Privacy Policy

Your privacy is one of our fundamental commitments at October Software ApS (referred to as “October Software” or “we”) and we will make our best efforts to protect your personal data.

This is why we take great care when we process your personal data in accordance with the principles set forth in the data protection legislation applicable in Denmark, including EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”). Personal data represents any information relating to an identified or identifiable natural person, and an identifiable person is that person that may be identified directly or indirectly, particularly by reference to an identification number or to one or more factors specific to its physical, psychological, mental, economic, cultural or social identity.

This privacy policy regards the personal data of our clients, business partners, other persons contacting and visiting us and of the representatives thereof, potential employees, interns or associates and it applies to data collected through our website, www.xerreader.com, as well as to all other personal data we collect through e-mail or other off-line contacts. The privacy policy describes:

• the purposes for which we collect and use your personal data;
• the processing grounds for such purposes;
• the categories of personal data we collect from you and process;
• the duration of processing and storing of such data;
• your rights as data subjects and the manner in which you may exercise them;
• to whom we may disclose your personal data

1. PURPOSES, GROUNDS FOR PROCESSING AND CATEGORIES OF PERSONAL DATA

In the context of your interaction with October Software, you, as a natural person, may be subject to the data processing activities that we perform. Thus, we use your personal data in the following cases:

If you are a client or potential client of October Software:

1.1 Providing the services requested from us
We use your relevant personal data in order to prepare and provide the services you requested from us.

1.2 Communicating with you
We use your contact details in order to communicate with you with respect to your requests and any other relevant business-related matters in connection to your requests.

1.3 Emails we send you
The emails we send are the ones needed to run your account. They are: confirming your email address when you create an account; resetting your password when you ask us to; confirming a request to delete your account; telling you when more people are opening your shared schedules than the allowance included in your subscription; and replying to you when you contact us.

These are part of providing the service rather than something you subscribe to, so there is nothing to unsubscribe from.

The categories of data processed in the context of our relationship with you are:

• For account registration, authentication, and service provision (points 1.1 and 1.2): your name, email address, password hash, IP address, the country derived from your IP address, device identifier (GUID), device name, operating system platform type, and any correspondence you send to us;
• For the account emails described in point 1.3: your name and email address;
• For user-initiated cloud sharing (point 1.5): the schedule database file and workspace layout that you deliberately choose to upload;
• For visitors opening shared schedule links (point 1.6): your IP address, the country derived from it, your browser type, a device identifier, and two identifiers computed in your browser from the characteristics of your browser and device, as described in point 1.6.

Once you become a client and are running our software, we record the IP address you sign in from as part of each login record. This lets us see how many people are using an account and identify use beyond what a licence allows. How long login records are kept is set out in section 4 below.

When an update of our software is available, we receive from the software the type of the operating system you use in order to make sure that a Windows user is not receiving the new version in Mac format. Such data is not stored or processed in any other way, but only at the time of update and for the stated purpose.

Schedule files and local processing:

1.4 Local schedule parsing and project data privacy
During standard use of XER Reader (whether using the native Windows or macOS applications or the browser-based Web App via WebAssembly), your schedule files (including .xer, .mpp, and .xml files) are parsed, analyzed, and visualized entirely in memory on your local device. Your schedule files and proprietary project data never leave your computer and are never uploaded to, inspected by, or stored on October Software servers.

1.5 User-initiated cloud sharing and BI Connect
Your schedule data reaches our servers only when you choose to send it, and there are three ways that happens. If you publish a schedule using XER Reader Cloud, such as creating an interactive web schedule link, the converted schedule database is uploaded together with the workspace layout it was viewed with, because the grouping, sorting and column settings are what allow your recipients to see the schedule as you arranged it. If you connect an external reporting tool using BI Connect, the converted schedule database is uploaded so that tool can read it. If you save a workspace layout to your account, that layout alone is uploaded, so you can apply the same arrangement on your other devices; no schedule data is sent with it. Storing schedule data on our servers is entirely your call and action. You maintain full ownership and control over shared schedule data, and you can modify, password-protect, or permanently delete shared schedules and cloud layouts from our servers at any time through the application.

If you open a schedule that someone has shared with you:

1.6 Serving and protecting shared schedule links
A customer using XER Reader Cloud can publish a schedule and share it as a browser link. You do not need an account with us to open such a link. When you do open one, we record your IP address, the country we derive from it, the type of browser you are using, and a device identifier. We also compute two identifiers from the characteristics of your browser and device, which let us recognise the same browser when it opens the link again. Those characteristics include how your browser draws graphics, how it processes audio, which fonts are available to it, your screen size and colour depth, your timezone and language, and the processing capability your device reports.

Those characteristics are examined in your browser. They are not sent to us and we do not store them. What reaches our servers is the two resulting identifiers, which cannot be turned back into the underlying details.

We process this data in order to serve the shared schedule to you, to count how many distinct people have opened a given link so that the shared user allowance included in our customer's subscription can be applied, and to detect links being circulated beyond the audience our customer intended. We do not use these identifiers for advertising, for profiling, or to recognise you on any other website. A cookie would not serve this purpose, because it is cleared or absent in exactly the situations the allowance needs to cover.

The ground for this processing is our legitimate interest, and that of the customer who shared the schedule with you, in operating the sharing service within the limits that customer has paid for and protecting it from misuse.

A shared schedule will not open in a private or incognito browser window, because these identifiers cannot be established there. If that happens, open the link in an ordinary browser window instead.

The schedule content itself belongs to the customer who published it, not to us. In respect of that content we act on that customer's instructions, and you should contact them directly with any request concerning it.

Cookies

When you sign in to our website we set a session cookie so that you stay signed in as you move between pages. This cookie is strictly necessary for the service to function, it is not used for advertising, and we do not use it to track you across other websites.

2. PROVIDING THE PERSONAL DATA

When the data is required directly from you, October Software kindly asks you to provide all categories of personal data we request in the aforementioned purposes, as otherwise we shall not be able to carry out our activity (including, among others, to provide you with our services).

If you provide to October Software the personal data of other natural persons, we kindly ask you to communicate to them and receive their approval before such disclosure the modality in which October Software intends to process their personal data, as described in this Privacy Policy.

3. DISCLOSURE OF YOUR PERSONAL DATA

We do not sell your personal data, and we do not share it with anyone for their own marketing or advertising purposes.

We use a small number of service providers who process personal data on our behalf. Each acts only on our instructions, only for the purpose set out below, and may not use your data for its own purposes:

• Payment processing. Subscription payments are processed by Stripe. Your card details are transmitted directly to Stripe and are never received or stored by us. We hold only a customer reference and the status of your subscription.
• Hosting and storage. Our servers and object storage are operated by an infrastructure provider. Account records, workspace layouts and shared schedule files are stored within the European Economic Area.
• Email delivery and mailboxes. Account confirmations, password resets, account deletion codes and correspondence with us are handled through our email hosting provider.

Apart from those providers, we may:

• disclose your contact details to our affiliates within October Software, only after obtaining your express consent in this respect;
• if in your interest and necessary, disclose relevant personal data to courts of law and arbitration panels or relevant authorities.

4. DURATION OF PROCESSING

We intend to keep your personal data for the duration of the commercial agreement, as well as afterwards, according to our internal policies and the legal obligations incumbent upon us according to the Danish law.

If you hold an account with us, your account and the data stored in it are kept for as long as that account exists. We do not delete them when a subscription ends, is cancelled or lapses, because people who subscribe again expect to find their schedules and layouts where they left them. Ending a subscription ends your access to the software; it does not remove what is stored.

Deleting your account is what deletes that data. You can delete your account yourself at any time, and doing so permanently removes the schedules, workspace layouts and shared schedule databases we hold for you. This cannot be undone.

When an account is deleted we keep one record of the deletion, holding a one-way hash of the email address together with the payment provider's customer reference. We keep it to apply our rule that a free trial is available once per email address, and to complete the removal of the account at our payment provider. The hashed email address is erased automatically two years after the deletion. The hash cannot be reversed to recover the email address.

In case the data is not collected in the context of a commercial agreement, such data will be kept for as long as necessary in order to attain the purpose of the data collection. If the law does not provide otherwise, we shall process your personal data for a period of 3 years, afterward being immediately deleted from our records.

5. YOUR RIGHTS

In your capacity as data subjects, the GDPR provides you with a series of rights including:

• the right of access – allowing you to obtain confirmation that your personal data is being processed by us and, if affirmative, the relevant details of such processing activities;
• the right to rectification – allowing you to rectify your personal data if inaccurate;
• the right to erasure (right to be forgotten) – allowing you to obtain the erasure of your personal data in certain cases (e.g., if the data is no longer necessary in relation to the purposes for which it was collected);
• the right to restriction – allowing you to obtain the restriction of processing your personal data in certain cases (e.g., when you contest the accuracy of your personal data, for a period enabling us to verify such accuracy);
• the right to object – allowing you to object to further processing of your personal data within the conditions and limits set forth by law;
• the right to data portability – allowing you to receive the personal data concerning you that you have provided to us, in a structured, commonly used and machine-readable format or to transmit this data to another data controller.

These rights concern the personal data we hold about you, such as your name, email address, account details and the record of your sign-ins. They do not extend to the schedule files and workspace layouts stored in an account, which are the account holder’s business records rather than personal data about the person asking, and which are governed by the End User License Agreement. Where a schedule has been shared with you by one of our customers, that customer decides what happens to it, and you should direct any request about its content to them.

We are happy to ensure your exercise of these rights. You may exercise your aforementioned rights and find out more about such rights by filing with us, as data controller, a written request at Automatikvej 1, 2860 Søborg, Denmark or by e-mailing us at info@xerreader.com. We shall review your request and reply within a 30 days term.

We are committed to always treat your requests with the utmost attention and address any queries you may have in the shortest time possible.

6. SAFETY OF YOUR DATA AND PAYMENT SECURITY

For preventing unauthorized access or disclosure and for assuring the proper use of your data, we maintain reasonable and appropriate physical, technical, and administrative safeguards to protect the data we collect and process. We retain data only in accordance with applicable laws and for as long as processing has a legitimate purpose.

Payment Processing
All payment transactions and subscription billings are processed securely by Stripe, a certified PCI-DSS Level 1 payment service provider. When you subscribe or make a payment, your credit card details (such as card number, expiration date, and CVC) are transmitted directly to Stripe over encrypted connections. October Software never collects, receives, processes, or stores your credit card details on our servers. We store only a Stripe customer identifier and subscription status metadata required to maintain and verify your software license.

Data Storage Location
All account records, cloud layouts, and user-shared schedule files are securely stored within the European Economic Area (EEA) using certified cloud infrastructure and European object storage providers complying with EU GDPR standards.

7. VERSIONS TO THIS PRIVACY POLICY

This Privacy Policy is in force as of March 2026.

This Privacy Policy may be updated from time to time. Any updates will become applicable within 15 days as of the publication of the new version on October Software’s website.