Privacy Policy

1. Scope and controller

This policy explains how Xavana Consulting ("Xavana", "we", "us" or "our") handles personal information when you use the Virtual Comic Reader application ("VCR" or the "App"), visit this website, or contact us. Mandatory local privacy law applies where it gives you additional rights.

Xavana Consulting is the data controller for the limited processing that Xavana determines:

2. Privacy at a glance

• No Xavana account is required to use VCR.
• Xavana does not sell or rent personal information.
• VCR contains no Xavana-operated advertising, behavioural tracking, analytics or remote crash reporting.
• Your publications, cover images, library catalogue, settings and reading progress remain in the App's private storage unless you deliberately connect or transfer from an external source.
• VCR can transfer publications to your headset, but it does not send your publications or reading activity to Xavana-operated servers.
• The website does not set cookies, use browser storage, run analytics or contain a contact form.

3. Information handled by the App

Publications and library information

To provide the reading experience, VCR may process publication files, file and folder names, titles, file type and size, cover images, thumbnails, reading progress, bookmarks, page position, reading direction, tags, collections, shelf order and cache status. This information is stored in the App's private storage on your headset and is not sent to Xavana.

You are responsible for ensuring that you have the right to access and use the publications you add. VCR does not provide or circumvent digital rights management. Unsupported, encrypted or DRM-protected files may be rejected.

Settings and device capabilities

VCR stores local preferences needed to operate the App, such as display quality, selected environments, audio levels, interface placement, accessibility and interaction choices. It may read the headset model, supported refresh rates, controller availability and abstracted hand-tracking capabilities to provide compatible features. Xavana does not receive this information remotely.

Head, controller and hand interaction

Meta Horizon OS and OpenXR provide real-time position, orientation, controller input and abstracted hand-tracking data required to display and control the App. VCR processes this on the headset. It is not used to identify you, sent to Xavana, or used for advertising or profiling. Local positions and sizes of App windows or objects may be saved so that they can be restored.

4. Passthrough and spatial features

On supported Meta Quest headsets, VCR uses Meta and Unity passthrough components to show your surroundings behind App content. VCR does not copy, save, analyse or transmit passthrough camera images.

If you choose to place a poster in your physical space, VCR may request Meta Quest scene or spatial permission and use local persistent-anchor functionality. The App may store an anchor identifier, poster image, generated file name and placement information in private local storage. VCR does not use anchor sharing, colocation, Xavana cloud storage or remote spatial telemetry. You may decline the permission or remove saved posters.

Meta independently operates the headset, operating system, passthrough compositor, permissions and platform services under Meta's own terms and privacy notices.

5. Optional file sources and transfers

Local Wi-Fi transfer

When you deliberately start a transfer session, VCR temporarily makes a transfer page available to devices on the same local network and displays a time-limited address and pairing code. Files travel directly from your device to the headset and do not pass through a Xavana server. Use this feature only on a network you trust and keep the pairing code private.

SMB libraries

If you add a private-network SMB library, VCR processes the address, share, folder path, username and password you provide. Passwords remain in memory for the current App session and are not saved. Source configuration, remote metadata and cached content remain in private App storage. Removing a source removes its local configuration and cached copies but does not alter the original source files.

Caches and temporary files

Publications imported from an SMB library are copied to private local storage so they remain readable without a network connection. Imported copies and caches remain until removed, evicted under the App's storage controls or deleted when the App is uninstalled. Thumbnails and catalogue metadata may remain until the publication or source is removed.

6. Meta platform, entitlement and purchases

Meta distributes the App and may process account, device, store, entitlement and payment information under its own policies. VCR may receive the entitlement or purchase status needed to verify access and restore purchased features. Xavana does not receive complete payment-card details or use store information for advertising or profiling.

Purchases, refunds and platform records are administered by Meta. See Meta's Supplemental Meta Platforms Technologies Privacy Policy.

7. Website, cookies and email

Website

This website does not set cookies, use local browser storage, run analytics or advertising scripts, or collect information through forms. The hosting provider may process technical request information such as IP address, date and time, requested page, browser information, referrer and security events to deliver and protect the site. Any logs controlled by Xavana are used only for delivery, security and fault diagnosis and kept only as long as needed for those purposes or legal obligations.

Email and support

If you email us, we process your address, message, attachments and correspondence to respond, provide support, handle the business relationship, investigate security issues and meet legal obligations. Our email service is Microsoft 365. Do not send passwords, access tokens, complete payment details or publication files unless we specifically request a safe diagnostic item.

Correspondence is kept only as long as needed to handle the matter and for accounting, legal compliance, security or the establishment or defence of legal claims.

8. Purposes and legal bases

Where the GDPR applies, we rely on:

• Contract: providing the App, verifying entitlement, restoring purchases and responding to service requests.
• Legitimate interests: securing and maintaining the App and website, preventing fraud or abuse, answering ordinary enquiries and establishing or defending legal claims.
• Consent: where we specifically ask for it. You may withdraw consent at any time.
• Legal obligation: retaining or disclosing limited information where applicable law requires it.

VCR does not make automated decisions producing legal or similarly significant effects.

9. Recipients and international transfers

The App communicates with Meta platform services, your SMB server and local-network devices only as needed for features you use. Xavana may disclose information to website and email providers, professional advisers or authorities where lawfully necessary.

Meta, Microsoft as Xavana's email provider, and hosting providers may process information outside Denmark or the European Economic Area. Their notices describe their processing and transfer safeguards. Where Xavana itself makes a restricted international transfer, it will use a lawful mechanism such as an adequacy decision or approved standard contractual clauses where required.

10. Retention and deletion

• Local publications, metadata, settings, progress, thumbnails, caches, poster images and anchor identifiers remain on the headset until removed through the App, cleared by operating-system storage controls, evicted under a cache limit or deleted when VCR is uninstalled.
• SMB passwords and any Meta platform access tokens used by VCR are held in memory for the current session.
• Local transfer sessions expire and do not use a Xavana file server.
• Website logs and emails follow the periods described in section 7.

To delete local App information, use VCR's removal and cache controls, remove sources and posters, clear the App's data or uninstall it. Deleting VCR data does not delete files or account data independently held by Meta, your SMB server or email provider. Use their controls for their copies.

To request deletion of information held by Xavana, email vcr@xavana.com. We may need to verify your request and may retain information where law permits or requires it.

11. Security

VCR uses safeguards designed to limit unauthorised access, including private App storage, session-only SMB passwords, read-only SMB access and no Xavana cloud relay for publication content. No system can guarantee absolute security. Keep your headset, accounts, local network, pairing codes and passwords secure and install updates when available.

12. Your privacy rights

Depending on where you live and the processing involved, you may have rights to information, access, correction, deletion, restriction, objection, data portability and withdrawal of consent. Legal conditions and exceptions may apply. Contact vcr@xavana.com. We normally respond within one month where the GDPR applies.

You may complain to the supervisory authority where you live or work. In Denmark:

13. Children

VCR is a general-audience reading tool and is not directed to children under 13. Xavana does not knowingly collect personal information directly from children under 13. Meta account, parental-supervision, age-group and store rules may restrict the App or particular features. If you believe a child has provided information directly to Xavana, contact us so we can investigate and delete it where appropriate.

14. Changes and contact

We may update this policy when features, providers, laws or data practices change. The current version will be posted here with a revised effective date. Additional notice will be provided where required for a material change.

For privacy, deletion or security enquiries, email vcr@xavana.com or write to the controller address in section 1.