Privacy Policy

Last updated: 6 October 2026

Xendl Software Limited (“Xendl”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what information we collect when you use our website, how and why we use it, who we may share it with, and the rights you have in relation to your personal information.

1. Who we are

This website is operated by Xendl Software Limited.

Registered address:
107 Fleet Street
London
EC4A 2AB
United Kingdom

For questions about this Privacy Policy, how we use your personal information, or to exercise your data-protection rights, please contact:

Email: info@xendl.com

2. Information we collect

Depending on how you use our website, we may collect or process:

information you provide when contacting us;
information you enter into the GRCMATE AI assistant;
technical information such as your IP address, browser type and device information;
information about how you use and navigate our website; and
cookie and consent preferences.

We do not seek to collect more personal information than is reasonably necessary to operate the website, respond to enquiries, understand website usage and provide our services.

3. How and why we use your information

We may process personal information in order to:

operate, maintain and secure our website;
respond to enquiries and communications;
provide and operate the GRCMATE AI assistant;
understand how our website is used and improve its performance;
improve the quality and usefulness of GRCMATE’s responses;
prevent misuse, fraud or security threats; and
comply with our legal and regulatory obligations.

Under UK data-protection law, we must have a lawful basis for processing personal information. Depending on the circumstances, we may rely on your consent, our legitimate interests, the need to take steps in connection with a contract, or compliance with a legal obligation.

Where processing is based on consent, you may withdraw that consent at any time.

4. GRCMATE AI assistant

Our website includes GRCMATE, an AI-powered assistant provided by GRCmate and hosted using Google Cloud services.

When you use GRCMATE, we process:

the messages you enter;
the assistant’s responses;
the date and time of the conversation; and
the website on which the assistant was used.

When a page containing GRCMATE loads, a random conversation identifier is created so that messages from the same visit can be grouped together. This identifier exists only in the page’s memory and is not stored on your device.

GRCMATE does not ask you to provide your name, email address or other personal details. However, if you choose to include personal information in a message, that information will form part of the stored conversation.

Please avoid entering sensitive or unnecessary personal information into the chatbot.

The chatbot itself does not set cookies and does not use local storage, session storage, advertising trackers or analytics tracking.

Technical information

GRCMATE is hosted using Google Cloud. When a page containing the chatbot loads, Google Cloud receives technical information associated with that request, which may include:

your IP address;
browser type;
the website address; and
the date and time of the request.

Your IP address may also be used temporarily in server memory to limit the number of messages that can be sent within a given period and help protect the service from misuse.

5. How GRCMATE information is stored and used

GRCMATE conversations are stored using Google Cloud BigQuery in London.

Conversations are automatically deleted 12 months after they take place. Google’s deletion processes and backups may mean that complete removal takes a few additional weeks.

Xendl and GRCmate may review stored conversations to check and improve the quality and accuracy of the assistant’s responses.

Conversations are not used for advertising or profiling and are not used by Xendl, GRCmate or Google to train AI models.

Google may temporarily retain message content in memory for up to 24 hours to improve response speed. If Google’s automated systems identify a message as possible misuse, relevant content may be retained for up to 90 days for review.

Technical request logs generated by Google Cloud are retained for 30 days.

6. Analytics

We use website analytics to understand how visitors use the Xendl website and to help us improve its content, performance and usability.

This may include information such as:

pages visited;
approximate session and traffic information;
device and browser information;
interactions with website features; and
how visitors arrived at the website.

We use Google Analytics 4 (GA4) for website analytics.

Where required, analytics technologies are only activated after you have provided the appropriate consent through our cookie consent controls.

We may also record interactions with website features, such as when a visitor opens GRCMATE. These analytics events do not include the contents of chatbot conversations.

7. Cookies and similar technologies

Our website uses cookies and similar technologies where necessary to operate the website and, with your consent where required, to understand how it is used.

Cookies may include:

Functional cookies
These are necessary for the website to function correctly and cannot be switched off where they are essential to providing the website or a service you have requested.

Statistics cookies
These help us understand how visitors use the website so that we can measure and improve its performance.

You can choose which optional technologies you allow using the cookie consent controls displayed on the website. You can also change or withdraw your consent at any time using the cookie settings available on the website.

GRCMATE itself does not set cookies or store identifiers on your device.

8. Who we share information with

We may use trusted service providers to operate our website and provide related services.

These include, where applicable:

GRCmate
Provides and operates the GRCMATE AI assistant for Xendl and may access stored conversations for the purposes described in this policy.

Google
Provides Google Cloud infrastructure, BigQuery storage and the Gemini AI model used to generate GRCMATE responses. We also use Google Analytics to understand website usage.

Service providers processing personal information on our behalf are expected to handle that information appropriately and in accordance with applicable data-protection requirements.

We do not sell personal information to third parties.

9. International data transfers

GRCMATE conversations are stored in Google’s London region, and the AI model is configured to run in Google’s London region.

Google’s logging services may process or store technical request-log information outside the UK. Where personal information is transferred internationally, appropriate safeguards are used in accordance with applicable data-protection requirements.

Other services used by the website, including analytics services, may also involve processing in countries outside the UK. Where required, appropriate safeguards are used to protect personal information transferred internationally.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including any legal, regulatory, security or operational requirements.

Specific retention periods relating to GRCMATE are:

Chat conversations: 12 months;
Google Cloud request logs: 30 days;
Temporary message caching: up to 24 hours; and
Content flagged by Google’s automated systems for possible misuse: up to 90 days.

Deletion and backup processes may result in information remaining in backups for a limited additional period.

Retention periods for other information may vary according to the nature and purpose of the information.

11. Requesting deletion of a GRCMATE conversation

You can request deletion of a GRCMATE conversation by emailing info@xendl.com.

Because GRCMATE does not normally know your identity, please provide:

the approximate date and time of your conversation; and
a few words from the messages you entered.

This allows the relevant conversation to be identified without the chatbot needing to collect identifying information in advance.

Once the conversation has been identified, it can be deleted and the deletion confirmed. Associated Google backups are cleared within a further 14 days.

Individual Google Cloud request logs cannot be deleted separately, but are automatically deleted after 30 days.

12. Your data-protection rights

Depending on the circumstances, UK data-protection law may give you rights including the right to:

ask for access to the personal information we hold about you;
ask us to correct inaccurate or incomplete information;
ask us to delete your personal information;
ask us to restrict how we use your information;
object to certain uses of your personal information;
receive certain information in a portable format; and
withdraw consent where we rely on consent to process your information.

These rights are not absolute and may depend on the circumstances and our lawful basis for processing the information.

To exercise any of these rights, contact us at info@xendl.com.

You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.

13. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no website or internet-based service can guarantee complete security. You should take appropriate care when deciding what information to provide online, particularly when using the GRCMATE assistant.

14. Third-party websites

Our website may contain links to websites operated by third parties.

We are not responsible for the privacy practices or content of third-party websites. We recommend reviewing the privacy information provided by those organisations when visiting their websites.