Privacy policy

Legal review required: this draft reflects how the software is built. A qualified lawyer must review it, confirm the legal entity, and add jurisdiction-specific sections (e.g. GDPR/UK GDPR lawful bases, CCPA/CPRA notices) before launch.

Who we are

X09 AI is operated by [Legal entity name, address]. Contact: support@x09.tech.

What we collect

• Account data: email, name, a salted hash of your password, optional two-factor secret, preferences.
• Content you create: conversations, documents (as extracted text), knowledge items, writing, code files, research reports, workflows and saved outputs.
• Usage records: for each AI request, the tool, model, token counts, cost and time. We do not log the content of prompts in operational logs.
• Billing data: subscription status and identifiers from Stripe, Apple or Google, depending on where you subscribed. Card details are collected and stored by those companies, never by X09.
• Security data: session records (device type, browser user agent, last active time) and IP addresses used for rate limiting and abuse prevention.

What we don't collect

• Raw rows from files you open in Data Analysis (processed on your device).
• Images you analyze (sent for a single request, not stored).
• Advertising or cross-site tracking data. The apps use no third-party analytics or ad trackers.
• Crash reports. Errors are kept only on your device unless you choose to send them to support.

How we use data

To provide the service, enforce plan limits, process payments, keep accounts secure, and respond to support requests. We do not sell personal data and do not use your content to train AI models.

Service providers

• Anthropic processes prompts and included content to generate responses. Under Anthropic's commercial terms, API data is not used to train its models.

  Legal review required: confirm current Anthropic data retention terms and link them.

• Cloudflare hosts the application and database.
• Stripe processes web payments. Apple and Google process subscriptions bought in the iPhone and Android apps.
• Email provider (if enabled) sends password-reset emails.

Retention

Your content is kept until you delete it or delete your account. Expired sessions and reset links are removed automatically. Usage records are kept for financial and abuse-prevention purposes and are de-identified when you delete your account.

Legal review required: set retention periods for de-identified usage and billing records.

Your choices and rights

Export everything we store about you as JSON, or permanently delete your account, from Settings → Data & privacy. You can also contact us to access, correct or delete data.

Security

Data is encrypted in transit. Passwords are hashed with PBKDF2. Sessions can be revoked from Settings. Every database query is scoped to your account.

Children

X09 AI is not directed to children under 16 and they may not create accounts.

Changes

We'll notify you in the app or by email before material changes take effect.