Privacy Policy

XML Viewer & XML Editor (also marketed as "<XML/>")

Effective Date: September 13, 2026
Last Updated: September 13, 2026

This Privacy Policy explains how Utsav Mangla, an individual developer based in Delhi, India, trading as "Utsav Mangla" ("we," "us," or "our"), collects, uses, discloses, and protects information in connection with the XML Viewer & XML Editor mobile application (the "App"). This Policy is incorporated into and forms part of our Terms of Service.

This Policy replaces any prior privacy policy previously published for the App (including any version hosted at a Google Sites address). If you have bookmarked or linked to an older policy, please update that link to point to this Policy once it is published at its permanent URL.

We are the data controller (or the equivalent role under the law applicable to you, such as "business" under U.S. state law, "data handling business operator" under Japan's APPI, "responsable" under Mexican law, "operator" under Russian law, or "personal data controller" under Vietnamese law) with respect to personal data processed through the App, except where we act as a processor on behalf of a third-party service provider identified below.

1. Scope

This Policy applies to personal data we collect through the App, regardless of where in the world you use it. Because the App is available in, and has meaningful usage in, Japan, the United States, Mexico, Russia, and Vietnam, Section 10 below sets out region-specific disclosures and rights that supplement, and where locally mandatory take precedence over, the general provisions of this Policy.

2. Information We Collect

2.1 Information you provide directly

Account information. If you sign in with Google Sign-In, we (and Google) receive basic profile information such as your name, email address, and profile photo, to the extent you authorize.
Support and correspondence. If you contact us for support (including via the in-app feedback/email feature), we collect your email address and the content of your message.
Purchase-related identifiers. If you subscribe or make an in-app purchase, our subscription management provider (RevenueCat) and the Apple App Store process your purchase and generate a pseudonymous customer/app-user identifier and transaction/subscription status information, which is shared with us. We do not receive or store your full payment card number; payment is handled entirely by Apple.

2.2 The files you convert ("Your Content")

When you use the App's core conversion feature, you select an XML file from your device (typically from your Downloads folder) using the device's file picker. The App transmits the content of that file to our backend infrastructure (hosted on Google Cloud) and to Google's Vertex AI generative-AI service so that the file can be interpreted and converted into PDF or HTML output. Because the App is commonly used to open and convert XML files such as tax forms, financial reports, and similar records, Your Content may include your own financial or tax information; see Section 4 for how such content is processed, and Section 7 for how long it is stored.
Please do not submit files containing sensitive personal data of third parties (for example, other people's health, financial, or government-ID information) unless you have the legal right and a lawful basis to do so, since such content will be processed as described in this section.
We are not able to review the content of files you submit before they are processed. You are responsible for the lawfulness and appropriateness of any file you choose to convert.

2.3 Information collected automatically

Device and app information. Device model, operating system and version, unique app instance identifiers, language and locale settings, and app version, collected via package_info_plus and device_info_plus and Firebase's SDKs.
Usage and diagnostic data. Screens viewed, features used, conversion counts, session duration, crash logs and stack traces, and app performance metrics, collected via Firebase Analytics, Firebase Crashlytics, and Firebase Performance Monitoring.
Advertising identifiers. On iOS, subject to your response to the App Tracking Transparency ("ATT") prompt, and on Android, your advertising ID, collected and used by Google AdMob and its advertising partners to serve and measure advertisements, including rewarded ads.
Approximate location. We do not collect precise GPS location. Google's advertising, analytics, and anti-fraud services (including Firebase App Check) may infer an approximate, IP-based location for analytics, fraud-prevention, and ad-targeting purposes.
Log and network data. Standard server log data (such as IP address, timestamps, and request metadata) generated as part of ordinary use of cloud infrastructure (Google Cloud Run) and Firebase Firestore.

2.4 Information from third parties

We may receive limited information about you from Apple, Google (Google Sign-In, AdMob), and RevenueCat, such as purchase/subscription status, entitlement information, and aggregated advertising performance data.

3. How We Use Information

We use the information described above to: (a) provide, operate, and maintain the App, including converting Your Content into the requested output format; (b) process and manage subscriptions, purchases, and entitlements; (c) authenticate you when you sign in; (d) diagnose, debug, and fix technical issues (crash reporting, performance monitoring); (e) understand feature usage and improve the App's design, reliability, and conversion accuracy; (f) serve, measure, and prevent fraud in connection with advertisements, including rewarded ads; (g) communicate with you about support requests, service updates, and (where you have not opted out and local law permits) product news; (h) enforce our Terms of Service and protect the security and integrity of the App; and (i) comply with applicable legal obligations.

4. AI Processing of Your Content

The App's core conversion functionality is powered by Google Cloud's Vertex AI generative-AI platform. When you submit a file for conversion:

The content of the file is transmitted to Vertex AI to be interpreted and transformed into the requested output.
Under Google Cloud's Vertex AI service terms and Data Processing Addendum, customer data — including the prompts, files, and outputs we send to Vertex AI on your behalf — is processed solely to provide the requested service to us and is not used by Google to train or improve its foundation models, and is not shared with other Google Cloud customers.
Vertex AI processing occurs on Google Cloud infrastructure, which may be located outside your country of residence (see Section 9 and Section 10).
We do not use the content of your files to train our own models, and we do not sell the content of your files.

We do not sell your personal data for money. We disclose personal data only as follows:

Service providers (sub-processors). We share information with providers who process it on our behalf and under contract, currently including: Google LLC (Firebase — Firestore, Analytics, Crashlytics, Performance Monitoring, Remote Config, App Check, and AI/Gemini/Vertex AI processing; Google Cloud Platform, including Cloud Run hosting; Google Sign-In; Google AdMob); RevenueCat, Inc. (subscription and purchase management); and Apple Inc. / Google LLC (app-store distribution and payment processing).
Legal and safety reasons. We may disclose information if required to do so by law, regulation, legal process, or governmental request (including requests from data protection, consumer protection, tax, or law-enforcement authorities in Japan, the United States, Mexico, Russia, or Vietnam), or where we believe disclosure is necessary to protect the rights, property, or safety of us, our users, or the public.
Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy or a successor policy providing at least equivalent protection.
With your consent or direction. For any other purpose disclosed to you at the time of collection, or with your consent.

6. Advertising and Analytics Choices

iOS App Tracking Transparency. You will be prompted to allow or deny app tracking (via Apple's ATT framework) the first time the App or its ad partners attempt to access your device's advertising identifier (IDFA). If you deny, AdMob will serve non-personalized ads to the extent permitted by the device, and no IDFA will be collected.
Google Ads Settings. You can review and adjust interest-based advertising preferences at Google's Ads Settings (adssettings.google.com) and opt out of personalized advertising provided by participants in the Digital Advertising Alliance / Network Advertising Initiative where applicable.
Analytics. Firebase Analytics collection can be limited through your device-level privacy settings; note that disabling analytics may not eliminate all crash or performance diagnostics necessary for us to operate the App reliably.

7. Data Retention

Account and purchase records. We retain account and subscription/entitlement records for as long as your account is active and for a reasonable period afterward (generally up to 7 years) as needed to resolve disputes, honor statutory retention obligations (including tax and consumer-protection recordkeeping), and enforce our agreements.
Your Content. Unlike data that is only cached transiently, the files you submit for conversion and the resulting converted output are persisted on our servers/database (Cloud Firestore and/or associated Google Cloud storage) so that you can access your conversion history. We retain Your Content until you request its deletion. To request deletion of some or all of Your Content, contact us at support@umango.in; we will delete the requested content as soon as reasonably practicable, and in any event within 30 days, except where we are required to retain it for a longer period to comply with law or resolve disputes. Because this content may include your own financial, tax, or other sensitive documents, we encourage you to request deletion once you no longer need us to retain a copy.
Diagnostic and analytics data. Crash, performance, and analytics data are retained by Firebase according to Google's default retention windows (commonly 14–60 months depending on the product) unless we configure shorter retention.
We will delete or de-identify personal data when it is no longer needed for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

8. Data Security

We use commercially reasonable technical and organizational measures designed to protect personal data, including encryption in transit (TLS), reliance on Google Cloud's and Firebase's security infrastructure (including Firebase App Check to help prevent abusive API access), and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and any applicable regulator as required by the law applicable to you (see Section 10 for jurisdiction-specific breach-notification timelines).

9. International Data Transfers

Our service providers, including Google Cloud Platform and Firebase, operate global infrastructure, and personal data collected through the App is generally processed on servers located in the United States and other countries where Google operates data centers, which may be outside your country of residence. Where required by applicable law, we rely on one or more of the following to legitimize such transfers: your consent, contractual data-processing terms with our service providers incorporating appropriate safeguards, or another legally recognized transfer mechanism. See Section 10 for jurisdiction-specific transfer disclosures, including an important notice for users in Russia.

10. Regional Disclosures and Your Rights

10.1 Japan (Act on the Protection of Personal Information — APPI)

If you access the App from Japan, we handle your personal information in accordance with the APPI, as administered by Japan's Personal Information Protection Commission ("PPC").

Purposes of use. The purposes for which we use your personal information are as set out in Section 3 above.
Cross-border transfer. Because your personal information is transferred to and processed on servers located outside Japan (including in the United States, via Google Cloud/Firebase), and because the United States is not currently recognized by the PPC as ensuring an equivalent level of protection to Japan, we transfer such data on the basis of your consent (given by using the App after being presented with this Policy) and/or contractual safeguards with our service providers. You may withdraw consent to future transfers by ceasing to use the App and requesting deletion of your data as described below.
Your rights. You may request disclosure of the personal information we hold about you, correction or addition of inaccurate information, cessation of use or deletion of your information, and cessation of provision of your information to third parties, in each case as and to the extent required under the APPI. To exercise these rights, contact us using the details in Section 12.
Complaints. If you are not satisfied with our response, you may contact the PPC (Personal Information Protection Commission, Japan) or another competent authority.

10.2 United States

General. We collect and use personal information as described in Section 2 and 3. We do not knowingly collect personal information from children under 13 (see Section 11).
State privacy laws (e.g., California, Colorado, Connecticut, Virginia, and other states with comprehensive privacy statutes). Depending on your state of residence, you may have the right to: know and access the categories and specific pieces of personal information we have collected about you; request deletion of your personal information; request correction of inaccurate personal information; opt out of the "sale" or "sharing" of personal information (including for cross-context behavioral/targeted advertising) and of certain profiling; and not be discriminated against for exercising these rights.
"Sale/Sharing" disclosure. Our use of Google AdMob for interest-based advertising, and Firebase Analytics/advertising integrations, may constitute a "sale" or "sharing" of personal information (such as advertising identifiers and usage data) under some state laws. You can opt out using the device-level and Google Ads Settings controls described in Section 6, and, where technically supported, we will honor the Global Privacy Control ("GPC") signal as an opt-out-of-sale/sharing request for browsers or devices that transmit it, to the extent required by applicable law.
How to exercise rights. Submit a request via the contact details in Section 12. We will verify your request using information reasonably available to us (such as your account email) before responding, and we will respond within the time period required by the applicable state law. You may designate an authorized agent to submit a request on your behalf where permitted by law.
Do Not Track. The App does not currently respond to browser "Do Not Track" signals, other than GPC as described above.

10.3 Mexico

If you access the App from Mexico, we process your personal data (datos personales) in accordance with Mexico's federal data-protection framework, currently enforced by the Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno), which assumed the data-protection oversight functions previously held by the now-dissolved INAI as of March 2025.

Consent. Where required, we rely on your consent (which, for most non-sensitive processing under Mexican law, may be tacit consent given by your continued use of the App after this Policy is made available to you) as a basis for processing.
ARCO rights. You have the right to Access, Rectify, Cancel, and Object (derechos ARCO) to the processing of your personal data, and to revoke your consent, at any time, subject to legal exceptions. To exercise these rights, contact us using the details in Section 12; we will respond within the time period required by applicable Mexican law.
Cross-border transfer. Your data may be transferred to and processed in the United States and other countries via our service providers (Google Cloud/Firebase). We take contractual and technical measures intended to ensure such transfers remain consistent with the protections required by Mexican law.
Complaints. If you believe your rights have been violated, you may file a complaint with the Secretariat of Anti-Corruption and Good Governance or its successor data-protection authority.

10.4 Russia

Important notice for users in Russia. Federal Law No. 152-FZ "On Personal Data," as tightened by amendments effective July 1, 2025, requires that the collection, recording, systematization, storage, and updating of the personal data of Russian citizens be carried out using databases physically located within the Russian Federation, subject to narrow statutory exceptions.

No account required. The App's core conversion features can be used without creating an account or signing in, and we do not require you to provide your name, email address, or other directly identifying information to use the App. This reduces, but does not eliminate, the personal data we collect from users in Russia.
What is still collected and processed outside Russia. Even without an account: (a) device and advertising identifiers, IP address, and usage/analytics data are collected via Google Firebase and Google AdMob and processed on Google's global infrastructure; and (b) the XML files you convert, and the resulting output, are transmitted to and persistently stored on Google Cloud/Vertex AI infrastructure outside Russia (see Section 7). If those files contain your own personal, financial, or tax information, that content is itself personal data under Russian law, regardless of whether you signed in.
Our current infrastructure. We have not established Russian-domiciled infrastructure for the initial collection or storage of personal data, and rely entirely on Google Cloud/Firebase's global infrastructure and its standard data-handling policies. We are not currently able to represent that this fully satisfies the localization requirement described above for any personal data — including file content — originating from users in Russia.
What this means for you. If you are in Russia and want to minimize the personal data this App processes outside Russia, avoid signing in, and avoid converting files that contain your own or others' sensitive personal, financial, or identifying information where possible.
Your rights. Subject to applicable law, you have the right to obtain information about the processing of your personal data, to require correction, blocking, or destruction of personal data that is inaccurate, unlawfully obtained, or no longer necessary (including deletion of stored file content per Section 7), and to withdraw your consent to processing at any time. Requests may be submitted using the contact details in Section 12.
Regulator. The Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor) is the competent authority for personal-data matters in Russia.
We are actively reviewing our options for the Russian market in light of this requirement, which may include limiting data collection from, or the availability of certain features to, users located in Russia.

10.5 Vietnam

Effective January 1, 2026, Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) and its implementing Decree No. 356/2025/ND-CP (superseding the former Decree 13/2023/ND-CP) govern the processing of personal data of Vietnamese citizens and individuals of Vietnamese origin residing in Vietnam, and apply to us as a foreign organization that processes such data through the App.

Consent. We seek your consent, specifying the categories of personal data and purposes of processing, before collecting personal data through the App, to the extent required by Vietnamese law.
Cross-border transfer. Personal data collected from users in Vietnam is transferred to servers located outside Vietnam (via Google Cloud/Firebase). Vietnamese law requires organizations conducting such transfers to obtain data-subject consent and to prepare and, where applicable, file a Transfer Impact Assessment with Vietnam's Ministry of Public Security (Department of Cyber Security and Hi-Tech Crime Prevention, "A05").
Your rights. You have the right to be informed of processing activities, to access, correct, and request deletion of your personal data, to withdraw consent, to data portability, and to lodge complaints and seek compensation for violations, in each case as provided under the PDPL. We aim to respond to withdrawal-of-consent requests within the statutory timelines (currently, acknowledgment within 2 working days and implementation within 10–20 days depending on the request type).
Breach notification. In the event of a personal-data breach affecting Vietnamese users, we will notify the competent authority (A05) within the timeframes required by law (currently as short as 24–72 hours depending on the nature of the incident).

11. Children's Privacy

The App is not directed to children and is not intended for use by anyone under the age of 13 (or the higher minimum age of digital consent that applies in your jurisdiction). We do not knowingly collect personal data from children under that age. If you believe a child has provided us with personal data without appropriate parental or guardian consent, please contact us using the details in Section 12, and we will take steps to delete such information and, where applicable, deactivate the associated account.

12. Contact Us / Exercising Your Rights

To ask a question about this Policy, or to exercise any of the rights described above, contact us at:

Utsav Mangla (trading as Utsav Mangla)
Email: support@umango.in

We will respond to verifiable requests within the timeframe required by the law applicable to you, and in any case within a reasonable time.

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, the App's functionality, or applicable law. We will update the "Last Updated" date above and, for material changes, provide additional notice as required by applicable law (for example, in-app notice or, where required, renewed consent). Your continued use of the App after a change takes effect constitutes your acceptance of the revised Policy, to the extent permitted by applicable law.