Effective October 2, 2026. Xoolink is in beta: the service is provided “as is,” demo accounts coexist with real accounts, and malfunctions may occur.
Xoolink (“Xoolink,” “we”) operates the xoolink.com business network. This policy explains what personal data we collect, why we collect it and the rights available to you. It is governed by Quebec’s Law 25 and the European Union’s GDPR, where applicable.
The controller is Xoolink. Under Law 25, the person responsible for protecting personal information is Philippe Nadeau. Contact them at confidentialite@xoolink.com.
To compose teams, detect needs, provide first-line moderation and respond when asked, Xoolink sends certain public content, including posts and submitted needs, to a third-party AI provider. Your private messages are not sent to AI unless you write directly to the assistant (a conversation reserved for Alpha ⭐ members). No decision with legal effects is made automatically without human intervention.
Xoolink offers a connector that lets an AI assistant (such as Claude or ChatGPT) query the site during a conversation.
Public connector (https://xoolink.com/mcp). It only returns data that is already public: listed organization profiles (never those that chose “Do not list”), FAQ answers, and teams computed from those profiles. No member’s personal data leaves through it. The text of a search or a need sent by the assistant is used to answer and is not stored; we only keep a count of calls per tool, per day and per type of assistant. The caller’s IP address is used to limit request rates and is not kept for more than one day.
Member connector (https://xoolink.com/mcp/membre). It acts only with your consent, given on a Xoolink page, and only within the accesses you grant: reading your name, your profile address and your organizations; reading your pending invitations; preparing a need as a draft. It never posts, sends or signs anything. We keep the authorization you granted (the name declared by the application, the accesses, the dates), a fingerprint of the access tokens (never the tokens themselves), a log of the actions taken on your behalf (date, tool, application, outcome) kept as long as your account exists, and the prepared draft, kept for seven days at most.
What the assistant receives. Information returned to an assistant is processed by its publisher (Anthropic, OpenAI or another) under its own terms: you choose to connect that assistant.
Your choices. You can withdraw an access at any time in Settings › Integrations › Connected apps; changing your password or signing out everywhere withdraws all of them. Your data export includes your connected apps, their log and your draft; deleting your account erases them.
We rely on providers that process data on our behalf:
Some providers may process or host data outside Quebec. In accordance with Law 25, we seek to ensure appropriate protection for those communications. Contact confidentialite@xoolink.com for more information.
Subject to applicable law, you may request access, rectification, deletion, portability, withdrawal of consent and objection to applicable processing. You can delete your account from Settings after confirming a code sent by email.
Send requests to confidentialite@xoolink.com. You may also complain to the competent supervisory authority, including Quebec’s Commission d’accès à l’information.
Passwords are hashed with PBKDF2; connections use HTTPS; security headers and a Content Security Policy are in place; authentication cookies are HttpOnly; and backups run regularly. No system is infallible. Report concerns to confidentialite@xoolink.com.
We use only essential cookies: a session cookie to keep you signed in and a visitor identifier for abuse prevention and audience measurement. We do not use third-party advertising cookies.
Xoolink is a professional B2B service for adults. It is not intended for minors.
This policy may evolve. The effective date shown above identifies the latest version.