1. Introduction
Welcome to XMLExpress. This Privacy Policy explains how we collect, process, store, and protect information when you use our software-as-a-service (SaaS) platform to automate CSV-to-XML conversions for government payroll compliance. Transparency is core to our operations, and this document details our practices from data collection to deletion.
2. Our Role: Data Controller vs. Data Processor
Because our platform handles both your account details and your employees' payroll information, XMLExpress operates in two distinct legal capacities:
- Data Controller: For the information you provide to create an account, manage your subscription, and receive customer support, XMLExpress acts as the Data Controller, meaning we determine the purposes and means of processing this data.
- Data Processor: For the raw payroll files you upload for conversion (which may contain names, wages, hours, and fringe rates for Davis-Bacon or WH-347 compliance), your company is the Data Controller. XMLExpress acts exclusively as a Data Processor. We process this data strictly based on your documented instructions to fulfill our contractual obligation of providing the XML conversion service.
3. Information We Collect
We collect the following categories of information:
- Account and Billing Data: Your name, business email address, company details, and payment information required to manage free-tier or paid subscriptions.
- Uploaded Payroll Data: The CSV, Excel, or other data files you upload into our platform for conversion purposes.
- Automatically Collected Data: Usage patterns, IP addresses, and interaction metrics gathered by the application to ensure security and improve functionality.
4. How We Use the Information
We use your information exclusively for the following purposes:
- To provide, operate, and maintain the CSV-to-XML conversion engine.
- To support account management, billing, and subscription services.
- To maintain compliance with regulatory obligations, conduct regular security audits, and protect the platform against unauthorized access.
5. Data Sharing and Third-Party Subprocessors
We do not sell your personal data or your employees' payroll data. We only share information with trusted third-party services (subprocessors) that are strictly necessary to deliver our services. These include:
- Payment Processors: Such as Stripe, to securely handle your subscription transactions.
- Cloud Infrastructure: Hosting providers, such as Vercel and our backend servers, required to process the conversions.
- AI Mapping Assistance (Anthropic): When our deterministic column matcher cannot recognize a CSV header, the header names only — never employee names, wages, hours, SSNs, or any other payroll values — may be sent to Anthropic's Claude API to suggest a mapping, which you review and approve before it is applied. Anthropic does not use data submitted through its API to train its models. All payroll data flows exclusively through our deterministic conversion engine.
All third-party subprocessors are bound by Data Processing Agreements (DPAs) and adhere to the same stringent data privacy and security standards as XMLExpress.
6. Data Retention and Security
- Security Measures: We implement strict access controls, encryption, continuous monitoring, and an Information Security Management System (ISMS) to safeguard the highly sensitive nature of government payroll data.
- Retention Policy: We retain your account and billing data for as long as your account is active. Raw payroll data and the resulting generated XML files are retained only for the duration necessary to complete the conversion process. We enforce clear retention limits and automate deletion to ensure "we keep everything forever" is not our policy.
7. Your Data Rights
Depending on your jurisdiction (such as under GDPR or CCPA), you have the right to:
- Access: Request a copy of the personal data we have collected about you.
- Correction: Request that we correct inaccurate personal information.
- Deletion ("Right to be Forgotten"): Request that we delete data that is no longer required.
- Data Portability: Receive your data in a structured, machine-readable format to transfer to other platforms.
- Restriction: Restrict our processing of your data while a request is being resolved.
8. Contact Information
If you have any questions about this Privacy Policy, wish to exercise your data rights, or need a copy of our DPA template, please contact us at:
Email: support@xmlexpress.com