XOCOAXOCOA

Privacy Policy

Effective date: May 6, 2026

XOCOA ("we", "us", "our") operates the XOCOA website, AI Chocolate Sommelier, account features, saved chocolates, and related services at xocoa.co. This policy explains what personal data we process, why we process it, how long we keep it, and your rights under the GDPR and applicable privacy law.

1. Information We Collect

When you use XOCOA without signing in, we may process:

  • Chat messagesthe text you send to the sommelier to generate recommendations.
  • Session identifiera randomly generated ID used to maintain conversation context.
  • Preference dataflavour preferences, dietary needs, and budget signals you share during the conversation.
  • Technical metadatabrowser type, language, and approximate timezone, collected automatically to ensure the service functions correctly.

If you sign in with Google, we additionally process:

  • Account identityyour Google-provided email address, name, avatar, and provider metadata needed for authentication.
  • Profile datadisplay name, avatar URL, locale, account creation date, and update date.
  • Signup security datayour IP address captured once at signup and approximate country derived from that IP for fraud prevention and account-security auditing.
  • Saved chocolatesproduct identifiers from the XOCOA catalogue that you choose to save, plus optional notes if enabled.
  • Authenticated chat associationchat sessions may be associated with your account so you can keep context and use account features.

We do not collect payment card data, postal addresses, phone numbers, precise GPS location, browsing history outside XOCOA, device fingerprints, advertising identifiers, or demographic inferences.

2. How We Use Your Information

We use the data above to:

  • Generate personalised chocolate recommendations grounded in our product catalogue.
  • Maintain conversation context and authenticated sessions.
  • Provide account features such as Google sign-in, profile display, saved chocolates, data export, and account deletion.
  • Protect accounts and prevent abuse or fraud.
  • Improve the quality and accuracy of the sommelier over time (aggregated, non-identifiable analysis only).

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not build persistent user profiles or use your data for behavioural advertising.

3. Data Retention

Account profile data and saved chocolates are retained for as long as your account exists. You can delete your account from the XOCOA account page, which removes account-linked profile and favorites data. Chat sessions linked to your account are anonymised on account deletion by removing the account association. Deleted personal data may remain in encrypted backups for up to 30 days before being purged from backup storage.

4. Cookies

XOCOA uses strictly necessary cookies and browser storage to maintain authentication sessions, security, and service functionality. These do not require your consent, because without them the service cannot work.

We also use Google Analytics to understand how the site is used, and we store a first-party session identifier in your browser so that repeat visits can be recognised. Both are optional. Neither runs until you accept them: nothing is written to your browser and no analytics request is sent while your choice is undecided or refused.

You choose per purpose. Improve covers usage measurement, including Google Analytics. Research covers the anonymised taste and preference signals we study to make recommendations better. You can change or withdraw either at any time from the “Manage my data” link in the footer, and a refusal is remembered so you are not asked again for six months.

We do not use advertising cookies, retargeting pixels, cross-site tracking, heatmaps, or session-replay tools.

5. Third-Party Services

We use service providers only where necessary to operate XOCOA. Google provides OAuth sign-in. Clerk provides authentication and account management. Supabase provides database hosting. Our AI inference providers, which may include Azure OpenAI, Groq, and Google Gemini, process chat messages solely to generate sommelier responses. Hosting providers process request data to deliver the website and application. A GeoIP provider may receive the signup IP once to derive approximate country.

  • Google OAuth, policies.google.com/privacy
  • Clerk, clerk.com/legal/privacy
  • Supabase, supabase.com/privacy
  • Microsoft Azure, azure.microsoft.com/en-us/support/legal/
  • Groq, groq.com/privacy
  • Google Gemini, policies.google.com/privacy

6. Your Rights (GDPR)

If you are located in the European Economic Area you have the right to:

  • Accessrequest a copy of personal data we hold about you. Logged-in users can self-serve at /sommelier/account via “Export my data”.
  • Rectificationrequest correction of inaccurate or incomplete personal data.
  • Erasurerequest deletion of your personal data. Logged-in users can self-serve at /sommelier/account via “Delete account”.
  • Portabilityyour export is provided in JSON format for portability.
  • Restrictionrequest restriction of processing in specific cases.
  • Objectionobject to processing based on legitimate interests.
  • Complaintlodge a complaint with your local data protection authority.

For any request, contact us at hello@xocoa.co.

7. Changes to This Policy

We may update this policy as our service evolves. Material changes will be reflected in an updated effective date above. Continued use of XOCOA after a change constitutes acceptance of the revised policy.

8. Contact

Questions about this policy? Reach us at hello@xocoa.co.