Privacy Policy

Notice. This document has been prepared from the implemented behaviour of the OXXON platform. It is not legal advice. Provisions concerning data subject rights, lawful bases, international transfers and supervisory authority contact points are jurisdiction-dependent and must be reviewed by qualified legal counsel admitted in each market of publication before this document is relied upon.

1. Scope

This Policy describes how OXXON Advisors Pvt. Ltd. ("OXXON", "we", "us") collects, uses, retains and discloses information in connection with:

• the OXXON website, including the marketing pages, the Knowledge Centre, the commercial licensing portal and the download pages;
• OXXON AUDIT in its Windows desktop edition;
• OXXON VERIFY, delivered through the website;
• OXXON FAST, delivered through the website.

The three products do not have the same data-handling profile. The distinction is material and is stated in full in Section 4. Nothing in this Policy should be read as applying uniformly across all three.

This Policy does not apply to any third-party website reached from an OXXON page, nor to a customer's own handling of reports produced by our software.

2. The controller

The controller of personal data described in this Policy is OXXON Advisors Pvt. Ltd., a company in the course of incorporation in India.

Enquiries concerning this Policy, and any request described in Section 9, should be addressed to partners@oxxonadvisors.com.

A registered office address, corporate identity number and, where required, a data protection officer or representative contact point must be inserted upon completion of incorporation. This is recorded as an outstanding item in PUBLIC_LAUNCH_LEGAL_READINESS.md.

3. Categories of information

3.1 Information you provide

Commercial licensing enquiries. Where you request a quotation through the licensing portal, we collect the company name, contact name, business email address, telephone number (optional), country, the products of interest, the number of licences required, the intended deployment model, and any free-text message you choose to add. Each submission is assigned a quotation reference of the form OXQ-YYYYMMDD-XXXXXX and is retained as a durable record.

Evaluation access to OXXON VERIFY. Access to a free evaluation run is gated on a business email address. We record the address, the fact that the single free run associated with it has been used, and the time of the request. Consumer webmail and known disposable-inbox domains are refused at this gate.

OXXON FAST accounts. Use of OXXON FAST requires an account identified by an email address. Assessments produced under that account are retained as durable records.

Correspondence. Where you contact us by email, we retain the correspondence and its contents.

3.2 Information generated by use of the website

Server-side operational records include a request identifier, the stage of processing reached, and exception types where a request fails. Where a processing request fails, the original filename of the uploaded file appears in error-level log entries. Workbook contents — cell data, formula values and sheet structure — are never written to application logs.

Rate-limiting of the evaluation gate operates on the requesting IP address. These counters are held in process memory and are not durable.

3.3 Information generated by the desktop software

OXXON AUDIT for Windows transmits no usage information to OXXON. See Section 4.1. The software maintains, entirely on the user's own machine: an application log, per-run logs, trial state, and — where a licence has been installed — the licence file.

Where a licence is activated, a machine fingerprint is used to bind a seat to a computer. The fingerprint is a SHA-256 digest computed over the system volume serial number, the Windows MachineGuid and the processor identification string. The components themselves never leave the machine; only the digest does, and only at the moment of activation.

3.4 Information we do not collect

We do not collect payment card details. We operate no payment gateway; see OXL-08 Payment Terms. We do not collect special categories of personal data, and ask that none be submitted in free-text fields.

4. How each product handles a financial model

This is the section that matters most, and the three products differ.

4.1 OXXON AUDIT — Windows desktop edition

A workbook opened in the desktop edition is processed entirely on the customer's own computer and is never transmitted to OXXON.

This is a property of the software's construction, not a policy commitment:

• The application reads the workbook from the path the user selected. It does not copy the workbook into its own data directory; there is no such directory and no code that would create one.
• The application contains no telemetry. A machine policy value named TelemetryEnabled is read and then ignored; the corresponding function returns false regardless of its setting. The value exists so that the absence of telemetry can be verified by an administrator rather than merely asserted by us.
• The one network call the product defines — licence activation — is structured so that no workbook data can reach it. The activation payload has exactly four fields: an order key, the machine fingerprint digest, the product identifier and the software version.
• Diagnostic exports are produced only when the user asks for one, are written to a location the user chooses, are redacted of sheet names, formulas, cell values and filenames on the way into the archive, and are not transmitted by the application. The user sends them to us only if and when they decide to.

Reports and the Technical Manifest are written to the output folder the user selected. They remain under the customer's control at all times.

4.2 OXXON VERIFY and OXXON FAST — website-delivered

These products process an uploaded workbook on OXXON's servers. A customer requiring that a model never leave its own environment must use the desktop edition of OXXON AUDIT.

For website-delivered processing:

• An uploaded workbook is written to the server's operating-system temporary directory and processed there. Processing is synchronous within the request.
• The workbook is not written to an application database and is not placed in cloud object storage. No such storage library is present in the application or its dependencies.
• No third-party artificial intelligence or large language model service is called at any stage. Findings are produced by deterministic structural rules.
• On completion of every request — including failure and timeout paths — the application attempts to delete every temporary file it created. The application does not verify that deletion succeeded. A deletion failure is caught silently and is neither retried nor separately logged. Where a server process is terminated abruptly, the cleanup path may not execute and a temporary file may persist on the container filesystem until it restarts.

For OXXON FAST, a sealed assessment is retained as a durable record so that it can be produced again later; this is the purpose of the product. The default retention period for FAST records is 90 days, configurable per deployment.

The detailed stage-by-stage account published at /workbook-privacy forms part of this Policy by reference and is to be read as consistent with it.

5. Purposes and lawful bases

The right-hand column is indicative only and requires confirmation by counsel in each market before publication.

6. Analytics and cookies

The website sets a small number of cookies. Which cookies are set depends on the product area visited and on deployment configuration. The complete account is given in OXL-12 Cookie Policy, which forms part of this Policy.

In summary: OXXON FAST sets a session cookie without which an account cannot be used; OXXON VERIFY sets a funnel cookie recording that the evaluation gate has been passed; and Google Analytics 4 is loaded only where you have granted permission for it, and only where a deployment has been configured with a measurement identifier at all.

Consent is obtained before any analytics cookie is set, is recorded in a first-party ox_consent cookie that is never transmitted to OXXON, and can be withdrawn at any time from the footer of any page.

7. Disclosure

We do not sell personal data and we do not share it for advertising purposes.

We disclose personal data only:

• to infrastructure providers who host the website, acting on our instructions;
• to Google, where and only where website analytics is enabled for a deployment;
• where required by law, regulation, or an order of a court or authority of competent jurisdiction;
• to a successor in interest in connection with a corporate transaction, on terms no less protective than this Policy.

We do not disclose an uploaded workbook, or the contents of one, to any third party.

8. International transfers

OXXON is established in India and its infrastructure may be located outside the country in which a user is resident. Where personal data is transferred out of a jurisdiction that restricts such transfers, the transfer mechanism relied upon must be identified and documented.

The specific transfer mechanisms have not yet been settled and require legal review before publication. This is recorded as an outstanding item in PUBLIC_LAUNCH_LEGAL_READINESS.md.

9. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, port, or restrict the processing of your personal data, and to object to processing carried out on the basis of legitimate interests. Where processing rests on consent, you may withdraw that consent at any time without affecting the lawfulness of processing already carried out.

Requests should be sent to partners@oxxonadvisors.com. We will respond within the period required by the applicable law, and will verify identity before acting on a request.

We cannot act on a request in respect of a workbook processed by the desktop edition, because we hold no copy of it and never have.

10. Retention

Retention periods for quotation requests, gate entries, logs and correspondence should be fixed to a defined period by counsel before publication.

11. Security

Our technical and organisational measures are described in OXL-11 Security & Privacy Statement. No system is immune from compromise, and we do not represent that ours is.

12. Children

The products are institutional software sold to organisations. They are not directed at children and we do not knowingly collect personal data from them.

13. Changes

We may amend this Policy. The version and issue date at the head of this document identify the current text. Where an amendment is material we will take reasonable steps to bring it to the attention of customers holding a current Commercial Licence.

14. Governing law

This Policy is governed by the laws of India. Section 12 of OXL-02 Website Terms of Use governs jurisdiction. Nothing in this Policy limits any non-waivable right you have under the law of your own country of residence.

Related documents

• OXL-02 Website Terms of Use
• OXL-11 Security & Privacy Statement
• OXL-12 Cookie Policy
• OXL-17 Disclaimer & Limitation of Liability
• Published page: /workbook-privacy — Workbook Processing & Privacy