Privacy Policy — Xtra-dev (Wyxloop Corp)

1. Who we are

Xtra-dev is the brand of Wyxloop Corp ("Xtra-dev", "we", "us"), a small company run by its founder. We build and operate websites, client systems, automations and IT services for our clients, and we publish our own products, among them MyXCapital, a personal-finance app. For everything in this policy Wyxloop Corp is the data controller. You can reach us at contact@xtra-dev.com.

2. What this policy covers

This single policy covers every way you can interact with Xtra-dev:

• The public website (xtra-dev.com): pages, the contact and quote forms, the free-consultation booking and the Custom PC builder.
• Client systems and the administration platform: the portals we run for our clients and the tools our team uses to deliver the work.
• Invoices and payments: the invoices we send, the pay pages behind them and the payment flows our products offer.
• MyXCapital: the web app at xtra-dev.com/capital and the MyXCapital mobile app, which is the same app inside a native wrapper. Section 7 is dedicated to it.
• Giveaways, newsletters and social content we publish.

Where a client asks us to build or run a system for them, the client is the controller of its users' data and we act on the client's instructions under a data processing agreement; this policy describes our own processing.

3. Data we collect

• Contact and quote requests: name, work email, company, phone (optional), what you need, budget range and anything you write to us.
• Accounts (invited users only): email, full name, role, password hash, two-factor settings and recovery codes (hashed), trusted devices, sessions, and a security event log (sign-ins, two-factor events, administrative actions).
• Billing records: the invoices we issue, who they were sent to, when they were viewed and paid, and the payment reference Stripe gives us. We never see or store full card numbers.
• Operational data: IP address, browser or app version, request timestamps and error reports needed to run and protect the service.
• Cookies: a session token, a CSRF token, a theme preference and a consent record — all strictly necessary. No advertising or tracking cookies.
• MyXCapital data: described in section 7.

We do not buy data, we do not run third-party advertising and we never sell or rent data to anyone.

4. How we use data

• To answer your request and prepare a scope, estimate or proposal.
• To run the account or workspace you were invited to: sign-in, two-factor authentication, billing and support.
• To issue invoices, take payments and keep the books.
• To keep the service secure: rate limiting, abuse detection, session management, incident response.
• To provide the features of our products exactly as described in the product (for MyXCapital, section 7).
• To meet legal, tax and accounting obligations.

5. Legal bases

Where the GDPR or a similar law applies, we rely on: (a) the performance of a contract, including the terms you accept when you use one of our products; (b) our legitimate interest in operating, improving and securing the service; (c) your consent, which you can withdraw at any time, for anything optional such as push notifications or a connected bank; and (d) legal obligations for tax and accounting records.

6. Who we share data with

Only the providers we need to deliver the service, each bound by its terms and a data processing agreement and limited to what its function requires:

• Stripe — payments and payouts (card data goes straight to Stripe; we store only payment references).
• Plaid and SimpleFIN — read-only bank connections for MyXCapital (section 7).
• Anthropic — the AI model behind the MyXCapital assistant (section 7).
• Google Firebase Cloud Messaging — delivery of push notifications to the Android app; Apple Push Notification service for iOS when it ships.
• Microsoft 365 — our email; Contabo — server hosting; S3-compatible object storage — encrypted backups.

We may also disclose data when the law requires it or to protect our rights, our users or the public. If Wyxloop Corp is ever acquired, this policy continues to apply to the data and we will tell you before anything changes.

7. MyXCapital

MyXCapital is Xtra-dev's personal-finance app: your accounts, transactions, bills, debt, savings goals, invoices and properties in one private place. It is the same app on the web (xtra-dev.com/capital) and in the MyXCapital mobile app, which loads it inside a native shell. Everything in it is private to the person who owns the workspace and to the people that person invites.

7.1 Bank connections (read-only)

You can connect a bank, card or credit-union account through Plaid, or through SimpleFIN. You authorize the connection directly with the aggregator; we never receive or store your online-banking credentials. From the connection we receive read-only account details (institution, account name and type, masked account number, balances, and for cards the statement balance, minimum payment and due date) and transaction history (date, amount, merchant or description, pending status). Plaid's handling of your data is described in the Plaid End User Privacy Policy. You can disconnect a bank at any time from MyXCapital; this removes the connection at the aggregator and stops synchronization.

7.2 What we do with your financial data

Only what the app shows you: balances and net worth, categorized spending and budgets, bills and subscriptions, debt payoff plans, alerts, savings goals and reports. Financial data is never sold, never shared for marketing, never used for advertising and never used for credit decisions. We do not use it to train AI models.

7.3 Invoices and payments

If you invoice your own clients from MyXCapital, your business details, your clients' names and emails and the invoice contents are processed to produce, send and collect the invoice. Payments run through Stripe on your own connected Stripe account; the people who pay you give their card or bank details to Stripe, not to us. Platform fees are shown before you accept them.

7.4 AI assistant

The assistant answers questions about your finances. When you ask something, the question and a compact summary of the relevant data (account names and balances, categorized totals, upcoming bills, alerts, the transactions needed for the question) are sent to Anthropic's API, which processes them to produce the answer and does not use them to train its models. The assistant can only read your data and propose changes; nothing is changed without your confirmation in the app. The assistant can be turned off in Settings.

7.5 Alerts and push notifications

MyXCapital computes alerts (payments due, overdraft fees, a card near its limit, interest charged) from the data already in your workspace. Alerts can reach you by a daily email and, in the mobile app, by push notifications. To deliver pushes we store a device token issued by Google Firebase (Android) or Apple (iOS) together with your user, the platform and the app version. A push carries only the alert's title and text and the page it opens, never account numbers or transaction details. Turn pushes off in Settings → Notifications or in your phone's settings; the token is deleted when you do, and automatically when the provider reports it as expired.

7.6 The mobile app

The MyXCapital app asks for notification permission so alerts can reach you. If you enable "Require fingerprint / face to open", the check runs entirely on your phone through its own biometric system; we never receive biometric data. The app opens external links in your browser and does not access your contacts, photos, location or microphone. Subscriptions are purchased on xtra-dev.com, not inside the app.

7.7 Sharing a workspace

The owner of a workspace can invite other people. Everyone invited sees the same financial data, so invite only people you trust; the owner can remove access at any time from the Users page.

7.8 Disconnecting and deleting

You can delete accounts and their transactions, disconnect banks, remove invited users and delete invoices yourself. To delete your whole workspace or your account, write to contact@xtra-dev.com; we complete deletion within 30 days, except for the billing records the law requires us to keep.

8. How long we keep data

Our retention rules are published in the Data Retention and Disposal Policy. In short:

• Contact and quote requests: up to 24 months after the last interaction.
• Accounts and workspaces: while they are active; up to 90 days after deactivation, then deleted.
• Security event logs: 180 days. Application logs never contain financial data.
• Financial account data (MyXCapital): while the bank connection is active and until you delete it; deletion requests are honored within 30 days. Alert history and push tokens: about 13 months, or until you turn the feature off.
• Invoices, payments and tax records: as long as tax law requires (typically 5 to 7 years).
• Encrypted backups rotate on a fixed schedule; deleted data leaves them as they rotate.

9. Security

How we protect data is described in our Information Security Policy: HTTPS everywhere, two-factor authentication for every administrator and every MyXCapital user, encryption of aggregator tokens and account numbers at rest (AES-256-GCM), bcrypt-hashed passwords, one private workspace per person enforced by the server on every request, a strict content security policy, rate limiting, audited access and daily encrypted backups. If an incident affects your data we notify you and the relevant authorities without undue delay, and never later than 72 hours after confirming it where the law sets that deadline.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict the processing of your personal data, to object to it, and to withdraw consent. Write to contact@xtra-dev.com; we answer within 30 days and may ask you to confirm your identity first. You may also complain to your local data protection authority.

California residents (CCPA/CPRA) additionally have the right to know, delete and correct, and to opt out of the sale or sharing of personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of; we never discriminate against anyone for exercising a right.

11. Cookies and similar storage

We use only strictly necessary cookies (session, CSRF protection, theme, consent record). The MyXCapital app also stores, on your device only, your theme, whether you dismissed the install hint, whether the biometric lock and push notifications are on, and the push token it registered. No analytics or advertising trackers are present; if we ever add optional analytics they will be opt-in.

12. International transfers

We are based in the United States and our providers may process data there or elsewhere. When data leaves your country we rely on the provider's Standard Contractual Clauses or an equivalent safeguard.

13. Children

Our services are for businesses and adults managing their finances. We do not knowingly collect data from children under 16; if you believe a child gave us data, write to us and we will delete it.

14. Changes to this policy

Material changes are posted on this page with a new version number and effective date; people with an account are also told by email or inside the product. The version history is kept below.

15. Contact

Wyxloop Corp (Xtra-dev) · contact@xtra-dev.com · Security reports: security@xtra-dev.com.

Revision history

Related documents

• Information Security Policy
• Access Control Policy
• Data Retention and Disposal Policy
• Terms of Service