Privacy Policy

This Policy explains how XFACTOR handles personal and organizational data in the XFACTOR COMMANDCENTER platform (the “Service”).

What we collect. Account details (name, work email, organization, role), the supply-chain, compliance, and assessment data you enter or upload, and operational logs (sign-in events, IP, and actions taken) used to secure the platform.

How we use it. To provide and secure the Service, run assessments and reporting for your organization, authenticate you (including the emailed sign-in code), and meet legal and contractual obligations. We do not sell your data.

Authentication data. Sign-in codes are sent to your email and stored only as a short-lived, single-use hash; passwords are managed by our authentication provider and never stored in plaintext.

Retention & your rights.Data is retained for the life of your service agreement and as required by law. You may request access, correction, or deletion through your organization’s administrator or XFACTOR.

Specific data-processing terms are set out in the service agreement between XFACTOR and your organization; this page summarizes platform privacy practices and does not replace it.