Privacy
What we collect, why, and what you can ask us to do about it.
Last updated: 17 August 2026
Who we are
XRHQ is operated by XRHQ Ltd, a company registered in England and Wales (company number 13444625), registered office 20–22 Wenlock Road, London, England, N1 7GU. We are the data controller for the personal data described here.
Contact us about anything in this notice at [email protected].
In short
XRHQ is a public directory of organisational XR deployments. Most of what we hold is information about projects, not people. Where we do hold personal data, it is mainly your account details, the contributions you make, and a small amount of technical data we need to keep the service working and secure.
Some of it is public by design — that is the point of a contributor profile — and the section below says exactly which parts.
What we collect
When you create an account
Your email address and password (stored hashed, never in readable form). Optionally, and only if you add them: your name, display name, profile handle, organisation, job title, a short bio, links to your own sites and profiles, and a profile picture.
When you use your account
The date of your last sign-in, and the sessions that keep you signed in.
When you contribute
The projects you submit and the changes you propose, together with which version of our submission terms you accepted and when. We keep a record of moderation decisions on your contributions, and counts of your contributions, points, streaks and any achievements.
When you contact us or report a problem
What you send us, including reports about a project and requests to claim one.
Automatically, for security and abuse prevention
Your IP address and browser user-agent string, recorded against submissions, project claims, project reports and administrative actions, and used to apply rate limits. We also keep an audit log of changes made through the service.
How the site is used
Which pages are visited, where visitors arrived from, and rough location, browser and device type. This is aggregated and cannot be traced back to you: no cookies are involved, visitors are counted using a temporary code derived from the request that is discarded within a day, and nothing follows you to other websites.
If you are on our mailing list
Your email address, whether you consented, when, and how you told us.
If you take part in our marketing or events
The details you give through LinkedIn ads and lead forms (such as name, job title, company and LinkedIn profile), and registration details for XRHQ Live events. LinkedIn processes data you provide on LinkedIn under its own privacy policy and as a separate controller.
About people written about in the directory
Our project records sometimes name individuals — a quoted executive, a named project lead, the author of a source article. See people written about in the directory.
What is public
If you contribute, these are visible to anyone, including people who are not signed in:
- Your display name or handle, and your profile picture.
- Your bio, organisation and job title, if you added them.
- The links on your profile.
- The contributions credited to you, and your position on contributor leaderboards.
These are never public: your email address, your password, your IP address, and the internal records of how your submission was handled.
Search engines and AI systems can read the public parts, and XRHQ’s project content is published under a Creative Commons licence, so others may copy it. That means public profile information can be copied elsewhere and we cannot recall those copies.
You choose how you are credited. Ask us and we will credit you differently, or not at all.
If you close your account, your name comes off your past contributions. The contributions themselves stay — they are part of a public record — but they show as anonymous rather than credited to you.
Why we use it, and our legal basis
| What for | Legal basis |
|---|---|
| Creating and running your account; publishing your contributions | Performance of a contract with you |
| Sending marketing emails | Your consent |
| Reviewing submissions, moderating content, keeping the directory accurate | Our legitimate interests in running a reliable public directory |
| Rate limiting, abuse prevention, audit logs, security | Our legitimate interests in keeping the service available and secure |
| Running our events, and contacting you if you asked us to through a LinkedIn form | Your consent; and our legitimate interests in running the events |
| Understanding how the site is used, in aggregate | Our legitimate interests in seeing what people find useful and improving it |
| Responding to you | Our legitimate interests in dealing with enquiries |
Where we rely on legitimate interests, we have considered the impact on you; you can object at any time.
People written about in the directory
XRHQ records deployments reported by companies, the press and public bodies. Those records sometimes name individuals and quote what they said publicly, and we always state where each claim came from.
We do this on the basis of our legitimate interests in maintaining a public, sourced record of how organisations use immersive technology. If you are named in a record and want it corrected or removed, contact us at [email protected] and we will look at it.
Openly licensed content, and what we cannot undo
XRHQ’s project content is published under Creative Commons Attribution 4.0, so anyone may copy and republish it, provided they credit XRHQ. That licence cannot be withdrawn for copies already made.
If you ask us to delete something, we will remove it from XRHQ and stop publishing it. We cannot recall copies other people already hold, and we cannot control search engine caches or AI systems that have already read the page. We tell you this plainly because it affects what a deletion request can actually achieve.
Your rights
Under UK data protection law you have the right to:
- Get a copy of your data.
- Have inaccurate data corrected.
- Ask us to delete it. You can close your account yourself at any time from your account settings, or email us and we will do it.
- Ask us to restrict how we use it.
- Object to use based on legitimate interests.
- Receive certain data in a portable form.
- Withdraw consent at any time — change your email preference in your account settings, or click unsubscribe in any marketing email.
To exercise any of these, email [email protected]. We will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office, or to your local supervisory authority if you are in the EU.
How long we keep it
| Data | How long |
|---|---|
| Account data | While your account is open. Close it yourself from your account settings and we delete your account data straight away; if you ask us by email instead, within 30 days |
| Published contributions and the credit attached to them | Indefinitely — they form part of a public record, and the licence on them cannot be withdrawn |
| Mailing list | Until you unsubscribe or ask us to delete you. If you unsubscribe we keep your email address on a suppression list, so that we do not add you back |
| Security records — sign-ins, failed sign-in attempts, and emails we sent you | 12 months, then deleted |
| IP addresses and browser details attached to anything else | 12 months, then stripped from the record |
| Our record of changes to the catalogue — who submitted, edited or approved a project, and when | Kept as part of the history of that record. If you close your account, your name comes off it |
| Rate-limiting records | Hours — they expire automatically |
| Event registration data held by LinkedIn | Per LinkedIn’s own retention |
When we delete something it goes from our live systems straight away. Our database keeps a short change history so we can recover from mistakes, and deleted data stops being recoverable from it after 7 days.
International transfers
Some of our providers process data outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.
Children
XRHQ is not intended for children and we do not knowingly collect their data.
Changes
If we change this notice we will update the date at the top, and tell registered users by email about anything material.
