Privacy Policy

1. Who we are and who this covers

XS is an AI-assisted funnel platform that organizations use to capture, research, and score their own business opportunities. It is operated by Access-Exonix JV, LLC, 1001 N Charles St Ste 800, Baltimore, MD 21202.

Accounts on this platform are created by an administrator, not by self-service signup. So "you" in this policy means one of:

– a workspace user — someone whose organization bought the platform and provisioned them an account;

– a visitor to our public pages, which are the pricing page and these legal pages.

Your organization is our customer. This policy explains what we do with personal data about you. It also explains, in section 4, which decisions are your organization's rather than ours.

Questions, or to exercise a right: support@exonix.com.

2. The short version

– We collect the account data needed to give you a working, secure login, plus records of how you use the platform's assistant and interview features.

– We measure which features get used and which do not, using our own records in our own database. No third party measures you, and those records cannot contain anything you typed.

– We use AI models to do the platform's work. Your organization's content is sent to those providers to be processed, and only to be processed.

– We do not train models on your data, and neither does our model provider under our agreement with them. Section 6 explains how that is enforced rather than merely promised.

– We do not sell personal data, we run no advertising, and we do not profile individuals.

– We use a small number of service providers, listed in section 7, and we tell customers before adding one.

This summary is not a substitute for the rest of the document.

3. Personal data we collect

We collect this directly from your use of the platform. We do not buy personal data about workspace users from anyone.

Your account identity. Your name, your email address, your role in your organization's workspace, and your account status. Your password is stored only as a cryptographic hash — we never store or see the password itself.

Authentication and security records. If you enrol in two-factor authentication, we store your authenticator secret in encrypted form and your recovery codes as hashes. If you sign in from a mobile companion app, we store a hash of that device's access token — never the token itself — with its expiry and last-used time. We keep short-lived counters of failed sign-in attempts, which include the email address used and the network address it came from, so we can stop password-guessing attacks.

Activity and audit records. Who did what and when, kept so we can investigate security events and answer questions about changes to your workspace.

Product usage records. So we can see which parts of the platform get used and which do not, we keep a deliberately content-free trail of your use of it: which feature or screen you used, the route pattern of the page — the shape of the address, such as /items/[id]/briefing, and never what the address bar actually said — the identifier of your sign-in session, whether the account acting was a workspace user or one of our own operators, and timestamps. Four things are excluded by the design of the record itself rather than by policy alone, because the table it is written to has nowhere to put them: free text you type, search terms and anything else carried in a query string, the contents of requests, and network addresses. We use these records to decide what to build, what to fix, and what to retire.

Your use of the assistant. When you ask the in-app assistant a question, we store your question, the context the platform assembled to answer it, the answer, and any rating you give it. This is used to measure and improve answer quality. Section 6 explains the limits on that use.

Guided interview responses. If you complete the guided scoring interview, we store the conversation, including the free text you wrote, so the session can be resumed and reviewed.

Linked messaging accounts. If you choose to link a chat channel such as Telegram or WhatsApp, we store the identifier of that account alongside your user record, so we can recognize you when you message the platform. You can ask your administrator to unlink it.

Derived representations of content. To make search and retrieval work, we compute numerical representations of your organization's content and store them with the source text. Where that content contains personal data, so does the derived copy.

Voice recordings and audio. If your organization enables voice features, spoken input is transcribed and spoken output is generated. Generated narration audio is cached so it does not have to be regenerated; transcription audio is not retained by the platform.

Diagnostic data. Where error reporting is switched on, technical error reports are sent to our error-tracking provider. These are configured not to include your email address, your network address, request contents, or credentials, and email-shaped text is stripped from error messages before they are sent.

Cookies

We set two cookies, and neither is for advertising:

– a session cookie, which keeps you signed in. Sessions expire 12 hours after sign-in, and after 60 minutes of inactivity. It also carries the sign-in identifier that groups the usage records described above into a single visit;

– a functional preference cookie, which remembers which sector view your dashboard shows.

We run no advertising trackers, and no third party measures your use of this platform. There is no third-party tracking script on any page, and no cookie of ours is readable by anyone else, which is why we do not ask you to accept cookies. The usage measurement described above is entirely first-party: our own code writing to our own database, inside the same workspace isolation as the rest of your data, and it sets no cookie of its own.

Your organization's business content

The deals, targets, companies, documents, scores, and notes your organization loads into its workspace belong to your organization. That content is confidential business information, and we process it only on your organization's instructions — see section 4.

4. Who is responsible for what

Your organization is the controller of its business content. For that content we act strictly as its processor, on its instructions and under a data processing agreement. If you want business content in your organization's workspace corrected or removed, your organization's administrator is the right first contact — that content is theirs to manage, not ours.

We are the controller of your account identity and of the authentication, security, audit, and usage records listed in section 3. We decide how to store and protect them so the platform can operate securely.

5. Why we process it, and on what legal basis

What we do — Data used — Legal basis (GDPR / UK GDPR)

– Give you a working account and sign you in — Account identity, authentication records — Our legitimate interests in providing the platform your organization has contracted for

– Enforce what your role permits — Account identity — Legitimate interests

– Keep the platform secure: throttling, two-factor, audit trail — Security and audit records — Legitimate interests, and compliance with our legal obligations

– Operate the assistant and interview features — Assistant usage, interview responses, derived representations — Legitimate interests, on your organization's instructions

– Measure and improve answer quality — Assistant usage records — Legitimate interests, subject to the limits in section 6

– See which features are used, so we know what to improve and what to retire — Product usage records — Legitimate interests in maintaining and improving the platform

– Support you and respond to requests — Account identity and request records — Legitimate interests

We do not rely on consent for any of this, which is why you are not asked to give it. We do not use personal data for advertising, we do not sell or share it for cross-context behavioural advertising, and we do not make decisions about you by automated means that have legal or similarly significant effects.

6. AI processing, and what we do not do with your data

The platform's core function is AI-assisted research and scoring, so this section is specific.

What leaves the platform, and to whom. When your organization runs research, scoring, an assistant query, an interview, or document generation, the relevant content is sent to our model providers' APIs to be processed and returned. Separately, content is sent to an embeddings provider to compute the representations that make retrieval work, and, if your organization enables voice features, audio and narration text are sent to a voice provider. Every one of these providers is named in section 7.

We do not train models on your data. This is enforced by the platform's design, not only stated:

– Assistant usage records are restricted to offline, evaluation-gated use. There is no online or continuous training, and no customer data is ever trained into shared model weights.

– The only corpus used for any training-adjacent purpose is a consented, anonymized set of design-partner transcripts, gated on a recorded consent record and passed through automated redaction that fails closed if it cannot verify the result is clean.

– Improvements to how the platform prompts a model are proposed, tested against a fixed evaluation set, and promoted by a person. Nothing self-modifies.

Our active model provider does not train on your data either. Under our commercial agreement, the content we send is not used to train their models, and inputs and outputs are deleted within 30 days. We do not claim a zero-retention arrangement, because we do not have one.

OpenAI receives embedding input and, when selected for a research beat, the scoped research prompt, NAICS scope and date, Census scope titles and exclusions, and any bounded repair instructions. The research request carries no tenant, thesis, item, run, or snapshot identifier. Its background response is stored temporarily on OpenAI disk for roughly ten minutes so it can be polled even with store: false; that flow is not Zero Data Retention compatible. API content may separately be retained for abuse monitoring for up to 30 days. We do not claim Zero Data Retention.

AI output needs a human. Answers, scores, research, and generated documents are produced by AI models. They can be incomplete or wrong, and they are not investment, legal, tax, or professional advice. The platform is built on that assumption: agents research and score, but only a person moves an opportunity from one stage to the next, and that decision is recorded as a human action.

7. Service providers

We use a small number of providers to run the platform. Each is under a data protection agreement, each is reviewed at least annually, and the current list with the data categories each receives is published at /subprocessors. It covers our cloud host, our AI model provider, our embeddings provider, our voice providers, our error-tracking provider, and the systems we use to build and operate the platform.

We will notify customers before adding a new provider that processes their data.

One provider you may hear about is deliberately not on that list: our market-reference-data supplier sends data to us. Data flows in one direction only, and none of your data or your organization's data is sent to it.

8. International transfers

Several of our providers are based in the United States. Where personal data is transferred out of the EU, the UK, or Switzerland, that transfer is made under the European Commission's standard contractual clauses with the applicable UK and Swiss addenda, as recorded in each provider's agreement.

9. How long we keep data

Your account data is kept for the life of your account. When your organization stops using the platform, its data is retained for a 30-day grace period after offboarding and is then permanently deleted, with a record kept that the deletion happened. Shorter periods apply to operational records such as sign-in tokens, cached narration audio, and processing logs.

Product usage records are kept for 90 days. The daily counts we derive from them — how many people used a feature, and how many did not — are kept for two years, because judging whether a feature is worth keeping takes more than a quarter of evidence.

The full, per-asset commitments live in our data retention schedule, which this summary reflects and which is the authoritative version. We run the schedule on an automated monthly cycle.

10. Security

We protect this data with, among other measures:

– isolation enforced by the database, not by application code. Every customer's data carries its workspace identity and is filtered by database row-level security, using an unprivileged database role that cannot bypass those rules. Cross-workspace isolation is covered by automated tests.

– passwords stored only as per-user salted hashes;

– two-factor authentication, available to all users and required for our own privileged staff, with single-use recovery codes stored as hashes;

– lockout and throttling against password-guessing;

– mobile access tokens stored only as hashes, revocable on the server;

– an append-only audit trail;

– encryption of data in transit;

– automated secret scanning, dependency and container vulnerability scanning, and static security analysis on every change we ship.

Our current technical and organizational measures, including our hosting arrangements and encryption at rest, are described in Annex A of our data processing agreement, which we keep current. We describe them there rather than here so that this policy always states what is actually in operation.

11. Data breaches

If we confirm a security incident affecting a customer's data, we notify that customer within 72 hours of confirming it, and we notify individuals and regulators where the law requires. Our incident response plan sets out how we investigate, contain, and communicate.

12. Your rights

If you are in the EU, the UK, or Switzerland

You have the right to access the personal data we hold about you; to have it corrected; to have it erased; to restrict how we process it; to receive a portable copy; and to object to processing we carry out on the basis of legitimate interests. You also have the right to complain to your data protection supervisory authority.

If you are in a US state with a comprehensive privacy law

Depending on your state, you have the right to know what personal data we hold and where it came from; to access and receive a copy; to correct it; to delete it; and to appeal if we refuse a request. You may use an authorized agent. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not process sensitive personal data — so the rights to opt out of those, while they apply to us in principle, have nothing to act on. We will not discriminate against you for exercising a right.

How to exercise a right

Email support@exonix.com. We will verify that you control the account email address on file, then respond within 30 days, extending only where the law allows and telling you inside the original window if we do.

Requests about your organization's business content are routed to your organization's administrator, since that content is under their control and not ours to change.

Two things to set expectations honestly: export and deletion are carried out by our operations team through a controlled internal procedure, not by a self-service button in the product; and deleting data from our live systems does not instantly remove it from backups, which roll off within 35 days.

13. Children

The platform is a business tool, provisioned by administrators, and is not directed to anyone under 18. We do not knowingly collect personal data from children.

14. Changes to this policy

We update this policy through our change management process whenever our practices or our providers change. Every version carries a version number and an effective date, and the change history is published alongside it. The version shown in the product is always the current one. We notify customers of material changes.

15. Contact

– Privacy and data protection: support@exonix.com

– Postal: Access-Exonix JV, LLC, 1001 N Charles St Ste 800, Baltimore, MD 21202

– Security vulnerability reports: see SECURITY.md in our public repository.