Privacy Policy

XaaX is a modular operations platform developed and operated by Osteam Software B.V., registered in the Netherlands (KVK 42116813). References to "we", "us" or "our" refer to Osteam Software B.V..

For privacy-related questions: hello@osteam.nl

For account, billing and website data we act as controller. For the business data your organisation stores in its XaaX workspace — including meeting recordings, transcripts, hours, projects, customer records and files — your organisation is the controller and Osteam Software B.V. acts as processor, handling that data only on your organisation's instructions.

Account data: name, work email, hashed password, role, workspace membership.

Workspace content (on behalf of your organisation): hours, projects, customer and lead records, assets, vehicles, stock, orders, calendars, uploaded documents and logos.

Meetings data (on behalf of your organisation): meeting records, participant names and (where provided) email addresses, audio recordings, transcripts, AI-generated draft summaries, decisions and action points, and approval history. Meeting recordings and transcripts may incidentally contain sensitive information spoken during a meeting; we do not claim otherwise. Your organisation is responsible for notifying participants and having a lawful basis for recording.

Billing data: company billing details, VAT-relevant data, plan and subscription state, and payment references from our payment provider. We never store card numbers or bank credentials.

Technical data: log and security data (IP address, timestamps) needed to operate and protect the service.

We process data to provide and secure the service (contract), to bill subscriptions (contract, legal obligation), to send service and account emails (contract, legitimate interest), and to improve reliability (legitimate interest). We do not sell personal data and do not use workspace content for advertising.

When your organisation uses the Meetings module, audio is transcribed and analysed by configured AI processing providers to produce draft summaries, decisions and action points. Drafts are always reviewed and approved by a person in your organisation before they become operational records. AI processing settings, retention of audio and deletion are controlled by your organisation's administrators.

We use a limited set of sub-processors to run XaaX:

• Vercel (hosting and file storage)
• MongoDB Atlas (database, EU region)
• Mollie B.V. (payment processing, Netherlands)
• Resend (transactional email)
• Configured AI transcription and analysis providers for the Meetings module (only when your organisation enables meeting processing)

Workspace data is retained while your organisation's workspace is active. Meeting audio has a retention period configurable by your organisation and can be permanently deleted independently of the meeting record. Password reset tokens expire after one hour. After account or workspace termination, data is deleted in accordance with our deletion process, subject to legal retention obligations (e.g. invoicing records).

Each organisation's data is stored in isolated, workspace-scoped collections. Access is role-based and enforced server-side. Data is encrypted in transit and at rest by our infrastructure providers. Important actions are audit-logged. Recordings are served only through authenticated, permission-checked requests.

Under the GDPR you can request access, rectification, erasure, restriction, portability or object to processing. For workspace content, direct your request to your organisation (the controller); we support them in fulfilling it. For account and billing data, contact us at hello@osteam.nl. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We will update this policy when the service or applicable law changes and note the new effective date above. Material changes will be announced to workspace administrators.