Privacy noticePrivacy notice

It covers the public website, the contact and Work with XS1 forms, operator sign-in for XS1 staff, and email sent from the site.

Contracted engagements and research partnerships are covered by the written agreement for that work, which takes precedence where it differs from this notice.

We only collect what you type into a form and choose to send.

When you send a form, the submission is stored in XS1's project database and emailed to the XS1 team inbox so a person can read it and reply. Your email address is set as the reply-to address, so our answer comes straight to you.

Operator login is for XS1 staff only. Accounts are issued by XS1; there is no public sign-up. For each account we hold the sign-in email, a display name, an optional recovery email, the account's role, and authentication records, including two-factor settings where they are enabled.

When an operator signs in, a session token is kept in that browser's local storage so they stay signed in. Signing out removes it.

The site sends transactional email only: notifications to XS1 about new submissions, account emails for operators such as invitations and password links, and messages XS1 staff send from the site. There is no newsletter or marketing list.

Each email is logged — recipient, message type, delivery status and time — so we can confirm it arrived. Emails include an unsubscribe link. If you use it, your address goes on a suppression list and the site stops emailing it; operators may still receive essential account emails, such as sign-in links.

Like any website, the site's hosting provider records standard request logs — IP address, browser details, the page requested and the time — to deliver the site and protect it from abuse. If a page fails to load, a technical error report (the error and the page it happened on) may be sent to the hosting platform so the problem can be fixed.

The site's fonts are loaded from Google Fonts, so your browser connects to Google's servers, which receive your IP address and browser details.

We do not use analytics or advertising cookies, tracking pixels, or third-party advertising.

The public site does not set cookies. It uses your browser's own storage for two small conveniences, and one more if you are an operator:

Inside the operator area the browser also keeps a few interface preferences. You can clear all of this at any time in your browser settings.

• To read and reply to your message or request, and to decide with you whether and how XS1 can help.
• To scope, propose and run contracted work or a research partnership, if we go ahead together.
• To run operator accounts and keep them secure.
• To deliver, secure and fix the website.
• To meet our legal obligations.

We do not sell personal information, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.

If you are in the European Economic Area or the United Kingdom, our legal bases are: our legitimate interests in answering inquiries and running a secure website; taking steps you ask for before entering a contract; your consent, where we ask for it (you can withdraw it at any time); and legal obligations.

We share information only with the service providers that run the site for us — website hosting, the project database, email delivery and font delivery — under terms that limit their use of it to providing their service.

We may also disclose information when the law requires it, to protect people's safety or XS1's rights, or as part of a merger or acquisition, in which case this notice continues to apply to it.

Some providers may process information outside your country. Where the law requires it, we rely on recognized safeguards, such as standard contractual clauses.

• Form submissions: kept for as long as we need them to respond and follow up, and for any longer period a resulting agreement or the law requires, then deleted.
• Operator accounts: kept while the account is active and for a limited period after access ends.
• Email logs and the suppression list: kept so we can confirm delivery and keep honoring unsubscribe requests.
• Hosting logs: kept by the hosting provider for its standard retention period.

Depending on where you live, you may have the right to access the information we hold about you, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent. You can also complain to your local data-protection authority — we would appreciate the chance to help first.

To make a request, use the contact form and choose Privacy request. Tell us what you would like us to do and which email address it concerns. We acknowledge requests within 1–2 business days and respond within one month. We may need to confirm it is you before acting.

The site is served over HTTPS. Submissions and operator data are stored with access controls and are available only to XS1 staff who need them. No system is perfectly secure; if you think you have found a vulnerability, please follow our vulnerability disclosure policy.

The site is not directed at children, and we do not knowingly collect information from anyone under 16.

We update this page when the way the site handles information changes, and change the effective date at the top. Significant changes are called out on this page.

Use the contact form and choose Privacy request. We reply within 1–2 business days.