Privacy Policy

1. Who we are

This website (XSD Validator, reachable at https://www.xsdvalidator.io) is operated by Lucid Dreams BV, Belgium. For any privacy-related questions you can reach us at privacy@xsdvalidator.io.

As an operator established in Belgium, we are subject to the EU General Data Protection Regulation (GDPR) and the Belgian Data Protection Act.

2. What data we process and why

2a. Uploaded files

When you upload XSD or XML files for validation, those files are:

• Written to an isolated temporary directory on the server with a randomly generated name
• Processed in memory by PHP's libxml library
• Deleted immediately at the end of the same HTTP request, regardless of whether validation succeeds or fails
• Never logged, stored, analysed, or shared with any third party

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — processing is strictly necessary to provide the service you requested and the data is deleted before the response is sent.

2b. Session data & rate limiting

To prevent abuse and ensure fair access, we track how many validations you perform per hour using a server-side session. This stores a counter and a timestamp in PHP's default session storage. The session is identified by a cookie named PHPSESSID placed in your browser.

We do not link session data to your identity. Sessions expire automatically after your browser is closed or after the session lifetime configured on the server (typically 24 hours).

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — rate limiting is necessary to maintain service availability for all users.

2c. Server logs

Like all web servers, our hosting provider records standard access logs containing your IP address, browser type, referring URL, and the pages you visit. These logs are used solely for server security and are retained for a maximum of 30 days.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR).

2d. Anonymous usage statistics

We keep anonymous usage statistics to understand how the service is used and to improve it. For each validation run we record:

• Timestamp of the validation
• Validation mode chosen (XSD only / XML only / both)
• Whether the result was valid or invalid
• The number of errors reported (count only, not the error messages themselves)
• The rounded file size in kilobytes
• The number of include files uploaded

We do not log IP addresses, filenames, file content, browser details, or any data that could identify you or your XSD/XML documents. These statistics are stored server-side in aggregate form and are never shared with third parties.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — anonymous service analytics without identifiers.

2e. Google AdSense (advertising cookies)

This website displays advertisements served by Google AdSense. Google AdSense uses cookies and similar tracking technologies to show you personalised ads based on your browsing history across the web.

We only load Google AdSense after you explicitly accept advertising cookies via the cookie consent banner. If you decline, no AdSense scripts are loaded and no advertising cookies are set.

When you consent, Google may collect and process data including your IP address, device identifiers, and browsing behaviour. Google acts as an independent data controller for this data. You can review Google's privacy practices at policies.google.com/privacy and manage your ad personalisation settings at adssettings.google.com.

Legal basis: Your consent (Art. 6(1)(a) GDPR). You may withdraw consent at any time by clearing your cookies or using the "Manage cookies" link in the footer.

3. Cookies overview

4. Data transfers outside the EU

Google AdSense may transfer data to servers in the United States. Google LLC participates in the EU–US Data Privacy Framework and provides appropriate safeguards for such transfers. For details, see Google's GDPR commitment.

We do not transfer your uploaded files outside the EU — they never leave the server they are processed on, and are deleted before any response is sent.

5. Your rights under GDPR

As an EU resident you have the right to:

• Access — request a copy of any personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request that we limit how we process your data
• Objection — object to processing based on legitimate interest
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent — withdraw advertising consent at any time (clear your cookies or click "Manage cookies" in the footer)

To exercise any of these rights, contact us at privacy@xsdvalidator.io. We will respond within 30 days. You also have the right to lodge a complaint with the Belgian Data Protection Authority (GBA/APD).

6. Data retention

Uploaded files are deleted within the same HTTP request. Session data expires after the session lifetime (typically 24 hours). Server access logs are retained for a maximum of 30 days. Cookie consent preferences are stored in your browser for 365 days or until you clear your cookies.

7. Children's privacy

This service is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you believe a minor has submitted data through this service, please contact us and we will delete it immediately.

8. Changes to this policy

We may update this privacy policy to reflect changes in the service or applicable law. The "last updated" date at the top of this page will always reflect the most recent revision. Continued use of the service after changes constitutes acceptance of the updated policy.

9. Contact

Lucid Dreams BV
Belgium
privacy@xsdvalidator.io