Privacy Policy

NicheXML (“we”, “us”) provides a web platform for converting spreadsheet data to schema-validated XML. This Privacy Policy explains what information we collect, why we collect it, and the choices you have. It is designed to meet the requirements of the EU General Data Protection Regulation (GDPR).

Data controller. NicheXML is operated by an individual provider based in Greece. All data-controller responsibilities under GDPR rest with the operator personally. Contact: support@nichexml.com.

1. Information we collect

1.1 Account data

When you register, we collect your name, email address, and a hashed password. To reduce fraud and abuse at signup, we also record the IP address and browser user-agent associated with your registration.

1.2 Content you upload

When you convert a file, we temporarily store the Excel spreadsheet you uploaded and the XML output we generated. Both are kept for 30 days and then automatically deleted; the underlying conversion record (filename, target schema, status) remains in your account history.

1.3 Billing data

All payment processing is handled by Stripe. We do not receive or store your card number, expiry date, CVC, or billing address. From Stripe we receive and store only: a customer identifier (cus_…), your active subscription’s identifier and price, and the payment method type (e.g. “card”). We do not display or process your card number on NicheXML — Stripe’s hosted checkout and billing portal handle every card-related operation.

1.4 Usage data

We keep a per-user counter of conversions consumed in the current billing cycle, and a per-conversion record of file name, target rule, status, and timestamps.

1.5 Cookies and local storage

• Session cookie — strictly necessary to keep you logged in. Not used for tracking or analytics.
• CSRF token cookie — protects form submissions from cross-site request forgery.
• Local storage — used only to remember your theme preference (light/dark/system) when you are not signed in. No personal data is stored there.

2. Why we use your data (legal bases)

• Service delivery — to provide the conversion service you signed up for. Legal basis: performance of a contract.
• Billing — to charge for your subscription and issue receipts. Legal basis: performance of a contract.
• Abuse prevention — to detect fraud, spam, and misuse (e.g. throwaway signups, duplicate trial abuse). Legal basis: legitimate interest.
• Legal compliance — to keep records required by tax and accounting law. Legal basis: legal obligation.

3. Who has access

Access to your data is limited to:

• You, through your account.
• Our processors: Stripe (payments), our transactional email provider, our hosting provider. Each is bound by a data-processing agreement and processes data only on our instructions.
• Administrators of NicheXML, for support, abuse investigation, and legal-compliance purposes.

We do not sell your data. We do not share it with advertising networks.

4. How long we keep your data

• Uploaded files and generated XML: 30 days from creation, then automatically deleted.
• Account data: kept for as long as your account exists. When you delete your account, personal data is removed and conversion history is anonymised, except where retention is required for tax or accounting compliance.
• Billing records: kept for the period required by applicable tax law (typically ten years in the EU).

5. Your rights under GDPR

You have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data (right to be forgotten), subject to legal-retention limits.
• Request portability of your data in a machine-readable format.
• Object to processing based on legitimate interest.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your national data-protection authority (in Greece: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα).

To exercise any of these rights, email support@nichexml.com. We respond within 30 days.

6. International data transfers

Our infrastructure is hosted in the EU. Stripe operates globally; transfers of billing data outside the EU are governed by Stripe’s standard contractual clauses.

7. Security

Passwords are stored using industry-standard hashing (bcrypt). All connections use HTTPS. Card data never touches our servers — Stripe is PCI DSS Level 1 certified. We keep the software stack up to date and monitor for security advisories.

8. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify signed-in users by email and update the “Last updated” date above.

9. Contact

Questions or requests: support@nichexml.com.