Privacy Policy

Last updated: 18 July 2026

Xale is a productivity service operated by Kayu Pte Ltd (UEN 201820276M), a company incorporated in Singapore ("Kayu", "Xale", "we", "us" or "our"). This policy applies to Xale's websites, web app, and any desktop or mobile applications, browser extensions, or related services that link to it.

Our public service address is One North Crescent, Level 7, Suite 7052, Singapore 138538. Our Data Protection Officer and support team can be reached at support@xale.app.

In brief

Your notes, mindmaps, lists, tasks and other content remain yours. We use personal data to provide and secure Xale, operate the features you choose, administer subscriptions, support you, meet legal obligations, and improve the product. We do not sell personal data or use it for cross-context behavioural advertising. You can export your content and request deletion of your account.

Personal data we collect

  • Account and profile data. Your email address, display name, account identifiers, authentication provider, and account preferences. Guest use creates a pseudonymous Firebase account identifier but does not require an email address.
  • Your content. Notes, mindmaps, lists, tasks, rhythms, events, projects, chats, captures, files, images, audio, links, imported material, AI prompts and outputs, and the relationships or metadata you add to them.
  • Connected-service data. Information you choose to import from or synchronise with services such as Google Calendar, Google Tasks and Google Drive, together with the permissions and tokens needed to maintain the connection.
  • Payment and subscription data. Contact and billing details, product and price selected, subscription status, tax, receipts, refunds, disputes and limited payment-method information. Full card numbers and card security codes are collected by Stripe or the relevant app store, not stored by Kayu.
  • Technical and usage data. IP address, approximate location derived from IP, device and browser type, operating system, app version, referral information, pages and features used, timestamps, performance data, crash information and security logs.
  • Communications. Messages, attachments and account information you provide when you contact support or respond to a service communication.

How we collect it

We collect data directly from you, automatically from your device and use of Xale, from services you choose to connect, and from transaction partners such as Stripe, Link, Apple or Google Play. We do not collect data from a connected service until you authorise the relevant connection.

How and why we use personal data

  • Provide, personalise, synchronise and maintain Xale.
  • Authenticate accounts and keep the service and users secure.
  • Run AI-assisted features when you choose to use them.
  • Process subscriptions, tax, receipts, refunds and disputes.
  • Provide support and send service, billing and security messages.
  • Understand feature use, diagnose problems and improve Xale using usage data and aggregate or de-identified patterns.
  • Comply with law, enforce our terms and protect legal rights.

Under Singapore's Personal Data Protection Act 2012 (PDPA), we collect, use and disclose personal data for purposes a reasonable person would consider appropriate and on a valid basis, including consent, deemed consent and applicable exceptions. Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you, compliance with legal obligations, our legitimate interests in operating, securing and improving Xale, and consent where the law requires it. You may withdraw consent, but doing so may prevent us from providing the affected feature.

How we improve Xale

We may analyse feature usage, navigation paths, performance, conversion and other behavioural patterns to understand how Xale is used and decide what to improve. Kayu personnel may manually review aggregate reports or de-identified examples. We take reasonable steps not to identify you from data that has been de-identified and do not use ordinary private content as a general product-research dataset. We may access identifiable content when you ask for support and give us permission, when needed to investigate abuse or security issues, to operate a feature you request, or where law requires or permits it.

We may use Google Analytics on public marketing pages in a consent-denied or otherwise privacy-limited configuration, where permitted, and Sentry for error and performance diagnostics. These services may receive technical and usage data. Sentry is configured without session replay and to minimise personal data. Where local law requires consent for analytics or similar technologies, we will seek it before enabling them.

AI-assisted features

When you use an AI-assisted feature, Xale sends the content and instructions needed for that request to one or more configured providers, currently Anthropic, OpenAI and Google. The provider may vary by feature, availability, account settings or a fallback needed to complete the request. The provider returns an output to Xale, and we may store the request, output and limited telemetry where needed to deliver the feature, maintain context, control cost, investigate errors or prevent abuse.

External AI providers process submitted material under their own commercial terms, privacy notices and service settings in effect at the time. Those terms and practices may differ and can change. Do not use an AI feature for information you are not comfortable sharing with the selected provider. If Xale lets you supply your own provider key, that provider's terms also govern your use and the material sent with that key.

Payments through Stripe Managed Payments

Web purchases of Xale Pro use Stripe Managed Payments. Stripe's affiliate Sold through Link, LLC ("Link") acts as merchant of record for the transaction and as Kayu's agent to charge and collect subscription payments. Stripe and Link receive transaction data such as your name, email address, billing address, payment-method details, product and subscription information, applicable tax, payment status, refunds, chargebacks and transaction-support communications. A Link account may be required to manage a web subscription.

Stripe and Link use this information for checkout, payment collection, fraud prevention, tax administration in supported jurisdictions, receipts, subscription management, refunds, disputes, transaction support and their legal obligations. They act as independent controllers for a number of these purposes and may act as processors for limited services. Kayu receives order and subscription status and may receive limited payment-method information such as card brand and last four digits. See the Stripe Privacy Policy and Link Terms.

Who receives personal data

We disclose only what is reasonably needed for the purposes described in this policy. Recipients may include:

  • Google Firebase and Google Cloud for authentication, database, file storage, hosting and server infrastructure.
  • Stripe and Link for web billing and the transaction functions described above.
  • Anthropic, OpenAI and Google when an AI-assisted feature sends them the relevant request material.
  • Google connected services when you authorise Calendar, Tasks or Drive access.
  • Sentry and Google Analytics, if enabled, for diagnostics and privacy-limited website analytics.
  • Professional advisers, auditors, insurers, authorities and other parties where reasonably necessary to comply with law, protect rights, complete a corporate transaction or obtain professional advice.

We do not sell personal data or share it for cross-context behavioural advertising. We may disclose aggregate or de-identified information that does not reasonably identify an individual.

If you connect Google Calendar, Tasks or Drive

These connections are optional and off by default. You grant access through Google's consent screen and can revoke it from Xale or your Google Account permissions.

  • Google Calendar. Xale reads selected calendar events to display them, identify conflicts and provide requested planning features. If write-back is enabled, Xale creates and manages events only in its dedicated Xale calendar.
  • Google Tasks. If you enable task sync, Xale reads tasks and writes to a dedicated Xale task list.
  • Google Drive.Xale accesses only files you select through Google's file picker for the requested import.

Xale's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, sell it, or permit human access except with your permission, for security, to provide or improve the user-facing connected feature, or as law permits.

Offline and on-device storage

Xale stores a local copy of data in the browser or app to support offline use and faster loading. On the web, this persistent cache can remain on the device between sessions and may remain after sign-out until browser or site data is cleared. Use Xale on a trusted device, especially for sensitive content, and clear site or app data before giving another person access to the device.

International transfers

Xale's primary Firestore database is hosted in Singapore. Firebase Authentication is processed in the United States, and Google and our other providers may process data in additional countries where they or their service providers operate. Where personal data is transferred outside Singapore, the EEA or the UK, as applicable, we use contractual protections or other recognised safeguards intended to provide a comparable standard of protection. You may contact us for more information about the safeguards relevant to your data.

Retention and deletion

  • Account data and active content are kept while your account remains open and as needed to provide Xale.
  • Items moved to Trash remain until you permanently delete them or delete the account. Versions, security logs and operational backups may remain for a limited period under normal recovery and security cycles before being overwritten or deleted.
  • A successful account-deletion request removes Xale-controlled account content from active Firebase systems. Some local copies may remain on your devices until you clear them.
  • Transaction, invoice, tax and accounting records are kept for at least five years from the relevant Singapore year of assessment, or longer where another law, dispute, refund or audit requires it.
  • Support, fraud and security records are kept only as long as reasonably needed for the issue, legal claim or safety purpose. External providers retain data under their own terms and legal obligations.

We may retain aggregate or de-identified information that no longer reasonably identifies you. Deletion does not require Stripe, Link, app stores or other independent controllers to erase records they must keep for tax, financial, fraud or legal purposes.

Your choices and rights

  • Access and portability.Use Xale's export tools or ask us for access to personal data we control.
  • Correction. Edit your content and profile or ask us to correct inaccurate account data.
  • Deletion. Permanently delete individual items or delete your account from Settings. You may also contact us.
  • Consent and integrations. Withdraw consent or disconnect an optional integration. This does not affect processing already lawfully completed.
  • Additional regional rights. Depending on where you live, you may have rights to object, restrict processing, receive a portable copy, appeal a decision, or complain to a regulator. We do not discriminate against you for exercising a privacy right.

To exercise a right, email support@xale.app from the address connected to your account. We may need to verify your identity and may deny or limit a request where law permits. You may complain to Singapore's Personal Data Protection Commission or the privacy regulator where you live.

Security

We use measures designed to protect personal data, including encrypted transport, provider encryption at rest, access controls, per-user data isolation and security monitoring. No service is completely secure. Keep your account and devices protected and contact us promptly if you believe your account has been compromised.

Adults only

Xale is intended only for people aged 18 or older. You may not create or use an account if you are under 18. If we learn that we collected personal data from someone under 18, we may close the account and delete the data, subject to legal retention requirements.

Changes to this policy

We may update this policy as Xale, our providers or the law changes. We will update the date above and give reasonable advance notice of a material change where required. If consent is legally required for a new use, we will request it.

Contact and Data Protection Officer

Kayu Pte Ltd's Data Protection Officer and support team can be reached at support@xale.app, or by post at One North Crescent, Level 7, Suite 7052, Singapore 138538.