Privacy Notice

Current status

This prototype does not currently accept correction, claim, removal or suggestion submissions — submission is disabled by a safety gate until an administrator-review workflow is connected. No personal information is collected through these forms while that gate is disabled.

Request form data

When request submissions are enabled, the fields you enter in a request form — and an optional email address, where the form allows one — are stored for administrator review. An email address you provide is used only so xMAD can follow up with you or verify your request; it is not used for marketing and is not shared with the business the request concerns unless you ask xMAD to do so.

Every submitted request also records which version of the Terms of Use, Privacy Notice, Listing Policy and confirmation wording (together, the "policy bundle") was in effect when you confirmed the request — the policy bundle version shown at the top of this page, the Terms and the Listing Policy. This lets xMAD identify which policy bundle version and declarations were presented and recorded when the request was submitted, even if these pages are later updated.

Retention

When request submissions are enabled, xMAD intends to work to the following retention limits:

• Pending requests: a maximum of 12 months from submission.
• Accepted requests: 24 months from the date they were resolved.
• Rejected requests: 6 months from the date they were resolved.
• Withdrawn requests: 30 days from the date they were resolved.

Deletion under these limits will not begin until xMAD has a non-personal administrative audit record in place to account for what was resolved and when, independent of the request data itself.

Backup copies of stored data may persist for longer than the limits above until xMAD's backup rotation has been verified as operating on a defined schedule; xMAD does not yet state a specific backup-retention duration.

You can ask xMAD to delete your submission earlier. xMAD will consider early deletion requests and aim to handle them within 30 days, unless there is an overriding legal or evidential reason to retain the information for longer.

No analytics or unnecessary tracking

xMAD does not use analytics or other unnecessary tracking on this site.

Rate limiting

When request submissions are enabled, xMAD applies rate limiting to reduce automated abuse. It creates a separate temporary pseudonymous key using a keyed cryptographic digest (HMAC) of the network address supplied by xMAD's trusted proxy. The raw network address is not stored in the rate-limit table. Although pseudonymous, xMAD treats the derived key as personal data for privacy purposes.

The rate-limit record is stored separately from submitted request data and has no direct database link to a submitted request. It is not part of the administrator-review record and is never public or indexed.

A rate-limit record remains active while submission attempts continue and becomes eligible for deletion after its current fixed window expires. Eligible records are intended to be removed by a separate recurring cleanup process. Until that process has been deployed, monitored and verified in production, deletion within 48 hours of eligibility is an operational target rather than a guarantee.

Contact

Privacy questions or requests can be emailed to hello@xmadsearch.com.