own purposes (Google Analytics data may also be used by Google for improving their analytics platform, but it is bound by Google’s Privacy Policy and terms). We have configured Google Analytics to anonymize IP addresses where applicable (for users in the EU, your IP will be truncated to remove the last octet before storage, reducing identifiability). We do not allow Google Analytics to use or share our analytics data for ad personalization. Google’s ability to use and share information collected by Google Analytics about your visits is governed by the Google Analytics Terms of Use and the Google Privacy Policy. Similarly, Microsoft Clarity’s usage of data is covered by the Microsoft Privacy Statement. You can opt out of Google Analytics tracking by refusing analytics cookies on our site, or by using Google’s Analytics Opt-Out Browser Add-on.
• Security / Anti-Spam: We use Google reCAPTCHA (v2 and/or v3) on our website forms (such as contact forms) to prevent spam and abuse. This is a service provided by Google LLC. When reCAPTCHA is enabled on a page, it may collect hardware and software information, such as your IP address, browser characteristics, and user interactions (e.g., mouse movements or clicks), and send that data to Google for analysis. Google uses this information to determine whether you are a human user and not a bot. According to Google’s requirements, we disclose that the reCAPTCHA service is subject to the Google Privacy Policy and Terms of Service. In practice, that means the data collected by reCAPTCHA is handled by Google in accordance with their privacy practices. We only implement reCAPTCHA to secure our site and do not use the information it collects for any advertising or profiling. By using our forms protected by reCAPTCHA, you acknowledge that Google will process certain data for security purposes. (You will typically see a notice near any reCAPTCHA-protected form stating “This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply”.) If you do not wish to have this data collected, please refrain from using our online forms; you may contact us through alternative means such as direct email.
• Other Vendors: Xavor may share data with other third-party vendors in order to run our business or provide specific services to you – for example, an email delivery service (to send out newsletters or transactional emails), a customer relationship management (CRM) tool to organize inquiries, or a scheduling platform if you book a meeting with us. These vendors will have access to personal information only as necessary to perform their functions and are contractually bound to protect it and use it only for our purposes. We ensure that all such providers commit to appropriate confidentiality and data protection obligations. (If you have specific questions about our current service providers, you may contact us for more information.)
• Within Our Corporate Group: Xavor Corporation is a global company with offices and affiliates in multiple countries. We may share personal information internally within our corporate family (e.g., between our U.S. headquarters and our branch offices in other regions) as needed to fulfill the purposes outlined in this Policy. For example, if you submit a contact request from Europe or Asia, it might be handled by staff in our U.S. office or vice versa, depending on your inquiry. All internal transfers of personal data are subject to strict access controls and are on a need-to-know basis. Our internal use and sharing of data will remain consistent with this Policy (we treat your data with the same level of protection regardless of which office or country is processing it).
• Legal Requirements and Business Transfers: We may disclose personal information to third parties if we believe in good faith that such disclosure is necessary to: (a) comply with a law, regulation, legal process, or government request; (b) enforce or apply our Terms of Service or other agreements; (c) investigate, detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Xavor, our users, customers, or others (such as exchanging information with other companies for fraud protection or credit risk reduction, as permitted by law). Additionally, if Xavor is involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your information may be transferred as part of such a transaction. In such cases, we will ensure the recipient is bound to respect your personal data in a manner consistent with this Privacy Policy or we will notify you and obtain consent if required by law.

Except for the scenarios above, we will not share, sell, or rent your personal information to third parties without your consent. We do not disclose personal data to unaffiliated third parties for their own direct marketing purposes. If any sharing of personal information falls outside the scope of this Policy, we will seek your permission where required.