Privacy Policy

GEXCAP INC · Version 1.0 · Effective 2026-08-23

This policy explains what personal data XEMX collects, why, and what you can do about it. XEMX is in beta; where a feature is still changing, this policy says so.

1. Who is responsible

GEXCAP INC, 2423 SW 147th Ave, #4006, Miami, FL 33185-4082, United States, is the controller of the personal data described here.

Contact: m.iorgu@gexcap.com

EU representative under GDPR Article 27: [TO BE APPOINTED]. If you are in the EU and this line still says "to be appointed", write to the address above and say so — it is an obligation we owe you.

A Host is a separate, independent controller of the personal data they receive about their Guests. What a Host does with it is governed by their own obligations, not by this policy.

2. What we collect

When you create an account — name, email address, password (stored hashed, never in readable form), and optionally a photograph and phone number.

When you list a Property — the address, coordinates, description, photographs, price, availability, any licence number you enter, and bank details you give us for payouts.

When you book — the dates, the number of guests, any message to the Host, the amount, and the payment record.

When you use the site — pages viewed, searches, saved searches and favourites, and the cookie choices you made.

When you write — messages between Hosts and Guests, reviews, and anything you send our support.

When you ask the AI Concierge — the question you typed and the conversation before it.

Technical data — browser type, language, and an approximate location. We never store your full IP address. We keep a truncated prefix and a salted hash of it, which lets us estimate country and detect abuse without holding the address itself.

3. Why, and on what basis

• To provide the Platform and your bookings — because we need to, to perform our contract with you.
• To take and remit payment — contract, and legal obligation for records.
• To keep the Platform safe — fraud prevention, abuse detection, security. Our legitimate interest in a Platform that is not used to defraud people.
• To answer support and complaints — contract and legitimate interest.
• To meet legal and tax obligations — legal obligation.
• Analytics — only with your consent, given through the cookie banner.
• Marketing email — only with your consent, which you may withdraw at any time.
• AI features — to answer your question or draft your listing text, as part of providing the Platform.

4. Who we share it with

With the other party to a booking. A Host sees the Guest's name and message when a request is made, and contact details once confirmed. A Guest sees the Host's name and, on confirmation, the address.

With service providers who process data for us, under contract: hosting and infrastructure; email delivery; SMS delivery, where enabled; payment providers, when a payment method is enabled; mapping; and AI providers.

With AI providers. Questions you put to the Concierge, and listing text you ask us to draft, are sent to a third-party model provider. Do not put personal, financial or confidential information into the Concierge.

With authorities where the law requires, and with advisers where necessary to establish or defend a legal claim.

We do not sell your personal data.

5. Transfers outside the EEA

We are a US company, so your data is processed in the United States, and some providers are also outside the EEA.

Where the GDPR applies to you, transfers rely on [TRANSFER MECHANISM — STANDARD CONTRACTUAL CLAUSES / ADEQUACY — TO BE CONFIRMED]. If you want details of the safeguards, write to m.iorgu@gexcap.com.

6. How long we keep it

• Account data — while your account exists, then deleted or anonymised, except where we must keep it.
• Bookings and payments — kept for as long as accounting and tax law requires, which may be several years after the stay.
• Messages — while the account exists.
• Reviews — reviews stay published after an account closes, but are detached from the closed account.
• Analytics events — 14 months.
• Consent records — kept as evidence that consent was given, with its version.

7. Your rights

Where the GDPR applies you have the right to access your data, to correct it, to erase it, to restrict or object to processing, to portability, and to withdraw consent at any time without affecting what was done before.

Two of these are built in: you can export your data and delete your account from Account → Security. Deletion removes or anonymises what we are not required to keep, and tells you what was retained and why.

You may complain to a supervisory authority. In Malta that is the Office of the Information and Data Protection Commissioner (IDPC).

If you are in California or another US state with its own privacy law, you may have equivalent rights; write to m.iorgu@gexcap.com.

8. Cookies

See the Cookie Policy. Strictly necessary cookies keep you signed in. Analytics and marketing run only if you agree, and you can change your mind from the "Cookie settings" link in the footer.

9. Automated decisions

We do not make decisions with legal or similarly significant effects about you by automated means alone.

The Platform uses AI to rank search results, to suggest prices to a Host and to answer questions. None of that decides whether you may book, and no AI decides whether to accept or decline a booking — that is the Host's decision.

10. Children

The Platform is not for anyone under 18 and we do not knowingly collect data about children. If you believe we have, write to m.iorgu@gexcap.com and we will delete it.

11. Security

Passwords are hashed. Credentials for third-party services are encrypted before they are stored. Administrative actions are logged. Traffic is served over HTTPS.

No system is perfectly secure, and the Platform is in beta. If you find a security problem, please tell us at m.iorgu@gexcap.com before telling anyone else.

12. Changes

We will publish any new version with its date, and will tell you about a material change before it takes effect.