Privacy Policy

Short version: pages on this site carry no analytics script, no cookie and no third-party request; we keep anonymous, aggregate funnel statistics on our server, described below. The skills you buy never send anything anywhere.

Who is the data controller

CROSSXTOP LTD, registered in England and Wales, company number 16339041, registered office Suite 10890, 61 Bridge Street, Kington, United Kingdom, HR5 3DJ.

For any privacy question, email crossxtop@gmail.com.

This website

This is a static site. Pages are plain HTML, CSS and a small amount of JavaScript served from our own server.

• No client-side analytics. Pages contain no analytics script, pixel, tracker or profiling of any kind. We do count funnel steps server-side — see “Aggregate funnel statistics” below.
• No cookies. The site sets no cookies and uses no local storage for tracking.
• No third-party requests. Everything a page needs is served from our own domain. There are no embedded scripts, pixels, iframes or hosted images, and no font, stylesheet or script is ever fetched from a CDN or any other company’s server. We commit to keeping it that way: if this site ever uses a web font, we will serve it ourselves.
• No advertising and no profiling.

Some of our pages carry ordinary text links to other organisations — the ICO below, and the statutes linked from our refund policy. A link is not a request: your browser contacts those sites only if you click one, and from that point their own privacy policies apply. Simply opening a page on this site contacts nobody but us.

Our web server keeps standard request logs — IP address, timestamp, requested path, user agent — which exist to keep the server running and secure. Our lawful basis is legitimate interest. They are not used to build a profile of you, and our policy is to retain them for no longer than 30 days.

Aggregate funnel statistics

To understand where visitors give up on the way to checkout, we count five steps — page views (from the request logs above), buy-button clicks, checkouts opened, orders paid and success-page returns (the last three from our payment provider’s server notifications). These statistics are aggregate: they contain no IP address, no email address, no card data, and no identifier that persists across visits. Our lawful basis is legitimate interest. We may share these anonymous event records with a third-party analytics processor (PostHog Inc., US region) so we can chart them; that processor receives nothing beyond the anonymous records described here, and no page of this site ever contacts it.

The skills you buy

The skills are text files that run on your own computer, inside your own agent.

Your textbooks, your lesson material and anything identifying your students stay on your own machine. They are never uploaded to us. We have no server that receives them, no account to sync them to, and no telemetry in the package. The skills make no network requests of their own. You still need the internet while they run, because your agent talks to its model.

We therefore never see, store or process student personal data. There is no processing agreement to sign with us, because we act as processor for nothing.

One thing to be clear about: your agent and its model are a separate product from a separate company. Whatever you type into that agent goes to whoever provides it, under their terms. That is true whether or not you use our skills. Check your agent’s data policy — and where your school requires it, use a setting or deployment that keeps material local.

Our security page sets out the same claims item by item, with the checks you can run yourself to confirm them.

When you email us

If you email us, we receive your email address, whatever you write, and any attachment you send. We use it to answer you, and — if you buy directly — to issue your invoice and send your download link. Our lawful basis is performance of a contract, or legitimate interest in replying to an enquiry.

Please do not send us student names, photographs or schoolwork. We do not need them to support you, and we would rather not hold them. If you send them by accident, tell us and we will delete them.

Email lives in our mailbox with our email provider, which processes it on our behalf as a service provider. We share it with nobody else, sell it to nobody, and send no marketing.

Retention. Correspondence that forms part of a sale — invoices, payment records and the emails that document them — is kept for six years after the end of the accounting period, as UK company and tax record-keeping rules require. Other correspondence is deleted once the matter is closed and there is no longer a reason to keep it.

When you buy

If you buy through our hosted checkout, Polar takes your payment as merchant of record and is the controller of the data you give at checkout. Their privacy policy governs that. We receive the order details we need to deliver your purchase — your email address and what you bought — never your card details.

If you buy directly from us, we invoice you by email and take payment through a regulated payment provider. We never see or store your full card number — the provider handles it. We keep the invoice and the transaction reference for the six-year period above.

Your rights

Under the UK GDPR and the EU GDPR you have the right to:

• Access the personal data we hold about you, and get a copy
• Rectification — have inaccurate data corrected
• Erasure — have data deleted, except where we must keep it for tax records
• Portability — receive your data in a machine-readable form
• Restriction of, and objection to, processing based on legitimate interest
• Withdraw consent at any time, where processing rests on consent

To exercise any of these, email crossxtop@gmail.com. We respond within one month, as the GDPR requires, and we do not charge for it.

Transfers outside the UK and EEA

We are based in the United Kingdom. Our email and payment providers may process data outside the UK or EEA, under the safeguards the GDPR requires for such transfers — an adequacy decision or standard contractual clauses.

Complaints

If you think we have handled your data wrongly, tell us first and we will try to put it right. You also have the right to complain to a supervisory authority.

In the UK that is the Information Commissioner’s Office (ICO) — https://ico.org.uk. If you are in the EU, you may complain to the supervisory authority in your country of residence.

Changes

If this policy changes, the date at the top of this page changes with it.