Privacy policy

Who this document is about

Xalant is a venture that is still being formed. This website is published by the people building it, and the footer names Eight Galaxies LLC as the copyright holder. Which legal entity will operate Xalant, and therefore which entity is responsible for the information described below, is not yet settled.

Because of that, this document names no company as the controller of your information, gives no registered address and names no data-protection officer. Those are left blank on purpose, and they are filled in when the entity is confirmed — not before.

What happens when you only read

Nothing is collected and nothing is stored in your browser when you read a page on this site. No cookie is set, by us or by anyone else.

Every typeface is served from this domain, so there is no web-font request to a third party. There is no tracking pixel, no embedded map, no social widget, no comment system and no advertising of any kind anywhere on the site.

The one thing this site stores in your browser

The footer carries a Motion toggle. If you press it, your choice is written to your browser's local storage under the key x-motion so that the site remembers it on your next visit.

That value never leaves your browser, is never sent to a server and identifies nothing about you. Clearing site data for xalant.net removes it.

What the contact form asks for

The form on the contact page asks for your name, your email address, your company name and your message. A phone number is optional. You also choose what your enquiry is about, and that choice adds a small number of qualifying questions — a market, a rough capacity, a timeline.

Two things are sent with the form that you do not type. The first is a short signed timestamp, issued when the page loads, which is used only to measure how long the form was open before it was submitted; it contains no identifier and is not a cookie. The second is a hidden field that real people leave empty and automated submitters tend to fill in.

Where a submission goes today

Today, nowhere. A submission is written to a file on the server that runs this site and printed to that server's log. No email is sent, and no third-party service receives it. The confirmation page says "recorded" rather than "sent" for exactly that reason.

Email delivery is written and ready behind a single configuration switch. When it is turned on, the message is passed to Resend, an email delivery provider, which processes it in order to deliver it. This section is updated in the same change that turns it on, so the page cannot describe a provider that is not yet receiving anything.

Analytics

No analytics script is served on this site today, and no measurement request leaves your browser.

The two products intended for it are Vercel Analytics and Vercel Speed Insights. Both are cookieless and report aggregate page and performance figures rather than individual behaviour. The site's content-security policy already permits their hosts, so switching them on is a configuration change — and this section is updated in that same change.

Bot protection on the form

The contact form has a bot check built around Cloudflare Turnstile, which is a challenge that does not ask you to solve a puzzle and sets no advertising cookie.

It is not enabled today: the check passes locally and no request is made to Cloudflare. When it is enabled, the widget loads from challenges.cloudflare.com on your first interaction with the form rather than when the page loads, and Cloudflare receives your network address and a challenge token as part of performing the check.

The industry news feed

The industry pages show headlines published by independent trade outlets. The fetching happens on our server, on a schedule, from a fixed list of feeds held in this repository. Your browser makes no request to those outlets while you read the page, and no image is loaded from them.

Following a "Read at" link takes you to the outlet's own page, where their privacy notice applies and ours stops. Those links carry rel="noopener nofollow".

Server logs

The hosting platform keeps short-lived request logs that include your network address, the page requested and your browser's user-agent string. They exist so that errors can be found and fixed.

A retention period for those logs is one of the items the legal review below has to settle, and it is not stated here until it is real.

How long information is kept

A contact submission is kept until it is deleted by hand. There is no automatic deletion schedule yet, and writing one is part of the review this document is waiting on.

If you would rather we did not keep your message, say so in it, or write to the address below and ask.

Asking what we hold, and asking us to delete it

Write to info@xalant.net. You can ask what information we hold about you, ask for a copy of it, ask us to correct it or ask us to delete it, and we will do that.

A named data-protection contact and a route to a supervisory authority both depend on the operating entity and the governing law, neither of which is confirmed. Until they are, the address above is the only one, and it reaches the people building this.

Children

This site is aimed at people evaluating infrastructure, not at children, and we do not knowingly collect information about anyone under the age this would apply to in whichever jurisdiction ends up governing it.

Changes to this document

The date at the top of this page is the date it last changed. When the review is finished and the entity is confirmed, the draft notice at the top of the page goes away and the blanks listed below are filled in.

What is deliberately blank

Each line below is a question that has not been answered yet. None of them is filled in with a placeholder, an example or a guess, because a wrong company name or a wrong governing law in a document like this is worse than an obvious gap.

• The operating entity responsible for the information described here, and whether that is Eight Galaxies LLC or another company.
• A registered address and a company registration number.
• A named data-protection contact, and whether a statutory data-protection officer is required at all.
• The governing law, and with it which statutory rights and which supervisory authority apply.
• Retention periods for contact submissions and for server logs.
• Whether a transfer mechanism is needed for information that leaves the United States.