What we collect, and what we don’t.
Xyress is operated by Ivalice, the conceptual-systems studio that builds it. Ivalice is the data controller for this site. The site is a front door for a platform in build: it runs no advertising and no cross-site trackers, and its only analytics is Cloudflare Web Analytics, which sets no cookies and cannot identify you. The only personal data it holds is what you send us through the contact form, plus the technical details below that keep spam out.
What the contact form collects
When you submit the form on the Partner page we store the name, email address, organization and message you typed, and the track you selected.
Alongside it we record three technical details, used only to identify abuse: the IP address reported for your request, your browser’s user-agent string, and how long the form was open before you submitted it. That last one is how automated spam is separated from real messages.
Why we hold it
To read your message and reply to it, and to keep spam and abuse out. Those are the only purposes. We do not profile you, we do not enrich the record from other sources, and we do not use it to market anything to you.
Who can see it
Named members of the Xyress team at Ivalice, through an authenticated admin console. Your submission is never shared with, sold to, or used by any third party for advertising or analytics. Every administrative action on a submission is recorded in an internal audit log.
Site analytics
The site is delivered and protected by Cloudflare. We use Cloudflare Web Analytics to understand, in aggregate, how the site is used: which pages are viewed, which sites refer visitors, how quickly pages load, and the browser, device type and country a visit comes from.
It sets no cookies, stores nothing in your browser, and does not fingerprint you, so we cannot use it to identify you or to follow you across other sites. It is never connected to anything you send through the contact form. Cloudflare processes this data on our behalf.
Cookies
The public pages set no cookies at all, including for analytics. The admin console sets two, and only for signed-in administrators: a session cookie and a CSRF token. Both are strictly necessary for that console to function and neither is used for tracking.
How long we keep it
Submissions are retained while the conversation is live and for as long as we have a legitimate reason to keep the correspondence. Administrator sessions expire after eight hours, or one hour of inactivity, and are deleted automatically.
Your rights
If you are in the UK or EU, the UK GDPR and GDPR give you the right to ask what we hold about you, to have it corrected, to have it deleted, and to object to our holding it. Write to [email protected] and we will action it. You may also complain to your national supervisory authority.
Contact
Questions, or any request about your data, go to [email protected] and a real person will handle it.
Last updated: September 2026