Privacy Policy

Last updated: 22 October 2026

Xono provides software that organisations use to receive and investigate reports of wrongdoing — often from people who would face real consequences if their identity became known. This policy explains what we do with personal information, and, just as importantly, which parts are our responsibility and which belong to the organisation you work for.

WHICH ORGANISATION IS RESPONSIBLE FOR YOUR INFORMATION

This is the most important section, because the answer differs depending on why you are here.

If you have made a report, or you handle reports, through your employer’s Xono account — your employer is responsible for that information. They decide what is collected, why, how long it is kept, and who inside their organisation can see it. We act on their instructions and provide the software. In data-protection terms, they are the controller and we are the processor.

If you want to exercise your rights over that information, or you have a complaint about how it is being handled, contact your own organisation first — they hold the decisions. You can contact us too, and we will help, but for most requests we will need to direct you to them.

If you are visiting our website, contacting us, or signing up as a customer — we are responsible. That is ordinary business information and this policy governs it directly.

WHAT INFORMATION IS INVOLVED

Through your employer’s Xono account:

Reports and the conversations about them — what was reported, any messages exchanged, files attached, and the record of how the case was handled.
Reporter details, which depend on the setting your organisation has chosen — see the next section.
Case-handler accounts — the names, email addresses and sign-in records of your organisation’s own staff who investigate reports.
Records of who did what — an audit trail showing actions taken on a case, which exists so that an investigation can be shown to have been handled properly.
Other things you use in the app — your answers to surveys and votes, questions you ask the Company Assistant (which answers questions about your organisation’s policies), and voice messages, which are converted to text so they can be read and translated.
Account and device details — where your organisation uses named accounts: your name, email address, and the identifiers your phone needs to receive notifications. An anonymous report carries none of these.

Directly by us: the details you give us when you get in touch or become a customer — name, email address, phone number, organisation, and billing details. When you sign up, we also record how you reached us — any campaign tags in the link you followed and the web page that referred you — so we can tell which of our own efforts bring people to Xono. This is recorded on our own servers from the request itself; nothing is stored on your device for it.

When you contact us through our website, the details you enter go to our own systems and to our business mailbox, so we can reply. Our website analytics are self-hosted: they use your IP address briefly, in memory, to count visits and estimate which country they come from, and do not store it against you.

ANONYMITY, AND WHAT IT ACTUALLY MEANS HERE

Your organisation chooses one of three settings, and it determines what we hold about you:

Anonymous — no link is created between a report and any account. We do not know who you are, and no one can look it up later.
You choose — you decide, per report, whether to identify yourself.
Identifiable — reports carry the reporter’s identity.

If you are unsure which applies to you, ask your organisation, or check what the app tells you before you submit.

Making an anonymous report and still being able to follow it up. When you report anonymously, you are given a one-time credential so you can check back and exchange messages without ever identifying yourself. We store only a scrambled form of it, never the credential itself, and it is shown to you exactly once. We cannot recover it for you — if it is lost, we have no way to reconnect you to that report. That is the necessary consequence of not knowing who you are.

Our servers’ own access records. Like any website, our servers keep standard access records — including network (IP) addresses — for a limited period, to protect a service that accepts anonymous submissions from abuse. We do not use them to identify people who report.

COOKIES

Our website and dashboard set no cookies requiring your consent. We checked this directly rather than assuming it. Signing in uses your browser’s local storage rather than a session cookie, and our website analytics are self-hosted and record nothing on your device — which is why you will not see a cookie banner. When you sign up, the note above about recording how you reached us works the same way: it is read from the request on our own servers, not saved on your device, so it does not change this.

One page is different, and we would rather say so than let you find it. The sign-up page runs a bot check from Cloudflare, to stop automated abuse creating accounts. To do that, your IP address and some basic details about your browser reach Cloudflare, and Cloudflare may store something on your device for the check itself. It runs only on that one page, it is not analytics, and it is not used to track you anywhere else. We treat it as strictly necessary to offer sign-up safely, which is the category that does not require a consent banner.

Help videos are delivered by Amazon Web Services. When you play an explainer video in the dashboard’s help panel, it is streamed from AWS CloudFront, so your IP address and basic browser details reach AWS to deliver it. Nothing is stored on your device, it is not analytics, and it happens only when you choose to play a video.

A few things on our website load only if you click them. Our Trustpilot reviews, our product video (from YouTube, in its privacy-enhanced mode) and our What is Xono? video (from AWS CloudFront) are not loaded unless you choose to open or play them. If you do, that company receives your IP address; Trustpilot and YouTube may also set their own cookies, under their own policies. Our cookie policy has the detail.

WHAT THE MOBILE APP STORES ON YOUR DEVICE

The app keeps some information on your own phone, and one part of that is worth explaining because it exists specifically to protect you.

When you make an anonymous report, the app saves the reference for that report on your device. That is how you can come back and check on it later without us ever holding a record connecting you to it. If we kept that link on our servers instead, we would know who made which report — which is precisely what we are trying to avoid.

Your phone’s own backup may include it, and that is worth knowing. If you use Google or Apple device backup, the reference is backed up with the rest of the app’s data to your own cloud account. It does not come to us, and it does not go to your employer — the point above still holds, because we never hold the link at all. It does mean the reference can survive you replacing your phone, which is usually helpful given we cannot recover it for you. If you would rather it existed nowhere but the handset, turn off backup for this app in your phone’s settings.

The app also stores your sign-in state, your messages, and your preferences locally, so that it works and so conversations load without being re-fetched each time.

None of this requires your consent, because it is necessary for the app to do what you asked it to do. We describe it here because you should know what is held on your device, not because permission is needed.

Deleting the app deletes what it has stored locally. If you made anonymous reports, this includes the only copy of the references to them — we cannot recover those for you afterwards, for the same reason described above.

WHY WE ARE ALLOWED TO PROCESS THIS INFORMATION

For reports and case data, the lawful basis is your organisation’s, not ours — typically their legal obligations under whistleblowing law, or their legitimate interest in investigating misconduct. We process it under our contract with them.

For our own business contacts, we rely on our legitimate interest in operating and providing the service — which includes understanding how customers found us, so we can measure which of our own efforts work.

Our website analytics and our servers’ access records rely on our legitimate interest in keeping our website and service useful and secure.

YOUR RIGHTS, AND ONE LIMIT WE WANT TO BE STRAIGHTFORWARD ABOUT

You have the usual rights over your personal information: to see it, correct it, ask for its deletion, object to how it is used, and receive a copy. For anything held through your employer’s account, those requests go to them.

Closing your account does not delete reports you have made, and this is deliberate.

We want to explain this rather than bury it. A report, once made, becomes part of your organisation’s own records — they may be legally required to retain it, an investigation may still be running, and the audit trail proving a case was handled properly has to remain intact. If a report vanished whenever a reporter closed their account, the record could be erased by pressure on the reporter, which is the opposite of what a whistleblowing system is for.

So closing your account removes the account. Reports remain with your organisation as their records, subject to their retention policy.

If you reported anonymously, there was never a link between you and the report to remove.

Backups. When information is deleted from our live systems, our encrypted backups are not edited one record at a time. Those copies are kept out of use and expire on our backup cycle, which can take up to about 18 months, and if we ever restore from a backup we re-apply deletions before the restored system is used.

WHO ELSE IS INVOLVED

We use a small number of service providers to run the platform — for hosting, sending email, storing files and backups, delivering notifications and help videos, checking sign-ups for bots, and processing payments. A current list of them, what each does and where they operate is available on request — see the contact details below.

Desktop notifications. If you turn on browser notifications in the dashboard, they are delivered by your browser’s own push service, run by the company that makes your browser (such as Google, Mozilla, Apple or Microsoft). The notification content is encrypted so that the push service cannot read it.

If your organisation connects the Company Assistant to a workplace chat tool it uses (currently Google Chat — see below), the company that runs that tool also carries those messages. This happens only for organisations that have connected it.

For our own business — answering enquiries and selling Xono — we use a business email and office service (Google Workspace) and SendGrid to send email, and we may use an AI service from Anthropic, in the United States, to help sort enquiries, draft replies and research organisations we are in contact with. Some earlier website enquiries are held in a mailing-list service, Mailchimp, in the United States. None of these receive report content.

WHERE YOUR INFORMATION IS HELD

For most organisations, our systems run in Germany, with encrypted file storage and backups in the United Kingdom and Ireland.

If your organisation is in South Africa, its contract is with Xono’s South African company, which provides the service there and acts as your organisation’s operator under South African data protection law. Its information is hosted in South Africa (Cape Town), including files and backups. The platform’s AI features for South African organisations run on AI systems that Xono Limited operates in Germany: the content is sent there over an encrypted connection, processed in memory and not stored there. You can reach both companies through the contact details below.

Some of our service providers operate in other countries — email delivery, for example, is processed in the United States, and notification and bot-check services run globally. Where the law requires a specific safeguard for a transfer, we rely on the standard mechanisms available, such as standard contractual clauses and the arrangements our service providers maintain.

HOW WE PROTECT IT

Report content is encrypted with a separate key for each customer organisation, and the platform’s AI features run on infrastructure we operate ourselves rather than being sent to an external AI provider. The AI only makes suggestions, such as a possible category for a report; a person decides, and no decision with a legal or similarly significant effect on you is made automatically.

If your organisation turns on the optional Company Assistant, which answers questions about its policies, it can also be used inside a workplace chat tool your organisation chooses to connect (currently Google Chat). It works only for people in the email domain your organisation has registered with us. Used that way, your messages and the assistant’s replies travel through the chat provider’s systems to reach us, along with your account email address and display name, as with any chat message. The assistant’s AI still runs only on our own infrastructure, not the chat provider’s. Reports of wrongdoing are not made through this channel: the assistant directs anything about a named person into your organisation’s reporting process instead. Where your organisation allows it, the assistant can also be used to record a workplace incident — a short description and who should be told — which becomes a case in your organisation’s account. Conversation context is kept only briefly and expires automatically within hours.

CONTACT AND COMPLAINTS

Xono Limited is the company behind this service — registered in the Isle of Man, company number 134387C, registered office 96 Fairways Drive, Mount Murray, Santon, IM4 2JF. We are registered with the Isle of Man Information Commissioner under Data Controller Reference IC513032I. For any privacy question, including requests about information we hold directly:

Information Officer: Marc de Villiers
Email: marc@xono.online
Phone: +27 76 603 8577
Post: G3 Highbury, 353 Main Road, Cape Town, 7708

If you are unhappy with our response, you can complain to your local data protection authority — in South Africa, the Information Regulator; in the UK, the Information Commissioner’s Office; in the EU, your national supervisory authority.