Last updated: August 22, 2026
XelzStudio ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect and handle information when you use our developer tools.
We strictly limit the data we collect to what is necessary to operate XelzStudio. Depending on how you sign in, we may collect and store your name, email address, Google profile picture, account tier, daily quota information, and premium status.
If you create an account using email and password, your password is never stored in plain text. It is processed using a one-way cryptographic password hash before being stored. We cannot retrieve your original password from that hash.
For email verification, we generate a temporary one-time password (OTP). The OTP is used only to verify ownership of your email address, expires automatically, and is not intended for permanent storage.
XelzStudio supports Google authentication and email/password authentication. Email verification messages and OTP codes may be delivered through a third-party transactional email provider such as Brevo. This means your email address and the technical information required to deliver the message may be processed by that provider solely for email delivery and security purposes.
We apply security controls such as password hashing, short-lived OTP verification, rate limiting, and secure session handling. However, no internet-based service can guarantee absolute security.
XelzStudio acts as a passthrough processing service:
If you choose to upgrade, payments are processed securely via Midtrans and PayPal. We never see, collect, or store your credit card, PayPal account credentials, or sensitive financial information. Data processing related to payments is subject to the respective privacy policies of Midtrans and PayPal.
We do not use tracking cookies for marketing. Authentication sessions may use secure cookies or other necessary browser storage solely to keep you signed in and protect your account. Where supported, session cookies are configured with security protections such as HttpOnly, Secure, and SameSite attributes.
Account information is retained while your account remains active or as reasonably necessary to operate the service, prevent abuse, resolve disputes, and meet legal obligations. Expired OTP verification data is not intended to be retained longer than necessary for verification and security purposes.
You are responsible for keeping your password confidential and for notifying us if you believe your account has been accessed without authorization.
For data deletion requests or privacy inquiries, contact us via our official community Discord or email us at privacy@xelzstudio.my.id.