Privacy Policy

Effective date: 17 March 2026

1. Who We Are

The XFID Registry at xframework.id is operated by Vector Bravo Ltd ("we", "us"). For privacy inquiries, contact privacy@xframework.id.

2. What We Collect

Registry browsing (no account required)

We do not use analytics trackers, advertising cookies, or third-party tracking scripts. Standard server logs may record your IP address, browser user-agent, and requested URLs for security and operational purposes. These logs are retained for up to 30 days.

Account registration

When you create an account, we collect:

• Email address — used for authentication, account recovery, and service communications
• Display name (optional) — shown in the dashboard and submissions
• Organization name (optional) — used for organization-level features
• Password — stored as a salted PBKDF2-SHA256 hash; we never store or see your plaintext password

Document submissions

When you submit a document, we store the document file, its computed XFID, metadata you provide, and your account identity as the submitter.

XF ID request form

If you use the public request form, we collect the name, email, organization, and description you provide. This data is stored in our request management system to process your request.

3. How We Use Your Data

• To authenticate you and maintain your session
• To process document submissions and XF ID requests
• To communicate with you about your account or submissions
• To maintain the security and integrity of the Registry

We do not sell your personal data. We do not use your data for advertising. We do not share your data with third parties except as required by law.

4. Cookies

We use a single essential cookie (xfid_session) to maintain your login session. This cookie is HttpOnly, Secure, and SameSite=Lax. It expires after 24 hours. We do not use analytics cookies, advertising cookies, or third-party cookies of any kind.

5. Data Storage

Your data is stored on Cloudflare's global network using Cloudflare D1 (database) and Cloudflare R2 (document files). Cloudflare processes data in accordance with their privacy policy. Data may be stored and processed in the United States and the European Union.

6. Your Rights

You have the right to:

• Access your personal data held by us
• Correct inaccurate personal data
• Delete your account and associated personal data
• Export your submission history

To exercise these rights, email privacy@xframework.id. We will respond within 30 days.

Note: XFID identifiers and public registry metadata associated with submitted documents are part of the public registry record and are not deleted when an account is removed.

7. Changes

We may update this policy from time to time. Material changes will be announced on the site. The effective date at the top of this page indicates when the policy was last revised.