Legal
Privacy notice
How XIONIA LTD collects and uses personal data on xionia.ai, xionia.audio, xionia.studio, xionialabs.com and starshaper.com (which forwards to xionia.audio), and the rights you have.
Last updated 4 November 2026
In short
- We collect what you choose to give us: your email address if you join First Light or register developer interest, your answers to our optional questions, and whatever you send us through our contact forms or by email. Beyond that, our websites receive only the technical data every website does, such as your IP address, to deliver them and keep them secure.
- Our websites set no cookies of their own and use no analytics scripts, advertising or tracking. The only traffic figures we see are overall counts our hosting provider makes from requests to its servers.
- We don’t sell your data or share it for anyone else’s marketing.
- You can unsubscribe, see what we hold or ask us to delete it at any time.
Who we are
XIONIA LTD (“Xionia”, “we”, “us”) is the controller of the personal data described here. We are a private company limited by shares, registered in England and Wales with company number 17490446.
XIONIA LTD71-75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom
For anything about your data, send us a privacy request through our contact form, or email hello@xionia.ai. We don’t have a data protection officer, and aren’t required to; Xionia Ltd’s director deals with privacy requests personally.
This notice covers xionia.ai, xionia.audio, xionia.studio, xionialabs.com and starshaper.com (which forwards to xionia.audio), and the emails we send to people who sign up on them.
What we collect and why
| When | What we collect | Why | Lawful basis |
|---|---|---|---|
| You join First Light | Your email address; a record of your consent (the wording you agreed to, its version, and the date and time) and of when you confirmed your address; the page you signed up on; and, if you answer our optional questions, the instruments you’d like to hear about, what best describes you, what you’d most like to make and any comment you send us. | To confirm the address is yours; to send you development and release news about Xionia Audio’s instruments, including the seven stars and StarShaper, and First Light’s introductory offers; to send you what you’ve told us interests you; and to read your comments. | Your consent (UK GDPR Article 6(1)(a)). We need it to send you marketing emails under the Privacy and Electronic Communications Regulations. |
| You register developer interest | Your email address; your studio or company name and what you’re building, if you give them; a record of your consent and of when you confirmed your address. | To send you news about licensing StarShaper’s engine and its developer programmes. | Your consent (Article 6(1)(a)). |
| You contact us | Your name, your email address, the topic you choose and your message, if you use a contact form; whatever you include in an email; or, if we speak on a video call, your name and what you share in the call. | To reply, and to keep a record of what we agreed. | Our legitimate interest in answering enquiries (Article 6(1)(f)), or taking steps you’ve asked for before entering into a contract (Article 6(1)(b)). |
| You ask about working with us | Your name, your email address and what you tell us about yourself and your work, in your message and in anything you send us or link to, such as a CV or portfolio; and, if we talk about a role, what you share with us then. | To reply, and to consider you for work with Xionia, now or when a role opens later. | Taking steps you’ve asked for before entering into a contract (Article 6(1)(b)), and our legitimate interest in finding the right people to work with us (Article 6(1)(f)). |
| You use one of our forms | Counts of what’s sent through our forms: emails to your address, messages from it and posts from your internet connection, kept under coded forms of your email address and IP address rather than the addresses themselves. We also check that your email address’s domain (the part after the @) can receive email, by asking Cloudflare’s public DNS resolver about the domain alone. | So nobody can use our forms to flood someone’s inbox, ours included, and so an address with a typing mistake, such as one ending gmail.con, is caught before we send anything. | Our legitimate interest in keeping our forms working and protecting people from unwanted email (Article 6(1)(f)). |
| You visit our websites | Technical data your browser sends: IP address, browser and device type, the pages you request and when. | To deliver the websites and keep them secure, and so our hosting provider can give us overall traffic figures, such as how many people visit each site a day. We don’t use it to identify you or to build a profile of you. | Our legitimate interest in running secure, working websites (Article 6(1)(f)). |
You don’t have to give us any personal data to use our websites. If you don’t give us your email address, we can’t send you First Light or developer news.
The sound demonstrations on our StarShaper pages run entirely in your browser. They don’t use your microphone, and nothing you play is recorded or sent to us.
We don’t use your data for automated decision-making or profiling that has legal or similarly significant effects on you.
Who we share it with
We use a small number of service providers who process data on our behalf, under contracts that require them to keep it secure and use it only on our instructions:
- Cloudflare, Inc. hosts our websites, delivers them through its network, protects them from attacks, stores First Light and developer-interest signups and the messages sent through our contact forms, and sends our emails. Cloudflare’s privacy policy.
- Microsoft Limited hosts our email and video calls (Microsoft 365), including the messages you send us through our contact forms or by email, your replies to our emails and calls you join with us. Microsoft’s privacy statement.
We may also share data with professional advisers (such as lawyers and accountants) where needed, or with authorities where the law requires it. If Xionia or a part of its business is ever sold or reorganised, the data may pass to the new owner, who would have to treat it as this notice describes.
International transfers
Cloudflare, Inc. processes data in the United States, with data centres worldwide. Cloudflare is certified under the EU–US Data Privacy Framework and its UK Extension (the “UK–US data bridge”), which UK law recognises as giving adequate protection. Its data processing terms also include standard contractual clauses with the UK Addendum.
Microsoft Limited stores our email in the United Kingdom. Microsoft may also process data outside the UK, for example to support and secure its services. Microsoft Limited’s US parent, Microsoft Corporation, is certified under the EU–US Data Privacy Framework and its UK Extension, and Microsoft’s data protection terms include standard contractual clauses.
Ask us if you’d like more detail about these safeguards.
How long we keep it
- Signups: if you don’t confirm your address, we delete your signup 30 days after we last sent you a confirmation email. Otherwise, until you unsubscribe or ask us to delete it, or we stop sending that news, whichever comes first. When you unsubscribe we keep only your email address, the date and the record of your consent: the address and the date so we don’t email you again, and the record so we can show that the emails you received were ones you’d asked for. We keep these for our legitimate interests in respecting your choice and in being able to show we did (Article 6(1)(f)), until you ask us to delete them.
- Counts for the limits on our forms: deleted two days after each count starts. The key that codes IP addresses changes every day, and each day’s key is deleted soon after the day ends, after which nobody, including us, can tell which address a count came from.
- Messages from our contact forms, and emails you send us: for up to two years after our last exchange (we delete form messages two years after they arrive), unless we need them longer for a contract or a legal claim.
- If you ask about working with us: for up to two years after our last exchange, so we can think of you when a role opens, unless you ask us to delete it sooner.
- Technical data: for a short period, as set by our hosting provider for security and troubleshooting.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal data we hold about you;
- correct it if it’s wrong or incomplete;
- delete it;
- restrict how we use it;
- send it to you, or to someone else, in a common machine-readable format.
You can also object to how we use data on the basis of our legitimate interests, and you can always stop us emailing you. Where we rely on your consent you can withdraw it at any time, using the unsubscribe link in any email or by writing to us. Withdrawing consent doesn’t affect anything we did before.
To use any of these rights, send us a privacy request or email hello@xionia.ai. It’s usually free. We’ll reply within one month, or tell you within that month if we need longer (up to two more months for complex requests). We may ask you to confirm your identity first.
Complaints
If you’re unhappy with how we’ve handled your personal data, please tell us first, through our contact form, by email to hello@xionia.ai or any other way you prefer. We’ll acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.
You also have the right to complain to the UK regulator, the Information Commission (the ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the European Union, you can also complain to the data protection authority in your country.
Children
First Light and developer interest are for people aged 16 or over. If you’re under 16, please don’t sign up. If you think a child has given us their details, tell us and we’ll delete them.
Security
Our websites are served only over encrypted connections (HTTPS). We collect as little as we can and keep signup data in access-controlled storage: only people we’ve authorised can sign in to see it.
Changes to this notice
We’ll update this notice when what we do with personal data changes, for example when we start selling products or using a new service provider, and change the date at the top. If a change affects you significantly, we’ll tell you by email before it takes effect.