Privacy Policy

Who we are

oxsholdings.com is the website of OXS Holdings and is operated by OXS Corp, a company registered in Wyoming, United States (“OXS Corp”, “we”, “us”). For visitors in the European Economic Area, the United Kingdom or Switzerland, OXS Corp is the controller of the personal data described here under the General Data Protection Regulation (“GDPR”) and its UK and Swiss equivalents.

For any question about this policy or your personal information, email privacy@oxsholdings.com.

What this policy covers

This policy covers oxsholdings.com only. Kointage (kointage.com), Caildus (caildus.com) and Earvance (earvance.com) have their own websites, accounts and policies. When you use one of them, its own privacy policy applies, not this one.

What we collect

• When you contact us. If you write to us through the contact form, we receive your name, email address, organization (optional), the inquiry type you choose and your message. If you email us directly, we receive your email address and whatever your email contains. Please don’t include sensitive information, such as health data or government identification numbers, in your message.
• When you visit. Our hosting provider processes the technical data needed to deliver pages securely: IP address, browser and device type (user agent), the page requested, the referring page, and the date and time of the request.
• Spam protection. The form contains a hidden field people don’t see and checks how quickly it was filled in. Your IP address is held in server memory for up to 10 minutes to limit repeated submissions. If Cloudflare Turnstile is enabled on the form, Cloudflare processes technical signals from your browser — such as IP address, TLS fingerprint and user agent — to tell people from bots.

We don’t offer accounts or take payments here, we don’t use analytics, advertising or tracking pixels, and we don’t build profiles. We don’t buy personal information or receive it from data brokers.

How we use it

We use personal information only for the purposes below. For visitors covered by the GDPR, the legal basis follows each purpose.

• Reading and replying to your message, and following up where you ask us to — for example on a partnership, media or investment inquiry. GDPR: Art. 6(1)(b), steps taken at your request before entering into a contract; otherwise Art. 6(1)(f), our legitimate interest in answering inquiries.
• Delivering the website and keeping it secure, including protecting the contact form from spam and abuse. GDPR: Art. 6(1)(f), legitimate interest.
• Complying with legal obligations and lawful requests from public authorities. GDPR: Art. 6(1)(c), legal obligation.
• Establishing, exercising or defending legal claims. GDPR: Art. 6(1)(f), legitimate interest.

We don’t use your information for marketing, and we don’t make decisions about you based solely on automated processing that produce legal or similarly significant effects.

Cookies, browser storage and tracking

This website doesn’t set cookies. Its fonts and scripts are served from our own domain, and it doesn’t load third-party analytics, advertising or social media trackers.

We keep one item in your browser’s session storage, oxs:intro, so the opening animation on the home page plays only once per visit. It contains no personal information and is deleted when you close the tab.

If Cloudflare Turnstile is enabled on the contact form, Cloudflare may use strictly necessary cookies or similar technologies on that page to detect bots, as described in its Turnstile Privacy Addendum.

Because we don’t track visitors over time or across other websites, there is nothing to opt out of: the website works the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.

Who receives your information

We don’t sell personal information, and we don’t share it for cross-context behavioral advertising. We disclose it only to service providers that process it on our behalf under contracts limiting how they may use it, and to public authorities where the law requires.

• Vercel Inc. (United States) — hosting and content delivery for the website and its contact endpoint.
• Plus Five Five, Inc., operating as Resend (United States) — delivers contact form messages to our inbox by email.
• Google (Google Workspace) — hosts our oxsholdings.com mailboxes, where form messages, emails you send us directly and our replies are stored.
• Cloudflare, Inc. (United States) — Turnstile bot protection on the contact form, only when it is enabled.
• Public authorities and courts — when we are legally required to disclose information.

Where your information is processed

OXS Corp is based in the United States, and our service providers process data there. If you contact us from another country, your information will be processed in the United States, where data protection laws may differ from those where you live. For information from the EEA, the UK and Switzerland, our providers rely on their certifications under the EU–U.S. Data Privacy Framework and the Standard Contractual Clauses in their data processing terms.

How long we keep it

• Messages and our correspondence: for as long as we need to handle your inquiry and follow up, and deleted within 24 months of our last exchange — unless they become part of an ongoing business relationship or the law requires us to keep them longer, for example for tax or accounting records.
• IP addresses used for rate limiting: in server memory for up to 10 minutes.
• Hosting logs: kept by Vercel for a limited period for operations and security, under its retention schedule.
• Turnstile signals: processed by Cloudflare under its own policy.

When a retention period ends, we delete or anonymize the information.

Security

The website is served only over HTTPS, with HTTP Strict Transport Security. Service credentials stay on the server and are never sent to your browser, and access to messages is limited to the people who answer them. No system is completely secure; if a breach affects your information, we will notify you and the authorities where the law requires.

Your choices and rights

Wherever you live, you can ask us what personal information we hold about you, and ask us to correct or delete it.

EEA, UK and Switzerland. Under the GDPR you also have the rights to access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests, and you can lodge a complaint with the data protection authority where you live or work.

United States. Depending on your state of residence — California, for example — you may have the right to know what personal information we collect and how we use and disclose it, to access, correct and delete it, and not to be discriminated against for exercising these rights. We don’t sell or share personal information and don’t use sensitive personal information, so there is nothing to opt out of.

How to make a request. To exercise any of these rights, email privacy@oxsholdings.com — ideally from the address you used to contact us, so we can verify it’s you. You may use an authorized agent; we may ask for proof of their authority. We answer within 30 days, or sooner where the law requires, and free of charge.

Children

This website isn’t directed at children, and we don’t knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, email privacy@oxsholdings.com and we will delete it.

Changes to this policy

We update this policy when our practices change, and the effective date beside it shows when it was last revised. If a change materially affects how we use information you’ve already given us, we’ll tell you by email where we can.

Contact

Questions, requests or complaints about privacy: email privacy@oxsholdings.com. We aim to reply within a few business days.