Last updated: 27 September 2026
Xsup runs on your own computer. Your mail, your calendar, your files and everything Xsup works out from them are stored on that computer, encrypted with a passphrase only you hold.
We do not receive your mail. We do not store it. We cannot read it. There is no account on our servers holding your content, because there is no such account.
Two things do leave your machine, and only these two:
Both are explained below.
For the content Xsup handles on your machine, you are the data controller. It is your mail in your possession on your computer. Nexilis Consulting Ltd does not process it on your behalf, because we never receive it.
For the small amount of information we do hold, described in section 4, Nexilis Consulting Ltd is the controller.
When you connect an account, the provider asks you to approve a specific list of permissions. This is the exact list Xsup requests today, and what each one is for.
| Permission | Technical name | Why |
|---|---|---|
| Read your mail | Mail.Read | To read the messages you want kept in order |
| Send mail as you | Mail.Send | Reserved for the send feature, which is off unless you switch it on for that account. Nothing is sent without your approval. |
| Read your calendar | Calendars.Read | To understand what is coming and connect it to the mail |
| Read your files | Files.Read.All | To read the documents the mail refers to |
| Keep you signed in | offline_access | So you do not sign in again every hour |
| Identify your account | openid, profile | To know which account you connected |
| Permission | Technical name | Why |
|---|---|---|
| Read your Gmail | gmail.readonly | To read the messages you want kept in order |
| Send mail as you | gmail.send | Reserved for the send feature, which is off unless you switch it on for that account. Nothing is sent without your approval. |
| Read your calendar | calendar.readonly | To understand what is coming and connect it to the mail |
| Read your Drive | drive.readonly | To read the documents the mail refers to |
| Identify your account | openid, profile, email | To know which account you connected |
Xsup does not currently request permission to move or delete mail in your mailbox. Where Xsup proposes a filing change that has to be carried out inside your mailbox, it asks you for that permission separately, and this page is updated before it does.
Xsup asks for the narrowest permissions that let it do its job. If a permission is listed above, it is used or reserved for a feature you control. You can withdraw any of them at any time with the provider or in the app.
Xsup's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
In particular: data obtained through Google APIs is used only to provide the features described on this page and in the product; it is not transferred to anyone except as you direct or as required by law; it is not used for advertising; and no human at Nexilis Consulting Ltd reads it, because it never reaches us.
Only this:
We hold the licence record for as long as you hold a licence and for six years afterwards, which is how long UK company records are kept. Support email is kept for two years.
This is the complete list. If you find a way that is not on it, that is a defect and we want to know.
The licence check. The app asks our licence server whether a licence number is still valid. The request contains the licence number and an identifier for the machine. It contains no mail, no file names, no counts of anything, and nothing about what you have been doing. We log the fact of the check and the licence number, so that we can tell you why your licence stopped working if it does.
AI providers you have chosen. Xsup uses a model to read and understand things. You choose which.
You choose this, and you can change it. You should read the privacy terms of any provider you turn on, because that is where your content goes.
Providers you connect. Reading your Gmail means talking to Google. That traffic is between your machine and them.
Nothing else. Xsup has no analytics, no crash reporting that includes your content, no telemetry and no background upload.
Everything Xsup keeps is stored in an encrypted store on your computer, locked with a passphrase you choose at first run.
We cannot recover that passphrase. Nobody can. There is no back door and no master key, which is the whole point. If you lose it and you have not kept the recovery key the app gives you, the data is unreadable, including by us.
Xsup does not delete your things. Items it believes you are finished with are moved to a folder that only you empty.
Under UK data protection law you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we use it. Write to admin@xsup.ai and we will answer within one month.
In practice, what we hold about you is the licence record in section 4. Your content is on your own computer, where you already have it, and you can export it from the app at any time, including when your licence has lapsed.
If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.
Xsup is a business tool and is not intended for anyone under 18.
If this policy changes in a way that matters, we will say so in the app and by email to the address on your licence, before the change takes effect.