Privacy Policy
This policy explains what Xpactio reads, stores and shares. Xpactio is an app for Attio that creates documents in Xero. It is operated by VentuRise LLC, a Wyoming limited liability company (filing ID 2026-002092905, 30 N Gould St Ste R, Sheridan, WY 82801, USA), at xpactio.com.
What Xpactio reads
- From Xero, through Xero’s API: invoices, quotes, purchase orders and credit notes, with their line items, amounts, dates and statuses; contacts with names, email and postal addresses; the organisation’s ID, name and base currency; branding themes; invoice PDFs when you attach one.
- From Attio: the records you create documents from, the attributes you map in Xpactio settings, the settings themselves, and your workspace ID and name.
- From you: if you create an Xpactio account to pay for Pro, your email address and a password. Stripe handles payment details; we never see card numbers.
What we use it for
- Creating, reading and updating documents in your Xero organisation when you or your workflows ask.
- Writing document numbers, statuses, links and errors back to your Attio records.
- Counting documents each month to apply your plan’s limit.
- Running the nightly sync and forwarding Xero’s change notifications on Pro.
- Billing and account emails.
We don’t sell or share your Xero or Attio data for advertising, analytics or any purpose other than running Xpactio.
Where your data lives
The Xpactio app runs inside your Attio workspace. Line items, amounts and customer details pass from Xero to Attio through the app; they are not copied to our servers. Your Xero sign-in is kept in Attio’s connection store, encrypted by Attio. We never receive your Xero password.
Our own service (Vercel and Neon Postgres) stores only:
- your Attio workspace ID, the Xero organisation ID it is connected to, and the address Xpactio uses to reach the app in your workspace;
- an Attio access token for your workspace, encrypted with AES-256-GCM;
- your plan, Stripe customer and subscription IDs, and the number of documents created each month;
- a log of workflow runs: record ID, Xero invoice ID, status and error text;
- a map from Xero invoice IDs to Attio record IDs, and Xero contact IDs with contact names, to keep both sides in step;
- for Xpactio accounts: email, a password hash, sign-in sessions, and sign-in attempts with email and IP address, to block password guessing.
The site sets a sign-in cookie for Xpactio accounts and a 10-minute cookie during installation. It uses no advertising or analytics cookies.
Sub-processors
- Attio — runs the app and stores the Xero connection
- Xero — the accounting data Xpactio works with
- Vercel — hosts this site and Xpactio’s API
- Neon — the database listed above
- Stripe — subscriptions and payments
- Resend — account emails
Security
All traffic between Attio, Xero, Stripe and Xpactio uses TLS. Requests between the app and our service are signed and expire after five minutes. Secrets are kept in environment variables and never written to logs.
Disconnecting and deletion
When you remove the Xero connection in Attio, Xpactio stops calling Xero for your workspace. Uninstalling the app removes its settings from Attio. Attributes and records Xpactio created in Attio stay until you delete them, and documents created in Xero stay in Xero.
To delete everything we store about your workspace, email help@xpactio.com. We delete it within 30 days.
Children
Xpactio is a business tool and is not directed at children under 16. We don’t knowingly collect their data.
Changes
We may update this policy. We email account holders about material changes. Using Xpactio after a change means you accept the updated policy.
Contact
Questions and deletion requests: help@xpactio.com.