Privacy Policy

1. Who we are

Xenia is a business travel and spend platform at onxenia.com. Companies ("customers") use Xenia to let their employees and guests book travel, get bookings checked against company policy, submit expenses, and reconcile spend. This policy explains what personal data we collect through the platform, why, and what rights you have over it.

For anything to do with privacy — a question, a request, a concern — write to privacy@onxenia.com.

2. What we collect

What we hold depends on how your company uses Xenia, but broadly it falls into these categories:

• Account and traveller profile data — your name, work email, role, and any traveller preferences you or your company add, including a home address if you choose to provide one.
• Booking and trip data — the flights, hotels, and other travel you search for, are quoted, and book, along with the itineraries and confirmations that result.
• Expense and finance data — expenses, receipts, and card-statement data your company submits or connects, and the approvals and coding applied to them.
• Support conversations — messages you send us through in-app support, email, or the contact form, and our replies.
• Usage and log data — how the platform is used, and technical logs needed to keep it running securely (device/browser information, timestamps, error data).

3. Why we collect it

We use personal data to:

• Provide the travel booking and expense services you and your company use Xenia for;
• Enforce the travel and spend policy your employer has configured, and run the approvals that policy requires;
• Provide support when you ask for it;
• Protect the platform — detecting and preventing fraud, abuse, and security incidents;
• Meet our legal and regulatory obligations, including finance and audit record-keeping.

4. Who we share it with

We share the minimum needed to make the service work, and we do not sell personal data.

• Travel suppliers — to fulfil a booking, the relevant details go to the supplier making it happen: airlines and hotels, via booking platforms such as Duffel.
• Cloud infrastructure — Xenia runs on Amazon Web Services (AWS), including AWS's email delivery services for sending confirmations and notifications.
• Your employer's organisation — if you use Xenia through your employer, your organisation is the controller of its own tenant's data. Xenia processes that data on the organisation's behalf and under its instructions (for example, which policy to enforce, or who approves your expenses) — we don't decide those things ourselves.

We do not sell personal data to anyone, for any purpose.

5. Calendar integrations

Xenia can connect to your Google Calendar or Microsoft 365 calendar to help suggest trips based on events that look like travel. This section explains exactly what that means.

• Read-only, per-user, and only with your explicit consent. Xenia never writes to your calendar, and a connection is made by you, for you — never switched on for you by your organisation without your say-so.
• We store only travel-relevant facts, not your calendar. When you connect a calendar, Xenia looks at events that appear to involve travel and derives and stores only what it needs to suggest a trip: the event title, its location, and its start and end times. We do not keep a copy of your calendar, and we do not read or store events that don't look travel-related.
• Never used for advertising, and never sold. Calendar-derived data is used solely to suggest trips inside Xenia. It is not used for advertising, profiling, or any purpose beyond the feature itself, and it is never sold or transferred except as needed to provide that feature to you.
• Disconnecting removes it. If you disconnect a calendar integration, the calendar-derived data we stored for it is removed.

6. How long we keep it

We keep personal data for as long as your account or your organisation's Xenia tenant is active, and for as long afterwards as we're required to for finance and audit obligations (for example, keeping booking and expense records for the periods tax and accounting law requires). If you ask us to delete your data, we will do so once we've verified the request, subject to those same obligations — we can't delete a financial record earlier than the law allows us to.

7. Your rights

Under UK and EU data protection law, you have the right to:

• Access the personal data we hold about you;
• Correct it, if it's inaccurate or incomplete;
• Delete it, subject to the retention obligations described above;
• Receive a copy of it in a portable format;
• Complain to your data protection authority — in the UK, the Information Commissioner's Office (ICO), or your local equivalent elsewhere.

If you use Xenia through an employer, some requests (for example, deleting a booking record your organisation needs for its own accounts) may need to go through your organisation, since they control that data. We're happy to help either way — write to us and we'll point you in the right direction.

8. Changes to this policy

This policy is effective from 7 August 2026. If we make a material change to how we handle personal data, we'll announce it — through the platform, by email, or on this page — before it takes effect.

9. How to contact us

For anything to do with this policy or how we handle your data, write to privacy@onxenia.com. For everything else, our general contact is info@xenia-ai.net or the contact form.