Privacy Policy

What we collect

• Account details: your email address, the name your faxes carry, your fax number if you have a plan, and your settings.
• Sign-in and security: your password, sign-in codes, your second sign-in factor if you add one, and records of your sign-ins.
• Documents and faxes: the files you upload, your cover pages, the faxes you send, and the faxes sent to your number. They can hold any information, including Social Security numbers, other government ID numbers, financial account numbers, and health and tax information, about you or about other people.
• Fax records: for each fax, the numbers, the date and time, the pages, the status and the delivery result.
• Orders and payments: what you bought, when and at what price, the terms and prices it was placed under, and payment details from our payment processor, such as whether a payment went through. Our payment processor collects your card details.
• Messages: what you write to us or to Xippy, and the replies.
• Device and usage data: your IP address, your device and browser, the pages you visit, what you click or tap, how you scroll and move the pointer, and the page or ad that brought you. We and our partners collect it with cookies and similar tools.
• Advertising data: what you do after you see or click a XipFax ad, such as signing up or buying, with the purchase’s value, and a hashed (scrambled) copy of your email address that matches a purchase to an ad.
• Your choices: what you consented to or opted out of, and when.

We collect it from you, from people who send faxes to your number, from your device, and from our service providers.

How we use it

• To provide XipFax: run your account, send your faxes, receive faxes at your number and deliver them to your account and email, and keep your fax log.
• To take payments, send receipts, and keep each order’s terms and prices.
• To answer you, and to act on requests and complaints.
• To keep XipFax secure, and to prevent fraud, abuse and unlawful faxes.
• To meet legal duties, and to make or defend legal claims.
• To measure and improve XipFax and our site.
• To advertise XipFax, including targeted advertising.
• To send you service emails, and marketing emails you can unsubscribe from.

Who we share it with

• The numbers you fax: each fax goes to the number you choose.
• Service providers that work for us: hosting and storage, our fax carrier, email delivery, customer support, payment processing, analytics and an AI service.
• Advertising and analytics partners: Google. See below.
• Professional advisers: such as lawyers and accountants.
• Authorities and others: when the law requires it, or to protect our rights, safety or property, or those of our clients or others.
• A buyer, successor or affiliate: if all or part of our business or XipFax is sold, merged, reorganized or transferred, including to a company that controls, is controlled by or is under common control with us.
• Anyone else: when you ask us to.

Advertising, analytics and your choices

Our pages carry tags from Google, including the pages that find where to fax a form to a government office. Through these tags, Google collects device and usage data and advertising data. That includes the pages you visit, which can show the form or office you looked up. When you sign up or buy, it includes that action, its value and a hashed copy of your email address. Google can collect information about your online activities over time and across different websites when you use XipFax.

We use this to measure our ads and our site. We also use it for targeted advertising: showing XipFax ads on other sites and apps to people who visited ours.

From Google Analytics we use its advertising features: remarketing, and its link to Google Ads, through which it collects data for advertising. With them, we and Google use first-party cookies and identifiers, such as the Google Analytics cookie, together with third-party ones, such as Google’s advertising cookies, to show XipFax ads to people who visited our site and to measure what those ads bring.

PostHog, our analytics service provider, measures how visitors use our pages for us alone, with first-party cookies and similar tools. It makes heatmaps and recordings of clicks, taps, scrolling and pointer movement.

We do not sell personal information for money. For Nevada residents, our Contact page is our designated address for requests not to sell personal information.

You can also turn off Google’s ad personalization in Google’s Ads Settings, or opt out of many companies’ targeted ads at once through the NAI’s consumer opt-out.

Do Not Track. We do not respond to Do Not Track or Global Privacy Control signals.

Your rights and requests

Depending on where you live, the law may give you rights over your personal information. They can include the right to confirm whether we process it, to see it, to correct it, to delete it, to get a copy, to learn which third parties we have sold it to, to opt out, and to withdraw a consent.

To use these rights, or to review or change your information, write to us on our Contact page. You don’t need a XipFax account. If you have one, give its email address; otherwise we may ask for information to confirm who you are. You can also see and download your faxes in your account.

To delete your account and its data, write to us on our Contact page, giving your account’s email address, or delete it from your account. We then delete them, except records we must keep or need for a legal reason, such as order and payment records, and records that identify no one. A copy of a received fax we emailed you stays with our email provider for up to 30 days after we sent it, and copies in our backups go as the backups expire.

If you are in the EEA or the UK

We use personal information on these legal bases:

• Our contract with you: to provide XipFax, take payments, send receipts and answer you.
• Legal duties: such as keeping tax and payment records.
• Our legitimate interests: to keep XipFax secure, prevent fraud and abuse, make or defend legal claims, measure and improve XipFax, and market and advertise it.
• Your consent: where we ask for it, which you can withdraw at any time.

We need your account details, documents and payment to provide XipFax; without them we can’t send or receive your faxes.

We are based in the United States, and we and our service providers process personal information there. We transfer it there under the safeguards the law recognizes, such as the European Commission’s standard contractual clauses in our service providers’ terms, or because the transfer is needed to provide XipFax to you. To get a copy of a safeguard, write to us on our Contact page.

Beyond the rights above, you can ask us to restrict our use of your information, and object to a use based on our legitimate interests, and to direct marketing at any time. You can also complain to the data protection authority where you live or work, or where you think the law was broken; in the UK, that is the Information Commissioner’s Office.

Social Security numbers

Documents and faxes can hold Social Security numbers. We protect their confidentiality, prohibit their unlawful disclosure, and limit who can access them.

Health information

Health information in documents and faxes is subject to electronic disclosure. XipFax sends each fax electronically to the number you choose, and delivers the faxes sent to your number to your account and email. You authorize each fax you send when you send it.

AI training

We do not collect, use or sell personal information to train large language models.

How long we keep it

We keep personal information, documents and faxes included, for as long as we have a business or legal reason to. Such reasons include providing XipFax, keeping your fax log, meeting legal duties and resolving disputes.

Changes to this policy

When we change this policy, we post the new version here with its date.

Contact

Questions, requests and complaints: write to us on our Contact page.