Privacy Policy
This notice explains what information is involved when you use the Xtensyon website, send an enquiry, apply for a role, access a course, or use our analysis tools.
Effective date: 30 October 2026
1. Who is responsible for your information
“Xtensyon”, “we”, “us”, and “our” refer to Xtensyon Information Technology Services, the operator of this website and its analysis tools. We are the personal information controller for the website-related activities described here: we decide why and how the relevant personal information is processed.
- Business / personal information controller
- Xtensyon Information Technology Services
- Privacy contact
- Use the Contact Us form — please use “Privacy request” in the subject.
The business owner handles privacy requests received through this form.
This notice covers website-related processing. If Xtensyon processes information on a client's instructions under a separate engagement, the relevant service agreement and data-processing arrangements also apply. They do not remove anyone's statutory privacy rights.
2. What information is involved and why
Enquiries and project discussions
The contact form asks for your name, email address, subject, and message. You may also provide a phone number and company name. We use the information you provide to understand the request, respond, and discuss work you have asked us to consider. Correspondence may be handled through the website's business system and email.
Contact submissions create private support tickets when ticket intake is enabled. Staff use the ticket and related correspondence to handle the request. If ticket intake is disabled, the managed form queues an email instead. A confirmation means the submission was accepted; it does not confirm email delivery. Private submission receipts and security checks help prevent duplicate requests and abuse.
Accounts and courses
If you have an account or enrol in a course, the website can process your account identity, contact details, enrolments, progress, and learning activity. Where a course includes quizzes, reviews, or discussions, it can also store your answers and contributions. These records support access, course delivery, and account administration. Display names, contributions, and learning achievements may be visible to others through public profiles, discussions, or leaderboards, depending on the feature and its settings.
Client registration uses your email address and password to create an account. Account administration also uses verification status, verification-link issuance records, and submission counters. Registration security checks use hashed network identifiers and email-related limits. Private client features can store your support requests, replies, profile changes, and newsletter preferences. Creating an account does not automatically claim earlier records that happen to use the same email address.
Logged-out quizzes on open courses are graded without saving a learner attempt, completion record, or learning points. Signed-in quiz activity follows the course's account and enrolment rules. Technical request records may still exist for either flow.
Job applications
If you apply through the careers pages, the information includes the contact details, application answers, CV, and other material you submit. This information is used to assess your application and communicate about recruitment. Supply only information relevant to the role. Avoid unrelated medical, financial, identity-document, or other sensitive details.
If you are invited to a recruitment exam, records can include your identity, invitation, deadlines, saved answers, submission times, scores, reviewer assessments, and released feedback. Answers can be saved while you work. Objective questions are scored against configured answers; written and practical responses use reviewer assessment. Exam results support recruitment review. Completing or grading an exam does not itself change your recruitment stage or make an employment offer.
Website use and technical records
Serving the website involves connection information such as your IP address, requested URL, browser information, and request time. The website also supports visitor records and page-visit history, including visit times, language, approximate country, and time zone where available. A visitor record may be connected to an account when you sign in. These records can support website operation, troubleshooting, security, and understanding how the site is used.
Required form fields are marked on the relevant form. If you do not provide information needed to fulfil a request, we may be unable to respond, provide access, or process the application. Optional information should be limited to what is useful for that purpose.
3. Grounds for processing
The appropriate ground depends on the information and the activity. Enquiries and requested service discussions can involve steps you request before an agreement. Account and course administration can be necessary to deliver the access or service you request. Security, troubleshooting, and proportionate website administration may rely on legitimate interests, subject to your rights. Keeping records or responding to an authority may be necessary to meet a legal obligation. Where consent is required, it must relate to the specific purpose and information involved.
Sensitive personal information requires an applicable lawful basis in addition to a general operational reason. Providing an enquiry or application does not give unlimited permission to use your information for unrelated purposes. Reading this notice is not, by itself, consent to every form of processing.
An enquiry or application is not an automatic subscription to promotional messages. Any use for a separate promotional purpose needs an applicable lawful basis and appropriate notice or choice.
4. Information sent through the analysis tools
The SEO Audit, Keyword Density, Content Gap Analysis, Content Extractor, and GEO Audit interfaces use an Xtensyon-operated analysis service. When you run an analysis, your browser sends the submitted URL or text, selected settings, and technical request information directly to that service. The request does not stay solely on your device. This notice covers that processing.
The analysis service can retrieve the target page and process its content. Depending on the tool, it creates an analysis job and makes status information or results available through a job or report identifier. The interface retrieves those results to display them. Cancelling a job or closing the page should not be treated as confirmation that the submitted information or results have been deleted.
Some results can be exported or referenced through report links. Treat report links and identifiers carefully: do not assume that a link is private or protected by your website account. Anyone you share an export with can keep their own copy.
Use material you are authorised to submit for analysis. Do not include passwords, access tokens, private customer records, confidential documents, or URLs containing secrets. A publicly reachable page may still contain personal information or material subject to someone else's rights.
Tool submissions are used to perform the requested analysis, provide or retrieve the results, and handle related operational or security issues. An unrelated use, including training a general-purpose model, requires its own lawful basis and notice; it is not authorised merely by using a tool. Where another provider is involved in the requested processing, the recipient and transfer principles in section 6 apply.
The tools automate evaluation of submitted content. A score or report concerns that content and is not a decision about your employment or eligibility for a service. See the Terms of Service for the limits of those outputs.
6. Who receives information and where it is processed
Information may be handled by authorised people responsible for enquiries, service delivery, recruitment, account administration, or website support, according to the activity involved. Hosting, email, storage, and other service providers may also process information needed to deliver those functions. Tool submissions are sent to the analysis service described in section 4.
Information may also need to be disclosed in response to a valid legal requirement or to establish, exercise, or defend a legal claim. A disclosure must have a proper basis and be limited to the information needed for that purpose.
Our website hosting, email, and analysis-tool providers are based in the United States, where information for those services is processed. Authorised staff may also access information to handle the activities described in this notice. A provider engaged to process information on our behalf must have an appropriate purpose, access scope, and safeguards; using a provider does not remove our responsibility for the processing we control.
Use the Contact Us form to ask for information about the recipients and processing locations relevant to your records or a proposed submission. If a location or confidentiality restriction is important to your project, establish it with us before supplying the affected information.
7. How long information is kept
Retention depends on the purpose for collection, applicable recordkeeping duties, and any genuine need to handle a dispute or legal claim. The conditions below govern retention. Scheduled cleanup rules apply only to the technical records identified below; they do not delete the associated support ticket, application, or account. A record should be removed or de-identified when its applicable purposes and retention obligations have ended.
| Record | Purpose and retention conditions |
|---|---|
| Enquiries and correspondence | While the request and related follow-up remain open, then for 24 months after the enquiry is closed. If an enquiry becomes client work, relevant records follow that engagement's retention requirements. A legal obligation or genuine dispute may require particular records to be kept longer. |
| Job applications, CVs, and recruitment exams | For the recruitment process. For unsuccessful applications, we keep the application and associated CV and exam records for 12 months after the recruitment decision, unless a legal obligation or genuine dispute requires particular records to be kept longer. Retention for unrelated future opportunities requires a separately communicated purpose and lawful basis. An exam deadline or expired access link does not itself delete saved answers or scores. |
| Contact and application submission receipts | Scheduled cleanup removes receipts older than seven days. Contact-form abuse counters and transaction gates are eligible for cleanup after 24 hours. Receipts help handle duplicate submissions; their removal does not remove the enquiry or application. |
| Cookie choices and configuration history | The configured retention is shown in the Cookie Policy. Daily cleanup removes older history. Clearing browser storage does not itself delete server history. |
| Advertising event hashes and daily totals | Temporary event hashes are eligible for daily cleanup after the configured period, currently 30 days on this website. Daily aggregate totals remain for reporting. This does not define retention for separate visitor records or server logs. |
| Accounts, course activity, and public contributions | While needed to provide and administer the account or learning service and handle related obligations. Account closure triggers consideration of the remaining need for associated records; it does not automatically erase every contribution or legally required record. |
| Visitor records not linked to a contact | The system is configured to schedule cleanup daily for records inactive for more than 60 days. This is a scheduled eligibility rule, not a promise of deletion at an exact time. Contact-linked records are excluded from that cleanup. |
| Contact-linked visitor records and technical logs | For relevant account administration, website operation, troubleshooting, or security purposes, with longer retention only where a continuing lawful purpose or obligation applies. |
| Analysis inputs and reports | Cached only for seven days. Cancelling a job or closing the browser does not itself clear that cache. Copies you download or share are outside this service cache and remain under the recipient's control. |
| Backups and retained copies | Recovery copies may outlast an active record until the applicable backup cycle ends. A deletion request must be considered alongside backup handling, any copies held by providers, and legal restrictions. Ask us about the position for the records concerned. |
You may ask about the period or remaining need applicable to your information. Where a record must be retained despite a deletion request, the response should explain the reason and any applicable limits. A legitimate requirement to keep one record does not justify unrelated retention.
8. Security and access
Access to personal information should be limited to authorised purposes, with safeguards appropriate to the information and the risks. No website, email service, or network can promise absolute security. Do not send credentials or sensitive records through a general enquiry form. Ask for an appropriate method if such information is necessary for an agreed task.
Report a suspected disclosure, account compromise, or privacy incident through the Contact Us form. Include enough detail to identify the issue without resending the exposed information unnecessarily.
9. Your rights and how to contact us
Subject to the applicable law and its conditions, you may ask to be informed about processing, access your personal information, correct inaccuracies, object to processing, or request blocking or erasure. Data portability and other remedies may also apply. If processing relies on consent, you may withdraw that consent; this does not automatically invalidate earlier lawful processing or remove an independent legal reason to retain a record.
Use the Contact Us form with “Privacy request” in the subject, describe the information or activity concerned, and state what you would like us to do. We may need proportionate information to verify your identity or authority before disclosing records or making changes. Avoid sending identity documents unless they are necessary and an appropriate channel has been agreed.
You may also raise a concern with the Philippine National Privacy Commission. See its explanation of the right to be informed. Where another applicable law provides additional rights or a competent supervisory authority, those rights remain available.
10. Changes to this notice
This notice identifies its effective or revision date above. A material change in processing requires appropriate notice and, where required, a fresh choice or consent before that change applies. Updating a webpage does not by itself authorise an unrelated use of information already collected.
Related documents: Terms of Service and Cookie Policy.