Privacy Policy

1. Introduction

Welcome to Reboot Inc ("we," "us," or "our"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and disclose information when you use our services or visit our website at xomer.ai.

Our services include: professional website design and development for local businesses, SEO (search engine optimization), AEO (answer engine optimization), Google Business Profile management, and ongoing website maintenance plans.

This policy applies to both our direct clients (businesses that engage us for services) and to visitors of xomer.ai. We do not sell, rent, or trade personal information.

This policy covers xomer.ai and our own handling of information. It does not govern the websites we build or host for our clients. Each client website is operated by that client, who is responsible for its own privacy policy, cookie or consent notice, and any other required disclosure. If you are a visitor to a client website, that client's privacy policy applies to you.

2. Information We Collect

From Our Clients:

• Business Information: Company name, contact name, email address, phone number, physical address, and industry type
• Payment Information: Billing details processed securely by Stripe, Inc. (stripe.com). We do not store full card numbers. Stripe's Privacy Policy governs their data practices.
• Project Assets: Text, logos, images, and other materials you provide for website development
• Communication Records: Emails and project-related correspondence
• Website Performance Data: Search-engine reporting we access for your site through Google Search Console and Bing Webmaster Tools, used to monitor performance and report to you. We do not install analytics or advertising trackers on a client website unless the client directs us to in writing. Where a client does, that tool belongs to the client and is governed by the client's own privacy policy.

From Visitors to xomer.ai:

• Inquiry Information: Name, email, phone number, company, and message submitted through our contact or lead forms
• Server Logs: IP address, browser type, and pages requested, held briefly by our hosting provider (Cloudflare) for security and performance. We do not run Google Analytics or any other third-party analytics or advertising tracker on this site.
• Cookies: Essential cookies only, as described in Section 8

From End Users of Client Websites:

When we build or host a website for a client, that client operates the site and is the business and controller for information collected through it. Information submitted through a form on a client website is collected on behalf of that client and transmitted to the client, currently via Airtable. Reboot Inc acts only as that client's service provider and processor for that information. We process it only on the client's instructions and only to provide the service. We do not sell it, share it for cross-context behavioral advertising, use it for our own purposes, or combine it with data from other clients. We do not place our own analytics, advertising or measurement property on a client website. Our contract with each client sets out these limits in writing.

2A. Business prospects

We collect business contact and professional information about prospective customers, including names, business names, roles, business email addresses, business telephone numbers, business and mailing addresses, websites and domains, trade or license information, publicly visible business-listing information, our communications, and inferences about whether our services may be relevant. We obtain this information from public government licensing records, businesses' unrestricted public websites, business-listing and data providers, and communications with us.

We use this information to identify and contact businesses that may be interested in Xomer, verify eligibility and contact details, personalize outreach, prevent duplicate or unwanted contact, comply with law, and protect our systems. We do not use tracking pixels to measure email opens. We disclose only the minimum information needed to service providers that host, secure, analyze, or deliver our systems and communications under contracts restricting their use. We do not sell this information or share it for cross-context behavioral advertising.

We retain active prospect and enrichment records until 120 days after the last outreach or interaction, then delete or deidentify them. In a segregated, access-restricted legal-defense archive that is not used for outreach or enrichment, we retain the complete sent-message artifacts and only the source provenance, consent or suppression events, and compliance-gate fields reasonably necessary to establish legal compliance or resolve claims for five years. When a deletion request reaches that archive, we document any applicable legal-obligation or legal-claims exception and field-minimize the retained record; otherwise we delete or deidentify it. We retain a keyed HMAC or other one-way, purpose-limited suppression token for as long as reasonably necessary to prevent renewed contact. A litigation or regulatory hold may extend these periods.

To request access, correction, deletion, or portability, or to appeal a decision, use our privacy request form at https://www.xomer.ai/privacy-request/ or email privacy@xomer.ai. We verify requests proportionately and do not discriminate or retaliate against anyone for exercising privacy rights.

3. How We Use Information

Client Information Is Used To:

• Design, develop, launch, and maintain websites and digital assets
• Implement SEO and AEO optimization on your behalf
• Manage your Google Business Profile at your direction
• Process payments and issue invoices
• Communicate about your project, deliverables, and service updates
• Monitor website performance and report results to you

Visitor Inquiry Information Is Used To:

• Respond to your questions and assess your project needs
• Send a proposal or quote
• Follow up on your inquiry

4. Data Sharing and Disclosure

We do not sell, rent, or trade personal information. We share data only in the following circumstances:

Service Providers (Limited to What They Need):

• Cloudflare: Website hosting, CDN, and security services
• Airtable: Lead and contact form data routing for client websites
• Stripe, Inc.: Payment processing. Card transactions are handled by Stripe under their Privacy Policy. We do not retain full card numbers.
• Email Delivery: Transactional email service for form notifications and project communications

Legal Requirements:

We may disclose information when required by law, subpoena, court order, or to protect our rights, property, or the safety of our users.

Business Transfer:

If Reboot Inc is acquired, merged, or sells substantially all of its assets, client data may be transferred to the successor entity. We will provide notice before such transfer takes effect.

5. No Guarantee of Search or AI Outcomes

As part of our SEO and AEO services, we optimize your website and online presence to improve visibility in search engines and AI-powered answer engines. However, search rankings and AI recommendations are determined by third-party platforms outside our control.

We do not guarantee any specific search engine ranking, AI recommendation frequency, traffic volume, lead count, or revenue outcome. Any analytics data or performance reports we share are informational and reflect past performance only.

6. Data Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the information we process, including TLS in transit and access controls.

While we implement reasonable security measures, no method of transmission or storage is 100% secure. In the event of a data breach affecting your information, we will notify you in accordance with applicable law.

7. Data Retention

Client Data:

• Other project and communication records: Retained for the duration of our engagement plus 12 months
• Business details supplied at client intake: Retained for 24 months after service ends to restore the site or re-issue the site package, as described in Section 16 of our Terms of Service. You may request deletion, subject to legal retention obligations.
• Financial and billing records: 7 years, as required for tax and legal compliance
• Website assets: Retained while your website is live with us, and archived for 24 months after your service ends, so we can restore your site if you return and so we can re-issue your package if you ask for it later. When you cancel we send you a copy of the site at no charge; when your service ends we send the completed package, also at no charge, and will re-send it on request within that 24-month window.

Visitor and Lead Data:

• Contact and lead form submissions: Retained for up to 24 months, or until you request deletion
• Cookies: Essential session cookies expire when you close your browser

You may request deletion of your personal data at any time, subject to our legal retention obligations.

8. Cookies and Tracking Technologies

xomer.ai uses the following types of cookies:

• Essential Cookies: Required for basic website functionality
• No Analytics, Advertising, or Tracking Cookies: We do not use Google Analytics, advertising pixels, session replay, or any other third-party tracking technology on xomer.ai

You can control or disable cookies through your browser settings at any time. Doing so will not affect your ability to use this website.

9. Your Data Rights and Choices

All Users:

• Access: Request a copy of the personal information we hold about you
• Correction: Ask us to correct inaccurate information
• Deletion: Request removal of your personal data, subject to legal retention requirements
• Opt-Out: Unsubscribe from marketing emails at any time by replying "no thanks" (or any reply asking us to stop) to any of our emails, or by contacting us

California Residents (CCPA/CPRA):

• Right to know what personal information is collected and how it is used
• Right to opt out of sale (we do not sell personal information)
• Right to delete personal information
• Right to correct inaccurate personal information we hold about you
• Right to limit the use and disclosure of sensitive personal information (we do not collect or use sensitive personal information for purposes that trigger this right)
• Right to non-discrimination for exercising your privacy rights

EU/UK Residents (GDPR/UK GDPR):

• Rights to access, rectification, erasure, restriction, and portability of your personal data
• Right to object to processing based on legitimate interests
• Right to withdraw consent where processing is consent-based

We acknowledge every rights request within 10 business days and complete it within 45 calendar days, or sooner where a shorter statutory deadline applies, including the one-month period under UK and EU GDPR. Where the law allows an extension and we need more time, we will tell you before that deadline passes and explain why. Submit a request at https://www.xomer.ai/privacy-request/.

10. Third-Party Links and Services

Our website and the websites we build may contain links to third-party websites, and a client website may include third-party services that the client has selected and directed us to add. We are not responsible for the privacy practices of those third parties or for a client's use of a third-party service on the client's own site.

Google Business Profile management is performed using your Google account credentials at your direction. We access only the data necessary to fulfill the specific services you have requested.

11. Children's Privacy

Our services are not directed at children under the age of 13. We do not knowingly collect personal information from children. If we discover we have inadvertently collected information from a child under 13, we will delete it promptly.

12. International Data Transfers

Reboot Inc is based in Las Vegas, Nevada, USA. Your data may be processed in the United States or in other countries where our service providers (such as Cloudflare and Google) operate. We ensure that appropriate safeguards are in place for any international data transfers.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised effective date. For material changes, we will notify active clients by email at least 14 days before the change takes effect.

14. Contact Us

For data deletion requests, privacy rights inquiries, or security concerns, please include the words "Privacy Request" in your message so we can route it correctly.