Privacy notice

1Who is responsible

RapidGoo FZC, a free zone company in the United Arab Emirates, runs XivoERP and is responsible for the personal data described here. Contact us at support@rapidgoo.com.

Two different roles matter in this notice:

• Your account data — the people who sign in to XivoERP. We decide how this is handled, so we are the controller.
• Your business data — the customers, suppliers, staff and documents you record inside XivoERP. You decide what goes in and why; we only process it to run the service for you. If that data includes personal information about other people, you are the controller and we act on your instructions.

2What we collect

Account and identity

Name, email address, the organization name you register, your country, base currency and timezone. We store a bcrypt hash of your password, never the password itself.

Technical and security records

Every sign-in attempt — successful or failed — is recorded with the IP address, browser user agent, platform and device name, the email address used, and whether it succeeded. This is a security and audit record: it is how an account compromise gets investigated. We also keep session and refresh-token records so you can stay signed in and so sessions can be revoked.

Billing

Billing contact name and email, country, currency, the package and term you chose, and the invoices we issue. If you pay by bank transfer you also give us a bank reference and upload a proof of payment (JPEG, PNG or PDF, up to 2 MB), which is stored with your submission.

We do not store card numbers. Card payments are not currently available in XivoERP — bank transfer is the live payment method. See the Offer details.

The business data you enter

Whatever you record: customers and suppliers with their contact details, tax registration numbers and bank details; items; quotations, invoices, bills, receipts and payments; ledgers and reports. If you configure printed documents, that can include an image of an authorised signatory’s signature, a company stamp, your logo and your own bank account details.

What your customers submit through public links

On the Advanced package, a business can invite its own customers to submit feedback and documents through secure links, without creating an account. What arrives — the rating, the comment, any uploaded files (PDF, JPG or PNG), and when it was submitted — is stored against the customer record the business created, alongside their name. This is the business’s data in the sense of clause 1: the business using XivoERP decides who to ask and what to ask for, and we process the submissions on its behalf. If a business publishes feedback as a testimonial, that is the business’s action and responsibility, not ours.

The links themselves contain a long random token and nothing personal. If you received such a link and want your submission changed or removed, contact the business that sent it to you — they control it.

Email records

When we send you a message — a password reset, an invitation, a confirmation link or a subscription invoice — we log the recipient address, subject, which template was used and whether it was delivered.

3Why we use it

• To provide the service — creating your organization, signing you in, storing and displaying your data, producing your documents and reports.
• To secure it — detecting and investigating unauthorised access, keeping the login audit trail, and rate-limiting sign-in attempts.
• To bill you — quoting, issuing invoices, and reviewing bank transfer proofs.
• To communicate — service email such as password resets, invitations, address confirmation and invoices. These are necessary to operate your account, so they are not marketing and cannot be switched off while your account is open.
• To meet legal obligations — keeping the accounting records we are required to keep.

We do not sell your data, share it with advertisers, or use it to train machine learning models.

4Cookies and browser storage

XivoERP sets no cookies at all — not for sign-in, not for analytics.

The application keeps a few values in your browser’s own storage so you stay signed in and return to the right organization:

• rapiderp.refreshToken — your session refresh token. If you ticked “Remember me” it is kept in localStorage and lasts up to 90 days; otherwise it goes in sessionStorage and disappears when you close the tab.
• rapiderp.rememberSession — whether you chose to be remembered.
• rapiderp.organizationId — the organization you last had open.
• xivoerp-theme — light or dark preference on this website.

Signing out clears the tokens. Because these are stored in the browser rather than in an HttpOnly cookie, a cross-site scripting flaw in the application could expose a long-lived session — we mention it because it is a real trade-off, not a theoretical one.

5Who else sees it

We keep the list of third parties deliberately short. Today it is:

There is no analytics, tracking, advertising, session-recording or error-reporting service in XivoERP. We checked rather than assumed.

One distinction worth being precise about: the fonts on xivoerp.com are loaded from Google, which means Google receives your IP address when you browse this website. The application itself at app.xivoerp.com loads no external fonts, scripts or resources at all.

We may also disclose data where the law requires it, or to protect our rights or someone’s safety.

6Where your data is stored

Your data is stored on servers in Singapore. Service email is sent through Mailgun’s European Union infrastructure, which means the recipient address and subject line of those messages are processed in the EU.

If you are in a country with data transfer restrictions, note that using XivoERP involves your data being stored outside that country.

7How long we keep it

Some of this is automatic; some is not, and we would rather say so plainly.

Backups are taken nightly and kept for 14 days, so deleted data can persist in a backup for up to that long.

8How we protect it

What is actually in place:

• Passwords hashed with bcrypt at cost factor 12 — never stored or logged in readable form.
• All traffic served over HTTPS.
• Short-lived access tokens (15 minutes) with rotating refresh tokens, and detection of a refresh token being replayed.
• Password reset and confirmation links stored only as a SHA-256 hash, single-use, and expiring.
• Tenant isolation: the organization whose data you can reach is taken from your signed token and your membership, never from anything the browser sends. Every query is filtered by it.
• Per-user module permissions, so people see only the parts of the system you grant them.
• Rate limiting on sign-in and password endpoints at the web server.
• Nightly database backups, kept 14 days.

And what is not, because you should know before you decide:

• Data is not encrypted at rest. It is protected by access controls on the server, not by disk or field encryption.
• Backups are held on the same machine as the database and are not copied off-site, so they protect against mistakes and corruption, not against loss of the machine.
• Rate limiting exists at the web server only, not inside the application.

We are working on these. If your organization has a policy that requires encryption at rest or off-site backups, talk to us before you commit.

9Your rights

You can ask us to give you a copy of your personal data, correct it, delete it, or restrict how we use it. Email support@rapidgoo.com and we will respond within 30 days.

Two practical points. Much of what you might want is already in your hands: you can edit your own details, manage the people in your organization, and export reports and document listings to CSV at any time while you have access.

And there is no self-service account deletion in the product today. Deletion is handled by request, by a person, and we will confirm when it is done. We will keep the records we are legally required to keep, such as invoices issued to you.

If you are an employee, customer or supplier of a business that uses XivoERP and you want your data changed or removed, contact that business — they control it, and we act on their instructions.

10Children

XivoERP is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children.

11Changes

If we change this notice in a way that materially affects you, we will email the account owner before it takes effect. The date at the top shows the current version.

12Contact

RapidGoo FZC, United Arab Emirates.
Email support@rapidgoo.com · Phone +971 50 871 3471