Privacy Policy

This Privacy Policy describes how Xtiply ("we," "us," or "our") handles personal information when you access or use our websites, applications, APIs, and related services (collectively, the "Services"). By using the Services, you agree to this Policy. If you do not agree, please do not use the Services.

Who we are

Xtiply provides a software platform that allows businesses to deploy AI-powered agents, automate conversations across channels, manage knowledge, and integrate with third-party tools. Depending on your relationship with us, we may act as a controller of certain personal information and, where we process data on behalf of our business customers, as a processor or service provider as described in our agreements with those customers.

Information we collect

We may collect the following categories of information:

Account and contact data. Name, email address, company name, billing details, and similar information you provide when registering, subscribing, or contacting support.
Usage and technical data. Log data, device and browser type, IP address, approximate location derived from IP, pages viewed, referring URLs, timestamps, and diagnostic or performance data.
Conversation and content data. Messages, files, media, and other content submitted through chat widgets, messaging channels, uploads, or integrations you connect to the Services— including data your end users provide when interacting with agents you configure.
Knowledge and configuration data. Documents, FAQs, product information, prompts, workflow settings, and other materials you upload or configure to train or operate your agents.
Integration data. Information made available through third-party services you authorize (for example, CRMs, messaging providers, or analytics tools), as permitted by those services and your settings.
Cookies and similar technologies. As described in our use of cookies and local storage for authentication, preferences, security, and analytics where applicable.

How we use information

We use personal information to:

Provide, operate, maintain, and improve the Services;
Create and manage accounts, process payments, and communicate about the Services;
Operate AI features (including retrieval, summarization, and response generation) in line with your configuration and applicable terms;
Monitor and help ensure security, prevent abuse, and enforce our policies;
Comply with legal obligations and respond to lawful requests;
Analyze usage in aggregate or de-identified form to improve product experience; and
Send service-related notices and, where permitted, information about features or offers (you may opt out of marketing as provided in those messages).

Legal bases (EEA, UK, and similar regions)

Where required, we rely on appropriate legal bases such as performance of a contract, legitimate interests (for example, securing and improving the Services, provided those interests are not overridden by your rights), consent where we ask for it, and compliance with legal obligations.

We may share personal information with:

Service providers who assist us with hosting, infrastructure, email delivery, analytics, payment processing, customer support, security, and AI or model providers that process content only as instructed and in accordance with our agreements;
Your organization (for example, administrators of your Xtiply workspace) when they manage access to the Services;
Professional advisers, regulators, or law enforcement when required by law or to protect rights, safety, and security; and
Corporate transactions such as a merger, acquisition, or asset sale, subject to appropriate safeguards.

We do not sell your personal information as that term is commonly defined in applicable privacy laws, and we do not use or disclose sensitive personal information for inferring characteristics in ways prohibited by law.

Google account and Google Calendar data

Data we access and store. When you authorize a Google connection, Xtiply accesses and stores account information needed for authentication, OAuth access and refresh tokens, calendar identifiers, and appointment information, including event titles, dates, times, descriptions, and attendees as needed to provide the integration.

How we use it. We use this information to authenticate your account, maintain your Google connection, check availability, and create, update, or cancel appointments according to your configuration and instructions.

Storage and security. Google integration data is stored in our Supabase database with encryption at rest. Access is limited to the systems and authorized personnel that need it to operate and support the integration.

Service providers and AI. We use Supabase for data storage and OpenAI and TypesafeAI to process information needed for AI-assisted scheduling and appointment management. Relevant Calendar information may be sent to these providers to perform the features you authorize. We do not sell Google user data or use it for advertising. We do not use Google Workspace API data to develop, improve, or train generalized or non-personalized AI or machine-learning models, or permit our providers to do so.

Retention and deletion.We retain Google integration data only for as long as necessary to provide the authorized functionality or meet applicable legal obligations. You can revoke access through your Google Account's third-party connections settings. Revoking access stops future access but does not itself delete information already stored by Xtiply. You may request deletion through the contact channels described below. Deletion covers Google integration credentials and Calendar data stored by Xtiply; it does not delete appointments from your Google Calendar.

Our handling of Google API data follows the Google API Services User Data Policy, including its Limited Use requirements. These restrictions also apply to aggregated, anonymized, and derived Google data and take precedence over broader statements elsewhere in this policy.

Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer period is required or permitted by law. Retention periods may depend on the type of data, your account status, backup and disaster recovery practices, and legal or regulatory requirements. Retention of aggregated or de-identified Google data remains subject to the Google-specific purposes and restrictions described above.

Security

We implement technical and organizational measures designed to protect personal information against unauthorized access, loss, or alteration. No method of transmission or storage is completely secure; you use the Services at your own risk to that extent.

Your rights and choices

Depending on your location, you may have the right to access, correct, delete, or export certain personal information; to object to or restrict certain processing; to withdraw consent where processing is consent-based; and to lodge a complaint with a supervisory authority. You may also be able to control cookies through your browser settings. To exercise applicable rights, contact us using the details below. We may need to verify your request.

International transfers

We may process and store information in the United States and other countries where we or our service providers operate. When we transfer personal information from the EEA, UK, or Switzerland, we use appropriate safeguards such as standard contractual clauses or other mechanisms approved by applicable law.

Children

The Services are not directed to children under 16 (or the age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have collected such information, contact us and we will take appropriate steps to delete it.

California residents

If you are a California resident, you may have additional rights under the CCPA/CPRA, including the right to know, delete, and correct certain personal information, and to opt out of certain sharing. We honor applicable requests as required by law. You may designate an authorized agent where permitted.

Changes to this Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. For material changes, we may provide additional notice (such as an email or in-product notice) where appropriate. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy, to the extent permitted by law.

Contact

To request access to, correction of, or deletion of information held by Xtiply, including Google integration data, contact your Xtiply workspace administrator to submit the request to Xtiply on your behalf. We may need to verify your identity and authority before processing the request.