Last updated: 1 October 2026.
This policy explains what personal data The Xplorion (“we”, “us”, “our”) collects from you, why we collect it, how we use and store it, and what rights you have over it. It applies to every page on thexplorion.com and to every service we provide. We write this document in plain English on purpose.
1. Who we are
The Xplorion is published by Krafty Sprouts Media, LLC, a limited-liability company registered in Delaware, United States, with its editorial office at 19 West 34th Street, New York, NY 10001. For GDPR, UK GDPR, LGPD and CCPA purposes we act as the data controller/business/operator. You can reach our Data Protection Officer at [email protected].
2. What data we collect
2.1 Data you give us
- Name and email when you subscribe, create an account or contact us
- Billing/shipping address when you purchase a service
- Content of messages, comments and reviews you submit
- Payment information — processed by Stripe and PayPal; we never see your card number
- Any info you add to a public profile (bio, photo, social handles)
2.2 Data we collect automatically
- IP address and approximate city-level location
- Browser, device, operating system and language preferences
- Pages visited, time on page, referrer
- Interaction events — scrolls, clicks, form submissions, read time
- Error and performance telemetry
- Cookie identifiers and consent choices
2.3 Data from third parties
- Google/Facebook login — email and public profile
- Google Analytics 4 and Plausible — aggregated behavioural data
- Google AdSense — ad-serving data (only after consent)
- Abuse reports from third parties regarding your content
3. Legal bases for processing
- Contract — to deliver services you have paid for
- Consent — for marketing emails, non-essential cookies, targeted advertising
- Legitimate interest — site security, fraud prevention, aggregate analytics
- Legal obligation — tax records, DMCA responses, law-enforcement requests
4. How long we keep it
| Data type | Retention |
|---|---|
| Newsletter subscription | Until unsubscribe + 30 days |
| Contact form message | 24 months |
| Purchase and invoice records | 7 years (tax law) |
| Server access logs | 90 days |
| Analytics data | 14 months (GA4 default) |
| Cookie preferences | 12 months |
| Support correspondence | 3 years |
| Article comments | Lifetime of article |
5. Who we share it with
We never sell your personal data. We share limited data with service providers under contract and only for the purposes we specify:
- Hosting: Pressable (US)
- Email delivery: ConvertKit (US)
- Payments: Stripe and PayPal (US)
- Analytics: Google LLC (US), Plausible Insights OÜ (EE)
- Advertising: Google AdSense (only after consent)
- CDN & security: Cloudflare (US)
- Error tracking: Sentry (US)
- Customer support: Intercom (US)
Where data leaves the EEA or UK, we use Standard Contractual Clauses as the adequacy mechanism and we assess recipient countries under the Schrems II framework.
6. Your rights
- Access — ask for a copy of the data we hold
- Rectification — have incorrect data corrected
- Erasure — ask us to delete your data (right to be forgotten)
- Restriction — pause processing during a dispute
- Portability — receive your data as JSON or CSV
- Objection — object to legitimate-interest processing
- Withdraw consent — any time, without penalty
- Complaint — lodge one with your national DPA
- Automated decisions — not subject to purely automated decision-making (we don’t do that)
Email [email protected]. We reply within 30 days (45 for complex requests). No charge for standard access requests.
7. California (CCPA/CPRA)
California residents have the right to know what personal information we collect, to delete it, to correct inaccuracies, to opt out of sale/sharing, to limit use of sensitive personal information, and to non-discrimination for exercising these rights. We do not sell personal information. Contact [email protected].
8. Children
The Xplorion is a general-audience website. We do not knowingly collect personal information from children under 13 in the US (under 16 in the EEA). If you believe a child has provided us with personal information, email us and we will delete it within 72 hours and purge backups within 30 days.
9. Security
We encrypt data in transit using TLS 1.3, store it in ISO 27001 / SOC 2 Type II certified cloud infrastructure, and limit internal access on a need-to-know basis with mandatory two-factor authentication. We rotate administrative credentials every 90 days. We will notify you and the relevant authorities within 72 hours of any breach affecting your personal data.
10. International transfers
Our servers and most service providers are in the United States. If you visit from outside the US, your data is transferred to and stored in the US. We rely on the EU–U.S. Data Privacy Framework (where applicable) and on Standard Contractual Clauses with supplementary measures for all other transfers.
11. Changes to this policy
Updates are posted here with a new “last updated” date. Material changes are also announced to newsletter subscribers at least 30 days before taking effect.
12. Contact
Data Protection Officer, Krafty Sprouts Media LLC, 19 West 34th Street, New York, NY 10001, United States. Email: [email protected]