Cookie Policy

This Cookie Policy explains how LeadCrowd Limited, trading as Xcho, uses cookies and similar technologies on the Xcho website and, where relevant, the Xcho account service.

1. Who we are

Xcho is operated by LeadCrowd Limited, company number 10963512, registered office The 1812 Building, Wheatley Park, Mirfield, England, WF14 8HE.

For cookie or privacy questions, email hello@xcho.ai and mark the message “Xcho privacy”.

2. What cookies and similar technologies are

Cookies are small files stored on a device when a website is used. Similar technologies can include local storage, pixels, tags, software development kits and other methods that store information on, or access information from, a browser or device.

A technology can fall within privacy or electronic-communications rules even if it does not use a traditional cookie.

3. How Xcho uses these technologies

Xcho uses or may use technologies for the following purposes.

Strictly necessary purposes. These support functions a visitor or account user requests, such as security, authentication, session management, fraud prevention, load management and recording cookie choices. Where the law permits these technologies to operate without consent because they are strictly necessary for the requested service, they are used only for that necessary purpose.

Preferences. These remember choices that improve the experience but are not essential to the core service. Where consent is required, they remain disabled until the relevant choice is made.

Analytics and measurement. Xcho may use analytics to understand how the website is used, identify problems and improve content and performance. Google Analytics 4 is treated by Xcho as optional analytics and is not enabled until the visitor gives the relevant analytics consent.

4. Google Analytics and Google Tag Manager

Where Google Analytics 4 is enabled, it is activated only after the visitor accepts analytics through Xcho’s cookie controls.

Google Analytics may use browser identifiers and cookies, including identifiers commonly beginning “_ga” and property-specific variants. The exact names and lifetimes depend on the deployed Google configuration and are shown in the live cookie settings or technology inventory.

Generic supplier defaults are not treated as Xcho’s actual settings. The published inventory must reflect the deployed identifiers and configured lifetimes, including any separate retention of analytics events. Necessary authentication and consent-preference storage must likewise be identified from the actual configuration rather than an assumed cookie list.

Where Google Tag Manager is deployed, it manages tags rather than supplying an exemption from consent. Each tag is classified and controlled according to its actual purpose. Consent-required analytics or marketing tags and their associated collection must remain blocked until the appropriate choice has been made. The technology inventory identifies whether Google Tag Manager and the individual tags are enabled on the relevant part of Xcho.

Rejecting optional analytics must not prevent ordinary use of the public Xcho website.

5. Self-hosted website measurement

Xcho may use self-hosted Plausible for proportionate aggregate website measurement.

Self-hosting and the absence of traditional analytics cookies do not, by themselves, establish an exemption. Where the actual configuration stores or accesses device information, Xcho will obtain consent unless a specific legal exception applies and all its conditions are satisfied. If Xcho relies on the statistical-purposes exception, measurement is limited to aggregate statistics to improve Xcho’s website or service, not identifying or targeting particular people, cross-service tracking or advertising. Individual-level information is retained only as necessary for aggregation and is not reused for an incompatible purpose. Clear information and a simple, free means of objecting must be available before that exception is used. Any personal data is also subject to the lawful-basis and rights information in the Privacy Policy.

Where an objection control is required for non-consent-based statistical measurement, it will be provided through the website’s privacy or cookie controls and an objection will be respected. If that control or the required information is not available, the statistical-purposes exception must not be relied on: the affected technology must remain disabled unless valid consent is obtained. A change of purpose or configuration will be assessed before deployment and the notice and controls updated accordingly.

6. Cookie choices

Where optional technologies are offered, the cookie controls must make acceptance, rejection and category choices clear and accessible. Rejecting optional technologies must be as straightforward as accepting them. Choices are not preselected where opt-in consent is required. The controls will record the choice and honour it; merely closing the notice is not consent.

Consent-required technologies are not enabled merely because a visitor browses or scrolls the site, signs a customer agreement, joins a waitlist or acknowledges this policy.

Optional consent can be changed or withdrawn through Cookie Settings as easily as it was given. On withdrawal, future consent-dependent storage, access and collection will stop and Xcho-controlled optional identifiers will be removed or disabled where technically possible. Browser settings can remove remaining stored cookies. Withdrawal does not make earlier lawful processing unlawful, but information already collected remains subject to applicable data-protection rights and retention rules. A cookie choice does not amount to consent for unrelated marketing messages.

Deleting or blocking strictly necessary account storage may sign the user out or prevent a requested account function from working.

7. Technology inventory

The current technology information supplied with the website’s Cookie Settings must identify the technologies actually deployed: their names or identifiers, provider or domain, purposes, consent category or relied-on exception and duration or expiry. Device-storage duration is distinguished from retention of information subsequently collected. Xcho will make this information available before consent-dependent use and keep it current when deployment changes. Optional technology for which the necessary information and controls have not been supplied must remain disabled. The categories below explain potential functions; they are not evidence that every named technology is active.

The relevant categories and services, when enabled, are:

Xcho necessary storage: authentication, session, security, fraud-prevention and preference functions required to provide requested website or account features. Exact names and durations depend on the deployed Xcho authentication and infrastructure configuration.

Xcho consent-preference storage: records the visitor’s cookie choices so that Xcho can honour them on later visits. This is used only to remember the choice.

Google Analytics 4: optional analytics enabled only after analytics consent. It may use identifiers such as “_ga” and property-specific “_ga_*” cookies and send analytics data to Google in accordance with the configured service.

Google Tag Manager: tag-management infrastructure. Tags loaded through it are classified and controlled according to their individual purpose.

Self-hosted Plausible: aggregate website measurement subject to section 5. No cookie name or retention period is inferred merely from the product name. The actual deployment and any required objection control determine whether consent is necessary.

A provider’s generic cookie list is not proof that every listed technology is present on Xcho. Xcho’s policy is to describe the technologies actually deployed.

What xcho.ai uses now

What app.xcho.ai and api.xcho.ai use

8. Third-party services and embedded content

Third-party services connected by Xcho customers, including CRMs, calendars, messaging services and external assistants, have their own privacy and storage practices when the customer or user accesses those third-party services.

A customer connecting an integration does not give Xcho permission to place unrelated marketing cookies on website visitors.

If Xcho later embeds third-party content that stores or accesses information on a visitor’s device, it will be classified and controlled according to its actual purpose and applicable consent requirements.

9. Personal data and international transfers

Where cookies or similar technologies process personal data, the Xcho Privacy Policy explains the relevant purposes, legal bases, recipients, retention arrangements and individual rights.

Google and other third-party providers may process relevant analytics information outside the UK. Where LeadCrowd makes a restricted international transfer, it uses an applicable transfer mechanism and safeguards.

The location of Xcho’s built-in AI does not determine where website analytics or browser information is processed.

10. Browser controls

Most browsers allow users to view, delete or block cookies and other storage. Browser controls are additional to Xcho’s own cookie choices and do not replace our obligation to obtain consent where required.

Blocking all cookies may affect sign-in, security or other functionality that depends on strictly necessary storage.

11. Changes to this policy

We will update this Cookie Policy and the live technology inventory when our website technologies or legal requirements materially change.

The revision date identifies this version. It takes effect when published or from a later date expressly notified and does not itself activate a technology or supply consent.

A new consent-required purpose will not be enabled on the basis of consent previously given for an unrelated purpose.

12. Contact

Questions about cookies, analytics or privacy can be sent to hello@xcho.ai or by post to LeadCrowd Limited at the registered office above.