Privacy Policy

We, at Appfluent, Inc. and our affiliated companies (collectively, "Appfluent", "we", "us" or "our"), put great efforts in making sure that we secure Personal Data related to you and use it properly.

We provide products and services including the XWidget software development kit ("XWidget SDK"), the XWidget Cloud platform for server-driven UI delivery and analytics ("XWidget Cloud"), and related tools, APIs, and command-line interfaces (collectively, the "Services"). We also operate websites at www.appfluent.us and xwidget.dev (collectively, the "Websites").

This Privacy Policy ("Policy") explains our privacy practices for processing Personal Data related to you when you use the Services, the Websites, or any of our affiliates' websites. The term "Personal Data" refers to information that identifies an individual or relates to an identifiable individual. For example, Personal Data is your name, email address, telephone number, and other contact details which you submit to us or that we collect from your device or application.

This Policy applies to visitors of the Websites, to developers and organizations who have signed up and/or contracted with us to access and use any of our Services ("Customers"), and to end users of applications built by our Customers that incorporate the XWidget SDK or XWidget Cloud ("End Users"). Please take the time to read our full Policy. If you do not agree to this Privacy Policy, please do not access or otherwise use our Websites and Services.

Personal Data You Provide Us

We receive and store any information you enter on our Websites or give us in any other way. If you register with any of the Services, we will collect your name, your company or organization name, and your email address. Read more below.

Personal Data That We Collect

We automatically log traffic and session information including IP addresses and user agent. We collect session durations and additional activity information. Read more below.

XWidget Cloud Analytics Data

When Customers use XWidget Cloud, the SDK may collect analytics data from End Users including render events, navigation events, platform information, and general location data. We process this data on behalf of our Customers. Read more below.

What Do We Do with Personal Data?

We maintain the Services, make them better and continue developing them, and protect us and the Services from misuse and law violations. Read more below.

Who Do We Share Personal Data With?

We use service providers, for example, to send email messages and to store data. We will transfer information when we change our corporate structure, and we will share the information with our affiliate entities. Read more below.

Disclosure of Personal Data to Authorities

We will obey orders and other lawful requirements by authorities to disclose information. Read more below.

Aggregated and Analytical Information

Aggregated data is not identifiable. We use it for legitimate business purposes and for standard analytical tools. Read more below.

Your Choices

You may opt-out of our mailing lists and terminate your use of the Services. Our Services do not respond to Do Not Track (DNT) signals. Read more below.

Your EU Data Subject Rights

If we process Personal Data related to you when you are in the EU, further terms apply to our processing in relation to your rights as a data subject under EU data protection laws. Read more below.

Specific Provisions for California Residents

If you reside in the State of California, further terms apply to our processing in relation to your rights as a data subject under the California Privacy Rights Act (CPRA). Read more below.

Personal Data Retention

We retain Personal Data to provide the Services and for legitimate and lawful purposes, as further explained in the data retention section of this Policy. Read more below.

Transfer of Data Outside Your Territory

We store and process Personal Data related to you in the United States. Content delivery may occur through globally distributed infrastructure provided by our service providers. Read more below.

Cookies

We use cookies to make it easier for you to log in and to facilitate Service activities. Read more below.

Information Security

We implement systems, applications, and procedures to secure Personal Data related to you, to minimize the risks of theft, damage, loss of information, or unauthorized access or use of information. Read more below.

Dispute Resolution

Contact us at: privacy@appfluent.us or write us for every request and complaint. We will make good-faith efforts to resolve any existing or potential dispute with you. Read more below.

Changes to this Privacy Policy

We will update our Policy from time to time after giving proper notice. Read more below.

Incorporation to the Terms of Use

This Policy is an integral part of Appfluent's Terms of Use or, if applicable, of any other Service subscription agreement entered into between you (or the entity that you are acting on its behalf) and us. Read more below.

Contact Us

Please contact us at: privacy@appfluent.us for further information.

Personal Data That You Provide Us

We receive and store any information you enter on our Websites or give us in any other way. For example, when you contact us via the Websites, we receive any information you provide us.

When you register for an XWidget Cloud account, we collect your name, email address, and organization name. We use this information to create and manage your account, provide the Services, and communicate with you about your account and the Services.

When you contact us to apply for a job with us, you provide us with Personal Data related to you, which we process for recruitment and general HR purposes.

Personal Data That We Collect

Like many websites, we use "cookies" (for further information about cookies, please see our Cookies and Similar Tracking Technologies Policy), and we obtain information when your browser accesses our Websites.

When you use the Services, we also receive information about your activity from third-party analytics services. For more information, please see the "Aggregated and Analytical Information" section of this Policy.

Examples of such information we collect and analyze include the Internet Protocol (IP) address used to connect your access device to the Internet; login; email address; password; access device and connection information such as browser type, version, and time zone setting, browser plug-in types and versions, operating system, and platform.

XWidget Cloud Analytics Data

When our Customers integrate the XWidget SDK or XWidget Cloud into their applications, the SDK may collect analytics data from End Users on the Customer's behalf. In this context, the Customer is the data controller and Appfluent acts as a data processor, processing End User data solely to provide the Services to the Customer.

The analytics data collected by the XWidget SDK may include:

The XWidget SDK does not collect names, email addresses, phone numbers, device identifiers, advertising identifiers, precise geolocation, or any other directly identifying Personal Data from End Users. Session identifiers are randomly generated and cannot be used to identify individual users.

Customers are solely responsible for ensuring that their use of the XWidget SDK and XWidget Cloud complies with all applicable data protection and privacy laws, including providing appropriate notice to, and obtaining any necessary consent from, their End Users.

Children's Privacy

The Services are not directed to children under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect Personal Data from children. If our Customers build applications directed at children using the XWidget SDK, they are responsible for compliance with the Children's Online Privacy Protection Act (COPPA) and other applicable laws governing the collection of data from children.

If you believe that we have inadvertently collected Personal Data from a child, please contact us at privacy@appfluent.us so that we can promptly delete the information.

What Do We Do With Personal Data?

We use Personal Data related to you for the following purposes:

We obey the law and expect you to do the same. If necessary, we will use Personal Data related to you to enforce our terms, policies, and legal agreements, to comply with court orders and warrants, and assist law enforcement agencies, to collect debts, prevent fraud, misappropriation, infringements, identity thefts and any other misuse of the Services, and to take any action in any legal dispute and proceeding.

We commit to process Personal Data related to you solely for the purposes described in this Policy.

Who Do We Share Personal Data With?

We do not sell, rent, or lease Personal Data related to you.

Personal Data related to you is shared with certain employees, as well as external consultants and with our affiliates, who are all governed by this Privacy Policy.

We also share Personal Data related to you with our vendors worldwide and with third-party service providers which process Personal Data related to you on our behalf. Such vendors and service providers are contractually bound to keep Personal Data related to you confidential and appropriately secure.

A merger, acquisition or any other structural change will require us to transfer Personal Data related to you to another entity, as part of the structural change, provided that the receiving entity will comply with this Policy.

We will share Personal Data related to you only subject to the terms of this Policy, or subject to your prior consent.

Sub-Processors

We use the following categories of third-party service providers (sub-processors) to process data on our behalf in connection with the Services:

We may update this list from time to time as we engage or change service providers. We will make reasonable efforts to keep this list current.

Disclosure of Personal Data to Authorities

We will need to disclose Personal Data related to you in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Aggregated and Analytical Information

We use standard analytics tools. The privacy practices of these tools are subject to their own privacy policies, and they use their own cookies to provide their service (for further information about cookies, please see our Cookies and Similar Tracking Technologies Policy).

We use the standard analytics tools of Google Analytics, and we may use additional or other analytics tools, from time to time, to learn about how you and other users use the Services, in support of our Service-related activities and operations. See Google's Privacy Policy for more information.

We may use anonymous, statistical, or aggregated information and may share it with our partners for legitimate business purposes. It has no effect on your privacy, because there is no reasonable way to extract data from the aggregated information that we or others can associate specifically to you.

XWidget Cloud analytics data is aggregated and presented to Customers in dashboard form. We may use aggregated and anonymized analytics data across all Customers to improve the Services, identify usage trends, and develop new features. Such aggregated data cannot be used to identify any individual End User or Customer.

Your Choices

We will give you choices about the ways we use and share Personal Data related to you, and we will respect the choices you make.

We may send newsletters or promotional communications to our users. To unsubscribe from these communications, you will be required to click an "Unsubscribe" link in these emails and confirm the email address for which you would like to unsubscribe.

We collect and receive Personal Data related to you that we need for the purposes described in this Policy. You can stop using the Services at any time, thereafter we will stop collecting Personal Data related to you. However, we will store and continue to use or make available certain Personal Data related to you as detailed above.

You may request that your account be terminated, and that Personal Data related to you be deleted by contacting us. Any termination of your account will involve deletion of your account information from our live databases and all the information and data stored for such account in the Services.

You may request a copy of the Personal Data related to you that we store about you by contacting us. You may also request that Appfluent transfer Personal Data related to you or provide you with copies of such Personal Data to enable its transfer to a third party.

When we delete Personal Data related to you that we have collected from or about you, it will be deleted from our active databases, but we will keep a reasonable number of copies in our archives. Although we will deactivate your account, we will continue to retain the Personal Data related to you for legitimate business purposes as set forth above.

Web browsers offer a "Do Not Track" ("DNT") signal. A DNT signal is a HTTP header field indicating your preference for tracking your activities on a service or through cross-site user tracking. Our Websites and Services do not respond to DNT signals.

If you wish to exercise any of your rights in relation to Personal Data related to you, including exercising your choices or opt-out rights, please email us at privacy@appfluent.us.

Your EU Data Subject Rights

If EU data protection laws apply to the processing of the Personal Data related to you by Appfluent, then the following terms apply:

Where we process Personal Data related to you when you visit our Websites as a data controller, the processing is based on the following lawful grounds:

Where we process End User data through XWidget Cloud on behalf of our Customers, we act as a data processor. The Customer, as data controller, is responsible for establishing the lawful basis for such processing and for responding to data subject requests from their End Users. We will assist Customers in fulfilling their obligations to the extent required by applicable law.

In addition to your rights under other sections in this Policy, you have the following rights:

A summary and further details about your rights under EU data protection laws is available on the EU Commission's website.

Note that when you send us a request to exercise your rights, we will need to reasonably authenticate your identity and location. We will ask you to provide us credentials to make sure that you are who you claim to be and will further ask you questions to understand the nature and scope of your request.

If we need to delete Personal Data related to you following your request, it will take some time until we completely delete residual copies of Personal Data related to you from our active servers and from our backup systems.

If you have any concerns about the way we process Personal Data related to you, you are welcome to contact our privacy team at: privacy@appfluent.us. We will look into your inquiry and make good-faith efforts to respond promptly.

Specific Provisions for California Residents

This section applies solely to all visitors, users and others who reside in the State of California and other applicable US States. We adopted this section to comply with the California Privacy Rights Act (CPRA) and any terms defined in the CPRA have the same meaning when used in this section. This section supersedes any contradicting provisions under the other sections of this Policy.

We have collected the Personal Data related to you which is described above under the "Personal Data That We Collect" section of this Policy. Such information consists of the following categories:

We obtain the categories of Personal Data related to you listed above from the following categories of sources:

We use the Personal Data related to you that we collect or receive for the purposes mentioned under the "What Do We Do With Personal Data?" section of this Policy.

We disclose Personal Data related to you to third parties for business purposes as described above under the section titled "Who Do We Share Personal Data With?"

We do not sell Personal Data related to you.

The Services and Websites are not intended to collect Sensitive Personal Information (as defined under the CPRA). We do not knowingly collect Sensitive Personal Information, and we require that you not provide us with any such information.

Selling and Sharing Personal Information

We do not sell or share Personal Data. However, we engage third parties to provide us with services such as analytics and marketing automation and allow them to collect Personal Data on our Websites.

We do not knowingly sell or share the Personal Data of consumers who are under 16 years of age.

The categories of Personal Data collected by these third parties in the preceding 12 months include identifiers, online activities and inferences drawn from such activities.

These third parties do not pay us for collecting such information, but the right granted to them to collect Personal Data may be considered as disclosure for the purpose of sale or sharing for cross-context behavioral advertising. At any time, you can opt-out of the collection of Personal Data by our service providers by contacting us.

Your Rights as a California Resident

In addition to your rights under other sections under this Policy, if you are a resident of California or any other applicable US State, you are entitled also to the following specific rights under the CPRA or other applicable US state consumer privacy acts, regarding Personal Data related to you:

Exercising Your Rights

To exercise the access, data portability, and deletion rights described above, please submit your request to us by sending an email message to: privacy@appfluent.us. Only you or a person authorized to act on your behalf may make a request related to Personal Data related to you. A request for access can be made by you only twice within a 12-month period.

The verifiable consumer request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Data or an authorized representative and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with the requested Personal Data if we cannot verify your identity or authority to make the request and confirm the Personal Data related to you. We will only use the Personal Data provided in your request to verify your identity or authority to make the request.

We will do our best to respond to your request within 30 days of its receipt. If we require more time (up to an additional 30 days), we will inform you of the reason and extension period in writing. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will inform you of the reasons for such decision and provide you with a cost estimate before completing your request.

Personal Data Retention

We retain different types of Personal Data related to you for different periods, depending on the purposes for processing the information, our legitimate business purposes, and pursuant to legal requirements under applicable law.

We will maintain your contact details to help us stay in contact with you. At any time, you can contact our privacy team at: privacy@appfluent.us and request to delete your contact details. Note that we will keep your details without using them if necessary, and for the necessary period of time, for legal requirements and proceedings.

XWidget Cloud analytics data — render events, navigation events, and associated metadata are retained for the duration of the Customer's active subscription. Upon account termination, analytics data will be deleted within 90 days. Customers may request earlier deletion by contacting us. Aggregated and anonymized data derived from analytics may be retained indefinitely.

We will retain Personal Data related to you after you have terminated your use of the Services, if retention is reasonably necessary to resolve disputes between our users, to prevent fraud and abuse, or to enforce this Privacy Policy and our Terms of Use. We will keep aggregated non-identifiable information without limitation, and to the extent reasonable we will delete or de-identify potentially identifiable information when we no longer need to process the information.

In any case, we will keep information about you for as long as you use the Services, unless applicable law requires us to delete it, or if we decide to remove it at our discretion, according to the terms of this Policy and our Terms of Use.

Transfer of Data Outside Your Territory

We store and process information, including Personal Data, on infrastructure hosted in the United States. We use Cloudflare as a content delivery network, which operates a globally distributed edge network. While primary data storage and processing occurs in the United States, cached content may be served from Cloudflare edge locations worldwide. The laws of these territories may differ from the laws of the jurisdiction in which you live.

If you are a resident in a jurisdiction where transfer of Personal Data related to you to another jurisdiction requires your consent, then you provide us your express and unambiguous consent to such transfer.

If you are located in the European Economic Area (EEA), note that we will transfer Personal Data related to you to other jurisdictions which are not deemed to provide an adequate level of data protection. In such case, we will use appropriate safeguards, in particular, by way of entering into the European Union (EU) Standard Contractual Clauses as amended from time to time with the relevant recipients, or by adhering to equivalent data transfer regulations to protect the security and confidentiality of such Personal Data. You can obtain a copy of the suitable safeguards that we use when transferring Personal Data as described above or receive further information about data transfer by contacting us at: privacy@appfluent.us.

We make sure that our third-party service providers provide us with adequate confidentiality and security commitments and we will take all steps reasonably necessary to ensure that Personal Data related to you is treated securely and in accordance with this Privacy Policy.

Data Breach Notification

In the event of a data breach affecting Personal Data related to you, we will notify affected individuals and applicable regulatory authorities in accordance with the requirements of applicable law, including the GDPR's 72-hour notification requirement where applicable. We will provide information about the nature of the breach, the categories of data affected, and the measures taken to address the breach and mitigate its effects.

Cookies

We use cookies and similar tracking technologies to make sure that our Services are continuously improved and meet your needs. Please view our Cookies and Similar Tracking Technologies Policy for more information on our use of cookies.

Information Security

Appfluent is committed to ensuring the security of Personal Data. We and our hosting services implement systems, applications, and procedures to secure Personal Data related to you, to minimize the risks of theft, damage, loss of information, or unauthorized access or use of information. These measures provide sound industry standard security. In particular, data transmitted between End User applications and our servers is encrypted in transit using TLS, and access to analytics data is restricted to authorized Customers through project-level access controls.

However, please understand that no security system is impenetrable, and although we make efforts to protect your privacy we cannot guarantee that the Services will be immune from any wrongdoings, malfunctions, unlawful interceptions or access, or other kinds of abuse and misuse.

Dispute Resolution

We do periodical assessments of our data processing and privacy practices, to make sure that we comply with this Policy, to update the Policy when we believe that we need to, and to verify that we display the Policy properly and in an accessible manner. If you have any concerns about the way we process Personal Data related to you, you are welcome to contact our privacy team at: privacy@appfluent.us, or write to us.

We will look into your query and make good-faith efforts to resolve any existing or potential dispute with you.

Changes to this Privacy Policy

From time to time, we will update this Policy. If the updates have minor if any consequences, they will take effect 14 days after we post a notice on the Websites. Substantial changes will be effective 30 days after we initially posted the notice.

Until the new Policy takes effect, if it materially reduces the protection of your privacy right under the then-existing Policy you can choose not to accept it and terminate your use of the Services. Continuing to use the Services after the new Policy takes effect means that you agree to the new Policy. Note that if we need to adapt the Policy to legal requirements, the new Policy will become effective immediately or as required by law.

Incorporation to the Terms of Use

This Policy is an integral part of the Appfluent Terms of Use or, if applicable, of any other Service agreement entered into between you (or the entity that you are acting on its behalf) and us.

Contact Us

Please contact us at: privacy@appfluent.us

Last updated in April 2026.