xPM

Privacy Notice

Effective 23 September 2026

This notice explains how xPM Solution (“xPM”, “we”, “us”) collects, uses, shares and protects personal information when you use the xPM project controls platform and related services (the “Services”).

1. Our role

Organizations that subscribe to xPM (our “Customers”) decide which projects, documents and users they bring into the Services. For that content we act as a processor or service provider on the Customer’s behalf and follow their instructions. For account, security and billing information we act as a controller. If your organization invited you to xPM, questions about project content should go to your organization first.

2. Information we collect

  • Account information: name, work email address, company, role and sign-in details. If you sign in with Google, we receive your name, email address and an identifier from Google.
  • Customer content: project data, drawings, specifications, documents, RFIs, comments and other material you or your organization upload or create.
  • Usage and device information: log data such as IP address, browser type, pages visited, actions taken, timestamps and error reports.
  • Communications: messages you send to us, for example support requests.

3. How we use information

  • to provide, operate and secure the Services, including authentication and access control;
  • to process Customer content as instructed, including AI-assisted analysis such as document review and RFI detection;
  • to send service messages such as invitations, security notices and account changes;
  • to monitor performance, investigate errors and prevent fraud or abuse;
  • to meet legal obligations and enforce our agreements.

We do not sell personal information, and we do not use Customer content to train general-purpose AI models.

4. Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Services), legitimate interests (securing and improving the Services, preventing abuse), legal obligation, and consent where we ask for it. You may withdraw consent at any time.

5. Sharing

We share personal information only as needed to run the Services, with:

  • your organization and the users it authorizes on its projects;
  • service providers acting on our behalf under written terms: Amazon Web Services (hosting, storage, authentication), Google (sign-in with Google), AI model providers (Anthropic, OpenAI, Google) for AI-assisted features, Pinecone (search indexing), Resend (transactional email) and Sentry (error monitoring);
  • authorities, where required by law or to protect rights, safety and security;
  • a successor, if xPM is involved in a merger, acquisition or sale of assets.

6. International transfers

We host the Services on Amazon Web Services in the United States and the European Union. When personal information moves across borders we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK addendum.

7. Retention

We keep personal information for as long as your account or your organization’s subscription is active and as needed afterwards to meet legal, accounting and security obligations. Customer content is deleted or returned as set out in the Customer’s agreement.

8. Security

We use administrative, technical and organizational measures appropriate to the risk, including encryption in transit, access controls based on least privilege, secure session cookies and audit logging. No system is completely secure; tell us promptly if you believe your account has been compromised.

9. Cookies

The Services use strictly necessary cookies to keep you signed in and to protect sign-in (for example session and one-time sign-in state cookies). They are marked HttpOnly and Secure, and are not used for advertising.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to lodge a complaint with a data protection authority. Residents of California and other US states have similar rights, including the right to know and to delete, and will not be discriminated against for using them. If your organization controls the information, we will pass your request to it.

11. Children

The Services are intended for professional use and are not directed to children under 16.

12. Changes

We may update this notice. We will post the new version here with a new effective date and, for material changes, notify account holders in advance.

13. Contact

For privacy questions or to exercise your rights, contact us through xpmsolution.com/contact.