GDPR & UK Data Protection

1. Data controller

XBUILDERAI LTD is the data controller for personal data processed in connection with Goodstand. This notice describes rights and processes that may apply if you are in the UK or EEA. It does not claim that Goodstand is established in the EU, and it is not a certification of full GDPR compliance. For general privacy practices, see our Privacy Policy.

2. Lawful bases for processing

Where UK GDPR or EU GDPR applies, we process personal data on the following bases:

Performance of a contract — providing the Service you asked for
Legitimate interests — security, fraud prevention, service improvement, and first-party operational analytics (balanced against your rights)
Legal obligation — compliance with tax, accounting, and regulatory requirements
Consent — optional Google Analytics, and any future marketing communications if offered

3. Categories of personal data

Identity and contact data (name, email)
Account and session data (magic-link or Google sign-in, session tokens)
Entity and compliance data you enter or upload, including Company Check searches
Service-request, filing-intake, and official-mail data where those features are used
Technical data (IP address, browser type, usage and security logs)
Communications (support and contact messages, product-email delivery logs)

4. Where data is processed

Personal data is processed on managed cloud infrastructure in the United States and in other regions where our processors operate. We do not currently store EU-resident data on a dedicated EU replica. Transfers use encryption in transit. See the processor list in the Privacy Policy and section 7 below.

5. Your data subject rights

If you are in the UK or EEA, you may have the right to:

Access — obtain a copy of personal data we hold about you
Rectification — correct inaccurate data
Erasure — request deletion where no lawful basis to retain
Restriction — limit processing in certain circumstances
Portability — receive data in a structured, machine-readable format where applicable
Object — object to processing based on legitimate interests or for direct marketing
Withdraw consent — where processing is consent-based, including optional analytics

6. How to exercise your rights

Email contact@goodstand.io with your request. We may need to verify your identity. We respond within 30 days, or inform you if an extension is required under applicable law. There is no fee unless a request is manifestly unfounded or excessive. You can also schedule account deletion in Settings, which uses a 30-day recovery window before purge as described in the Privacy Policy.

7. Subprocessors

We use subprocessors that may process personal data on our behalf, including Vercel, Supabase, Resend, Upstash, Apify, Cloudflare, OpenAI, Google (sign-in and, with consent, Analytics), and Stripe when payments are processed. They receive only what is needed for their function and are bound by contracts with appropriate safeguards. The current list is in our Privacy Policy. Questions: contact@goodstand.io.

8. International transfers

Where personal data is transferred outside the UK or EEA, we implement appropriate safeguards used by our processors — including UK International Data Transfer Agreements and EU Standard Contractual Clauses — unless an adequacy decision applies.

9. Supervisory authority

You have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO). We encourage you to contact us first at contact@goodstand.io so we can address your concern.

10. Relationship to other policies

This notice supplements our Privacy Policy and Terms of Service. Platform security practices are also described on the Security page. In case of conflict on data protection matters, this GDPR notice prevails for UK and EEA users.