Privacy & security
This page describes what Xaldro stores and how access works. The legal text is the Privacy Policy; see also the Data Processing Agreement.
What Xaldro can do in Webflow
Xaldro asks Webflow for three read permissions: authorized_user:read (who installed it), sites:read (the sites you shared) and ecommerce:read (your shop's default currency and its orders). It has no write, custom code or workspace permission. The only thing it creates in Webflow is its own two order webhooks per connected site. See Getting started.
What Xaldro stores
From each order:
- order ID, status and placed date;
- totals: subtotal, tax, shipping, discount and total, and the currency;
- customer name and email, and the customer's country and region (used to pick a tax code);
- line items: product name, SKU, quantity, unit price and tax;
- a reduced copy of Webflow's order record: order ID, status, accepted and refunded dates, amount paid, totals and purchased items. No shipping or billing address is stored.
Also: your account email and plan, your sites and mappings, the IDs of what Xaldro posted in your ledger, your team, and an activity log of account changes with the IP address and browser of whoever made them.
Tokens
Webflow, Xero and QuickBooks access tokens are encrypted with AES-256-GCM and kept on Xaldro's server. They are never sent to your browser and are not included in a data export. When Webflow reports a token revoked, Xaldro forgets it at once, and every stored Webflow token is also checked daily.
Where it runs, and who else handles data
Xaldro is hosted in the EU by Hetzner. These companies handle data as Xaldro uses them:
| Company | What for |
|---|---|
| Webflow | Source of your sites and orders |
| Xero, Intuit | The ledger you choose to post to |
| Stripe | Billing; payments are taken on Stripe's own checkout pages, and Xaldro stores the Stripe customer and subscription IDs, not card details |
| Resend | Transactional email, including the daily summary, which contains customer names |
| Hetzner | EU hosting |
| Cloudflare | DNS |
| Storage of encrypted backups only; Google holds encrypted data it cannot read |
Signing in
- Connect Webflow installs Xaldro and signs the owner in.
- Sign in with email sends a one-time link that works for 30 minutes and only once. Links are stored hashed.
- Team invites are emailed and work for 7 days. A sign-in or invite link is never shown on screen.
Sessions
Your session is a signed, httpOnly cookie that lasts up to 30 days. It is checked against the database on every request, so Sign out ends it on every device, and removing a member or deleting the account ends their sessions at once.
Team roles
Members do the day-to-day work; only the owner handles billing, the team, connecting Xero and QuickBooks, removing a site, exporting data and deleting the account. See Team & permissions.
Export and deletion
The owner can download everything Xaldro holds for the account with Account → Export your data (a JSON file, without tokens) and delete it with Account → Delete account. See Uninstalling & your data for what is deleted and when, and how long backups are kept.
Questions
Write to support@xaldro.com or use the form at https://xaldro.com/support. We reply within one business day (Monday to Friday, CET).