Privacy Policy | Goodstand

1. Who we are

XBUILDERAI LTD ("we", "us") operates the Goodstand platform. We are the data controller for personal data described in this policy. For rights that may apply if you are in the UK or EEA, see our GDPR page.

2. Data we collect

What we collect depends on how you use Goodstand. Typical categories include:

Account data — email address, display name, sign-in method (email magic link and, if you choose it, Google), and session information
Company data — legal names, jurisdiction, identifiers, addresses, registered-agent details, ownership fields, and questionnaire answers you enter or confirm
Company Check and search attempts — company names or identifiers you search, selected matches, and related lookup metadata
Documents — files you upload and files stored for your company, such as formation papers, receipts, or correspondence attachments
Service requests and filing intake — messages, confirmations, and supporting files for a requested plan or catalog service
Official mail / inbox — inbound letters and attachments forwarded to a company inbox address where Monitor or Managed includes that feature
Support and contact messages — information you send via the contact form, email, or in-product support
Product analytics — page visits, product interaction events, Company Check funnel events, anonymous session identifiers, and traffic-source fields such as UTM and referrer
Lifecycle email records — logs that a welcome, follow-up, reminder, or similar product email was sent or clicked
Payment data — if and when you pay, billing metadata processed by our payment provider; we do not store full card numbers
Security signals — IP address, device/browser type, timestamps, and rate-limit information used to protect the Service
Cookies and local storage — essential cookies for consent, authentication, and session continuity, plus local/session storage identifiers used for first-party product analytics

3. How we use data

We use personal data to provide and improve the Service, complete Company Checks, show dashboard information, send product emails, process service requests and filings you ask for, authenticate users, prevent abuse, measure how the product is used, and comply with legal obligations. We do not sell personal data. We do not use your documents, prompts, or outputs to train our own machine-learning models.

Contract — to deliver the Service you asked for, including checks, monitoring, and requested filing assistance
Legitimate interests — security, abuse prevention, product improvement, and first-party operational analytics
Legal obligation — tax, accounting, and regulatory retention where required
Consent — optional Google Analytics, and any future marketing emails if we offer them and you opt in

4. First-party analytics and Google Analytics

Goodstand keeps its own first-party product analytics. These events help us understand Company Check usage, page visits, and product interactions. They use anonymous or session identifiers stored in your browser (for example localStorage or sessionStorage) and may include traffic-source attribution. First-party analytics are part of operating the Service. Choosing “Essential only” does not turn them off.

Google Analytics is optional. It loads only after you accept cookies. Essential only prevents Google Analytics. You can reopen Cookie settings from the footer at any time. The cookie-consent choice is stored for one year.

5. Cookies and similar storage

We group cookies and similar technologies as follows:

Essential — authentication and session, security, cookie-consent choice, and first-party product analytics / visitor or session continuity
Optional — Google Analytics, only after you accept

6. Email communications

We send product and transactional email needed to operate the Service. That currently includes sign-in / magic-link messages, welcome and onboarding follow-up, service-request confirmation, deadline or product reminders, and account-deletion notices. You cannot unsubscribe from emails required to operate your account (for example sign-in and security). Deadline reminders can be muted in account settings where that control is offered. We do not currently send a marketing newsletter. If we add optional marketing email later, it will require a separate opt-in and an unsubscribe path; this policy does not imply that a newsletter already exists.

7. Sharing and processors

We share data with service providers who process it on our behalf to run Goodstand, and with contractors or partners only as needed to perform a service you requested. We may disclose data if required by law, to protect rights and safety, or in connection with a merger or acquisition with notice where required.

Vercel — hosts the Goodstand web application and API routes
Supabase — authentication, database, and private file storage
Resend — transactional and product email
Upstash — rate limiting and abuse prevention
Apify — retrieval of public Wyoming registry records used in checks and monitoring
Cloudflare — inbound email routing for company inbox capture where that feature is enabled
OpenAI — AI Chat replies and text extraction or classification for some documents and letters
Google — optional Google sign-in, and Google Analytics only after cookie consent
Stripe — payment checkout and billing metadata if and when a paid checkout is used; full card numbers are not stored by Goodstand

8. Retention and account deletion

We retain account and entity data while your account is active. If you schedule deletion in Settings, the account enters a 30-day recovery window. Monitoring and inbox ingestion stop, and you can restore the account during that window. After the window, we purge company records, documents, inbox history, and filing records associated with the account, except records we must keep for law, security, or billing. Payment records, if any, may be retained in anonymized form. Security and email-delivery logs may be kept for a limited period. Backups, where our processors maintain them, may persist for their normal backup cycle after purge.

Deletion is confirmed by email when scheduled. Individual documents can be downloaded from the vault while the account is active. A complete self-service export of every record is not currently built; email contact@goodstand.io if you need a copy of personal data.

9. Security

Data is transmitted over encrypted connections and stored with our managed cloud processors using industry-standard encryption practices. Access is limited by account authentication and internal access controls. No method of transmission or storage is 100% secure. A current, non-certification description of platform controls is on our Security page.

10. International transfers

We operate for an international audience. Personal data is processed on cloud infrastructure in the United States and in other regions where our processors operate. We do not currently operate a dedicated EU-only replica of customer data. Where a transfer from the UK or EEA requires additional safeguards, we rely on appropriate contractual protections used by our processors, such as Standard Contractual Clauses or the UK International Data Transfer Agreement, unless an adequacy decision applies. See our GDPR page.

11. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. UK and EEA residents have additional rights under UK GDPR and EU GDPR — see /gdpr. To exercise rights, email contact@goodstand.io. We respond within 30 days, or tell you if an extension is allowed.

12. Children

The Service is not directed to individuals under 18. We do not knowingly collect personal data from children. Contact us if you believe a child has provided data and we will delete it.

13. Changes

We may update this Privacy Policy. The "Last updated" date at the top of this page will change when we do. Material changes will be communicated by email or in-app notice where appropriate.

14. Contact

Privacy inquiries and data subject requests: contact@goodstand.io.