Privacy Policy

This Privacy Policy explains how LeadCrowd Limited, trading as Xcho, handles personal data in connection with the Xcho website, business accounts and platform. It also explains the different role Xcho normally has when a business customer uses Xcho to communicate with its own contacts.

1. Who we are

Xcho is operated by LeadCrowd Limited, a company registered in England and Wales with company number 10963512. Our registered office is The 1812 Building, Wheatley Park, Mirfield, England, WF14 8HE.

For privacy questions, rights requests or data-protection complaints, email hello@xcho.ai and mark the message “Xcho privacy”, or write to us at the registered office.

This notice focuses on UK data-protection law. Where another data-protection law applies to a particular person or activity, we will comply with the obligations that apply to us.

2. Our different data-protection roles

For Xcho’s own website enquiries, account administration, billing, fraud prevention, security, support, business relationship management, service communications and our own permitted marketing, LeadCrowd normally acts as controller because we determine why and how that information is used.

When a business customer uses Xcho to contact, converse with or book appointments for its own leads, prospects or customers, that business normally determines the purpose of the processing and acts as controller. LeadCrowd normally acts as its processor under the Data Processing Agreement in the Xcho Business User Agreement.

If an Xcho customer is itself a processor, it must have authority from its controller to appoint LeadCrowd as a subprocessor.

The business contacting an individual through Xcho is responsible for its own privacy information, lawful basis, marketing permissions and regulatory obligations. This Xcho Privacy Policy does not replace that business’s privacy notice.

Customer contacts and conversations imported into Xcho are used to provide that customer’s Xcho service. They are not sold, added to a lead marketplace or reused for unrelated marketing or lead generation.

3. Information we handle

Information relating to Xcho customers and account users may include names, business contact details, employer or organisation, role, account identifiers, authentication information, permissions and user roles, selected plan and settings, billing details, transaction status, limited payment-card metadata supplied by Stripe, support correspondence, service communications, usage records, security events, audit logs, complaints and account administration records.

For customer campaigns, information may include names, telephone numbers, email addresses where supplied, source information, consent or permission records, suppression and opt-out records, campaign assignments, messages and replies, relevant information extracted from conversations, AI-generated summaries or classifications, delivery records, appointment details and related activity.

Information may be provided by the customer, imported from a spreadsheet, synchronised from an authorised CRM, received from a connected website form or webhook, generated through use of Xcho or supplied by an individual when they respond.

Xcho is not intended to collect payment-card details, bank login credentials, passwords or authentication secrets in campaign conversations. Customers must not deliberately configure Xcho to request them.

Customers must not deliberately configure Xcho to collect special-category personal data or criminal-offence data unless LeadCrowd has expressly approved the processing scope and appropriate lawful conditions and safeguards are in place. An individual may nevertheless volunteer unexpected sensitive information during a conversation; where that happens, access and use should be limited to what is appropriate for the customer’s lawful purpose.

4. Why we use personal data as controller

Business enquiries and account creation. We use information to respond to enquiries, manage trials and onboarding, create and administer business accounts and take steps requested before a contract. Our lawful basis may be contractual necessity where the individual is contracting with us and legitimate interests in managing a business relationship where the person acts for an organisation.

Service delivery and support. We use account-user information, support correspondence and relevant service records to operate Xcho, provide help, communicate operational information and manage the customer relationship. Our bases include contractual necessity and legitimate interests in providing and supporting our service.

Billing, payments and tax. We use billing details, transaction information and relevant usage records to collect subscriptions and top-ups, administer refunds, reconcile charges, prevent payment abuse and meet accounting and tax requirements. Our bases include contractual necessity, legitimate interests in business administration and fraud prevention and legal obligations.

Security, fraud prevention and misuse. We use account, device, authentication, security and usage information where reasonably necessary to protect Xcho, users, suppliers and other customers, investigate suspected abuse and establish or defend legal rights. Our basis is legitimate interests and, where applicable, legal obligation.

Service improvement and analytics. We use genuinely anonymised and aggregated service information for capacity planning, benchmarking and product improvement. Proportionate processing of account-user usage and diagnostic data to identify faults, assess feature performance and improve Xcho is based on our legitimate interests in providing a reliable and useful business service, only where necessary and those interests are not overridden by individuals’ rights. Optional tracking for which consent is required is based on consent and remains disabled until it is given. This does not authorise independent product-analytics use of customer campaign conversations or contacts; those remain subject to the customer’s instructions and the limits in the Business User Agreement.

Our own marketing. We may send relevant information about Xcho where permitted by law. We rely on legitimate interests where appropriate and consent where required, together with any separate electronic-marketing requirements. You can object to direct marketing at any time. Campaign contacts are not added to our own marketing list merely because a customer uses Xcho.

Website measurement. Optional Google Analytics 4 measurement is based on consent and is not enabled until analytics consent is given. Where self-hosted aggregate measurement is lawfully operated without consent, any necessary personal-data processing is based on our legitimate interests in understanding and improving the website, subject to an appropriate balancing assessment and any required simple, free objection control. Calling a tool cookieless or self-hosted does not, by itself, remove consent requirements. The Cookie Policy explains the applicable choices.

Legal obligations and claims. We may use and retain limited information where necessary to comply with law, respond to regulators, enforce contracts or establish, exercise or defend legal claims.

Required account information. Business identity, an authorised account contact, secure login information and relevant billing or tax details are needed to set up and operate a business account and, where applicable, meet legal obligations. Without information reasonably required for those purposes we may be unable to open the account, provide the requested function, collect payment or apply the requested tax treatment. Optional marketing and analytics choices are not a condition of ordinary service use.

Business transfers. We may process limited business-contact and account information for the legitimate interests of evaluating or completing a genuine financing, reorganisation or transfer of the Xcho business, subject to necessity, confidentiality and the safeguards described below. This is not permission to sell campaign contacts as a lead product.

5. Customer campaigns and permissions

Customer contacts and conversations are processed to provide that customer’s Xcho service and on its instructions, subject to LeadCrowd’s own legal obligations.

The customer is responsible for lawful collection, authority to supply the data, accurate privacy information and the permission required for each recipient, purpose and communication channel.

A contact record, old enquiry, purchased lead or existing telephone number is not by itself proof that a future SMS or WhatsApp message is permitted. A general data-protection lawful basis also does not replace any separate electronic-marketing or channel-provider requirement.

Before a campaign is activated, the customer must confirm that it holds the permissions required for the recipients, sender, purpose and channel. That responsibility continues for contacts later supplied by forms, webhooks, CRM synchronisation or other authorised integrations and must be reassessed when the use materially changes. Xcho records and may rely on the customer’s instruction rather than independently verifying every contact. Neither that confirmation nor this notice removes any direct legal duty of LeadCrowd or the customer.

Xcho may prompt customers to import or synchronise existing suppression and opt-out information. Customers remain responsible for supplying complete and accurate restrictions from their other systems and recording withdrawals received elsewhere. Once Xcho records an opt-out or suppression instruction, LeadCrowd will apply the relevant controls without undue delay to prevent further affected outbound marketing. Ordinary users may not bypass those restrictions. A fresh lawful permission must be documented where required before relevant marketing is re-enabled. Messages already irreversibly accepted by a supplier may not be recallable.

LeadCrowd may request reasonable evidence or suspend affected activity where there is a complaint or reasonable ground to suspect unlawful messaging. This does not make LeadCrowd the controller of the customer’s campaign or transfer the customer’s underlying permission responsibility to LeadCrowd.

6. AI processing and automated decisions

Xcho’s built-in AI currently uses Anthropic Claude models through Amazon Bedrock within LeadCrowd’s AWS environment. It can generate conversational replies, summarise messages, extract relevant information, identify interest, route conversations and support appointment booking.

Xcho does not use its built-in AI to make final eligibility, underwriting, affordability, entitlement or other solely automated decisions that produce legal or similarly significant effects for the individual. Those substantive decisions remain with the customer or its other systems.

Xcho does not provide regulated or professional advice or personal recommendations. Where a conversation requires advice or a substantive human decision, the customer is responsible for the appropriate human process.

AI identity and oversight. AI disclosure is to be enabled by default and required disclosures cannot be removed or contradicted by customer settings. Where applicable law requires disclosure at the first interaction, it will not be deferred until the person asks. Xcho does not intentionally impersonate a human. Customers remain responsible for suitable human follow-up and must not use Xcho as an emergency-response or final consequential-decision service.

AI systems can make mistakes or misunderstand context. Xcho uses controls such as message screening, no-advice restrictions, sending windows, opt-out handling and human handover, but these controls do not guarantee perfect accuracy or regulatory compliance.

LeadCrowd does not use customer contacts or conversations to train or fine-tune a general AI model and does not authorise its subprocessors to use that data for their own general model training.

LeadCrowd may change model versions or providers where the service purpose and material safeguards are maintained and any required subprocessor or transfer process is followed.

7. Payments and Stripe

Stripe processes Xcho subscription payments, prepaid balance top-ups, authorised automatic top-ups, refunds and related payment administration.

Full payment-card details are handled by Stripe and are not stored by Xcho. Xcho may receive limited information from Stripe that is needed to administer the account, such as transaction identifiers, payment status, card brand, last four digits, billing details and fraud or dispute information.

Stripe may act as our processor for some payment functions and as an independent controller for activities it determines for itself, such as certain legal, regulatory, fraud-prevention or network obligations. Stripe’s own privacy information explains those activities.

Xcho does not send customer campaign conversations or unnecessary lead information to Stripe merely because Stripe processes the customer’s payment.

8. Suppliers, integrations and other recipients

LeadCrowd uses suppliers to operate Xcho. The current subprocessor list is maintained separately so that provider identities, services and material processing changes can be kept current.

Principal service providers may include Amazon Web Services for hosting, storage and Amazon Bedrock AI processing; Twilio for SMS, WhatsApp connectivity and Xcho-provided telephone numbers; Meta/WhatsApp for WhatsApp Business functionality; Stripe for billing and payments; and Postmark for Xcho account and service emails.

Google Calendar and HubSpot are optional customer-enabled integrations. Website forms and webhooks can provide customer-directed data to live campaigns.

A customer may connect an independently chosen external assistant through Xcho’s MCP or API functionality. That external provider is selected by the customer and operates under its own terms and privacy arrangements. Access to Xcho can be revoked, but revocation does not necessarily delete copies already received by that provider.

We may disclose information to authorised personnel, professional advisers, insurers, auditors or competent authorities where reasonably necessary and lawful.

For a genuine proposed or completed financing, reorganisation or sale of all or part of the Xcho business, we may share limited information with prospective or actual counterparties and their professional advisers under appropriate confidentiality and purpose restrictions. We use anonymised or aggregated information wherever sufficient. Customer campaign data is not disclosed for speculative commercial use: any necessary access or transfer must have a lawful basis, comply with the customer’s processing terms and preserve the agreed purpose and protections. A successor operating Xcho must honour applicable contractual and data-protection obligations. This does not permit selling contacts or conversations as a lead list.

9. International processing

Xcho’s primary platform hosting is configured in the AWS London region. Built-in AI processing is configured to remain within UK/EU processing routes where technically configurable at launch.

That does not mean every supplier processes every category of data only in the UK or EEA. Messaging, payment, support, email and customer-enabled integration providers may process relevant information elsewhere.

Where LeadCrowd makes a restricted international transfer, we use an applicable lawful transfer mechanism and appropriate safeguards, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses or another permitted mechanism.

You can request information about the transfer mechanism applying to your information and a copy of relevant safeguards by emailing hello@xcho.ai. We may redact information only where necessary to protect others’ rights, security or legitimate confidentiality, while providing meaningful information about the safeguards. Where EU data-protection law applies, the relevant EU transfer requirements apply in addition to any applicable UK requirements.

A customer-selected external assistant or third-party integration may have its own processing locations and transfer arrangements. The customer should assess those provider arrangements before enabling the disclosure.

10. Retention and deletion

We keep personal data only for as long as reasonably necessary for its purpose, legal requirements and legitimate dispute or security needs.

While an Xcho account remains active, customer campaign contacts, conversations and campaign history may remain available until the customer deletes them or asks Xcho to do so, subject to any lawful retention requirement.

After account closure, the customer can choose return or deletion of personal data processed on its behalf. Unless it requests earlier deletion, the normal arrangement is secure return or export availability for 30 days followed by deletion of live customer campaign data. Any different mandatory switching or retrieval period in the Business User Agreement takes priority. Limited controller records and legally required retention are treated separately, not as authority to retain complete campaign datasets indefinitely.

Where selective removal from backups is not immediately practicable, the affected data is put beyond ordinary use and protected by restricted access until deleted or overwritten as soon as practicable through the backup cycle, no later than 90 days after live deletion. A stricter mandatory full-erasure deadline takes priority unless a later date is expressly and lawfully agreed. If a backup is restored, deletion and suppression instructions must be reapplied before ordinary processing resumes.

LeadCrowd may retain limited account, billing, contract acceptance, security, permission-confirmation and compliance audit records for up to six years after account closure where reasonably necessary for legal obligations or to establish, exercise or defend legal claims. This does not mean complete campaign conversations are routinely retained for six years.

Operational logs may be retained for shorter periods appropriate to security, troubleshooting and service operation.

Enquiries and waitlists. We retain enquiry correspondence while responding and during reasonable follow-up connected with the request. Waitlist information is retained while the requested access or launch remains relevant and the person remains interested. We review whether retention remains necessary and delete or anonymise it when the enquiry, follow-up or waitlist purpose has ended, unless a documented legal obligation or dispute requires relevant records.

Marketing records. We retain optional marketing information while the choice remains valid and the relationship or expressed interest remains relevant. We review inactive records and remove them when there is no continuing justification. After an objection we stop the relevant marketing and may retain a minimal suppression record so the objection is respected.

Analytics and demonstration data. Identifiable analytics data is retained only for the configured, disclosed measurement period necessary for the stated purpose, then deleted or genuinely anonymised. The deployed period is stated in the relevant technology information before collection. Where the statistical-purposes exception is used, individual-level information is not retained beyond the aggregation process. Personal data inadvertently entered in a public demonstration is limited to dealing with that interaction and necessary security or incident handling, not a permanent demo archive. These retention criteria do not authorise undisclosed tracking or indefinite retention.

Minimal suppression information may be retained where needed to prevent renewed unwanted contact, subject to the applicable legal role and instructions.

Connected CRMs, calendars, messaging providers, payment providers and customer-selected external assistants may hold their own copies according to their role and retention terms.

11. Security and access

LeadCrowd uses technical and organisational measures appropriate to the service and the risks presented by the processing. These may include role-based access, authentication controls, encryption in transit and at rest where supported, logical tenant separation, logging and monitoring, supplier access controls, incident response, backup and recovery and staff confidentiality obligations.

Authorised Xcho personnel may access customer campaign data only where reasonably necessary for support, security, incident investigation, abuse prevention, maintenance or legal obligations.

No internet-connected system can be guaranteed absolutely secure. Xcho does not claim a security certification unless it expressly identifies that certification as current.

Customers are responsible for managing their own users, roles, devices, credentials and external-assistant tokens and for promptly revoking access that should no longer exist.

12. Service emails and marketing

We may send account users essential or reasonable service communications about security, billing, support, changes to Xcho, service operation and other matters connected with their account. These are distinct from optional promotional marketing.

Where we send promotional marketing, recipients can opt out using the method provided or by contacting us. Opting out of marketing does not prevent us from sending necessary service, security, billing or legal communications.

13. Your rights

Depending on the applicable law and circumstances, you may have rights to access personal data, correct inaccurate information, request deletion, restrict processing, receive portable data, object to certain processing and withdraw consent where processing is based on consent.

Withdrawal of consent does not affect processing that was lawful before withdrawal.

Your right to object. You can object at any time to direct marketing, including related profiling, by using the opt-out provided or emailing hello@xcho.ai. We will stop that marketing. Where we rely on legitimate interests, you may also object for reasons relating to your particular situation. We will stop the affected processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms or the processing is needed to establish, exercise or defend legal claims. This does not affect any stronger right or simpler objection control that applies to a particular activity.

Where the information is controlled by an Xcho customer because it relates to that customer’s campaign, the business that contacted you is normally the appropriate first contact. If LeadCrowd receives a request relating to customer-controlled campaign data, we will route or assist with it as required by our processing obligations.

For information LeadCrowd controls in its own right, contact hello@xcho.ai. We may request proportionate identity verification before disclosing information.

14. Complaints and personal-data breaches

You can complain about our handling of personal data by emailing hello@xcho.ai, writing to the registered office or using another accessible communication route. No paid account, particular form or legal terminology is required. We will acknowledge a data-protection complaint within 30 days, begin appropriate enquiries without undue delay, keep the complainant informed of progress and explain the outcome and available escalation route without undue delay. The acknowledgement period is not a waiting period before investigation and does not replace a separate statutory deadline for a rights request.

You may complain to the Information Commissioner’s Office and, where EU law applies, the competent supervisory authority, subject to the applicable complaint procedure. We will explain relevant escalation information when responding and will not require you to waive a statutory right to complain.

If LeadCrowd becomes aware of a personal-data breach affecting customer campaign data, it will notify the relevant customer without undue delay in accordance with the Data Processing Agreement. Initial notification need not wait until the investigation is complete.

15. Cookies and similar technologies

The Xcho Cookie Policy explains cookies, local storage, tags and similar technologies used on the public website and, where relevant, the account service.

Google Analytics 4 is not enabled until the visitor gives the relevant analytics consent. Necessary technologies may operate without consent only where the applicable legal requirements for that purpose are met.

16. Changes to this policy

We may update this Privacy Policy where our processing, suppliers, service or legal obligations change. Where a change is material, we will provide appropriate notice.

The revision date identifies this version, which applies when published or from a later effective date expressly notified. A previous notice or customer agreement is not retrospectively replaced merely by editing a draft document.

A change to this notice does not retrospectively create permission to use customer campaign data for an unrelated purpose and does not replace the customer’s own obligation to provide appropriate privacy information to the people it contacts.