About this Privacy Notice. We, XRAY AI, Inc. offer AI-based internal business intelligence services through our digital platform. This Privacy Notice is meant to give you information about what personal data we collect about you, how we use it, why we use it, and how you control the data processing. We recommend that you routinely review this privacy notice and your preferences on our platform, as we may update it from time to time. Our offices are located at 12724 Machiavelli Way, Palm Beach Gardens, FL, USA, 33418. If you have questions about our company or your privacy, or want to exercise your rights, you can contact us at support@xrayai.ai.
Table of Contents
1.The Basics: Definitions, Our Role, and Legal Bases
2.Personal Data we Collect as a Processor
3.Personal Data We Collect as a Controller, How We Use it, and Why
5.Sharing the Personal Data We Collect
6.International Transfers
7.Security
8.Your Rights - How to Control Our Use of Your Personal Data
9.Data Retention
10.Cookies and Similar Technologies
11.Third-Party Services
12.Children
13.Changes to the Privacy Notice
1.The Basics
1.1.Definitions
When we refer to "services", we mean the AI-based internal business intelligence services available through our platform. Using our platform, c-suite executives can use the raw data of their company's internal systems to generate insights into how to improve their business, including identifying issues and suggesting improvements.
When we refer to "personal data", we mean information that is defined as personal data under law. This includes information that identifies you directly or indirectly, including unique identifiers like IP addresses or cookie IDs.
When we refer to "you", we mean any user of our platform, and when we refer to the "customer", we mean the organization who is our customer and on whose behalf you access the services.
1.2.Our Role: Controller and Processor. Certain data protection laws, including the laws in the EU, differentiate between a party that determines why and how personal data is processed (called a "controller") and a party that processes personal data solely on the controller's behalf and according to the controller's instructions (called a "processor"). We are the controller in respect of the processing described in this Privacy Notice. That said, in respect of certain personal data, we serve as a processor. Please see the section below on Personal Data We Collect as a Processor for more information. Additional entities who may be serving as separate, independent controllers are listed below.
1.1.A Note on Legal Bases. Certain jurisdictions only allow the processing of personal data where a legal basis has been established. Under the EU's General Data Protection Regulation ("GDPR"), the possible legal bases include (but are not limited): your consent, the processing is necessary to perform a contract with you, the processing is necessary to fulfill our legal obligations, or a company has a legitimate business interest to process your personal data. Where we are a controller, we only collect and process data where we have established a legal basis. Below you can find more details about specific legal bases. You are not required under law to provide us with the Personal Data described in this Privacy Notice. However, if you do not agree to provide the same, we will not be able to provide you with some or all of our Services.
2.Personal Data We Collect as a Processor. We process certain personal data about our customers' personnel and their own customers when we provide services to our customers. In that case, we serve as a processor and the customer serves as a controller. We process that data on behalf of the relevant customer and according to its instructions. If you are an employee, subcontractor, or customer of one of our customers, we may process any personal data contained in the customer's internal systems that our customer chooses to share with us. To learn more about our processing activities in this capacity or to exercise your privacy rights regarding them, please contact the applicable customer directly.
Back to top
3.Personal Data We Collect as a Controller, How We Use It, and Why. Below is a description of the types of personal data we collect, how we use it, and the reason why we consider each use lawful. You have no legal obligation to provide us with personal data, but if you don't provide us with certain information, we may not be able to provide you with the associated services.
3.1.Registration Data – In order to access our platform, you must first create an account. To create an account, the customer will provide us with your name, email address, the name of your company, and a username and we will provide you with login credentials or enable an approved authentication method.
How We Use this Data: We use your registration information to grant you access to our platform, save your preferences, protect the security of our platform, prevent fraud, and address any issues that arise. We use your contact details to communicate with you about our platform when necessary. We may also use your contact details to provide you with promotional materials we think may be of interest to you.
Legal Basis: When we process your registration data to provide you with our services, we do so to perform a contract with you, in this case, our agreement with the customer. When we process your registration data to maintain our platform, including to prevent fraud, protect the security of and/or address issues with our platform, we do so on the basis of our legitimate interest to maintain our assets. Processing your Personal Data to share our promotional materials with you is based on our legitimate interest to promote our products and services.
3.2.Communications – When you communicate with us, we collect any data you provide, such as your name, company, email, and the content of your message.
How We Use this Data: To respond to your message and address the subject of your inquiry. We may also use your communications data to provide, operate, secure, support, analyze, and improve the service and provide you with promotional materials we think may be of interest to you.
Legal Basis: When we process this data to respond to your message and/or to provide you with our services including our support services, we process this personal data based on the performance of a contract with you. When we process this personal data to secure, analyze, and improve the service, we do so based on our legitimate interests to maintain and improve our products and services. Processing your Personal Data to share our promotional materials with you is based on our legitimate interest to promote our products and services.
3.3.Call Recordings – When you call us on the phone or through a video conferencing tool, we may record the conversation and create a transcript and/or a summary of the discussion.
How We Use this Data: We use these recordings, transcripts, and summaries to provide, operate, secure, support, analyze, and improve the services.
Legal Basis: We process this data based on your consent. You may withdraw your consent at any time by emailing us at support@xrayai.ai.
3.4.Activity and System Data (Including Cookies) – When you visit our platform, we automatically collect data about your computer or mobile device, including personal data such as your IP address, device ID, browsing history (e.g. the other sites you've visited before ours), usage data, metadata, and your activity on our site (e.g. what pages you visited, for how long, and what links you clicked on). For more information about the cookies we use and how to adjust your preferences, see the Cookies and Similar Technologies section below.
How We Use this Data: We mainly use this data to generate aggregated analytics data about the use of our platform so we can maintain and improve the platform and develop new products or services. We also use statistical data to prevent fraud and protect the security of our platform. In addition, we use analytics data for company and business management purposes, including customer retention, analyzing usage patterns and predicting customer needs.
Legal Basis: We process this personal data based our legitimate interests to develop and improve our products and services, and to prevent fraud.
Back to top
4.Defense of Legal Rights. In addition to the uses of personal data set forth above, we also use personal data, if necessary, to establish, exercise, or defend our legal rights or those of others, including enforcing our rights under any customer agreement and/or this Privacy Notice, as well as for dispute resolution purposes.
5.Sharing the Personal Data We Collect. We share your personal data as follows:
5.1.Affiliates. We share your personal data, with our affiliated companies, where this is necessary to provide you with our products and services and so that we can manage our business, such as to keep updated records of our customers and users.
5.2.Customers. The customer on whose behalf you access our services may have access to information about your use of our services. For example, a user with an administrator account may be able to see your data.
5.3.Service Providers. Below is a list of the types of service providers we use, the service each provides, and the types of data shared with each. All service providers have agreed to confidentiality restrictions and have undertaken to use your personal data solely as we direct.
Type of Service | Description | Personal Data Shared |
Cloud Computing | We use service providers that offer cloud computing services. They offer us space on their servers for us to store our files and programs, including your personal data. | All personal data that we collect from you is stored on third party servers. |
Customer Relationship Management (CRM) | We use an external CRM tool to help us keep track of our customers and information related to them, including their personal data. | your name, company, position, email address, and phone number. |
Analytics Providers | We use a service provider to assist us with analytics services. | Data collected automatically through our platform, including IP addresses and cookie information. |
AI Tool Providers | We use various AI tools where reasonably necessary to provide, operate, secure, support, analyze, and improve the service. | Communications data and analytics data. |
Authentication/SSO Providers | We use third-party tools to authenticate users and secure their connection to our platform. | Login credentials. |
Meeting Transcription Tools | We use third-party tools that record, transcribe, and summarize calls and meetings with our customers and users. | Recordings of calls and video conferences. |
5.4.Change of Ownership. If we are looking to sell our company, liquidate assets, or merge with another, we may share your personal data with other interested parties as part of negotiations toward that transaction. In such case, or where we do sell our company, your personal data shall continue to be subject to the provisions of this Privacy Notice.
5.5.Law Enforcement Related Disclosure. We may share your personal data with government agencies or other relevant parties, such as a law office or independent auditor: (i) if we believe that such disclosure is appropriate to protect our rights, property or safety (including the enforcement of the customer agreement and this Privacy Notice) or those of a third party; (ii) if required by law or court order; or (iii) as is necessary to comply with any legal and/or regulatory obligations, such as audit requirements.
6.International Transfers. Some of our service providers are located in countries other than your own. When we transfer your personal data internationally, we will do so safely and securely and in accordance with applicable law.
6.1.If you are located in the EU, when we share your personal data with third parties based outside of the European Economic Area ("EEA"), we will ensure that they sign agreements that require them to comply with applicable law and make sure that your data protection rights are protected. We will also implement the following safeguards:
6.1.1.We rely on the decision by the European Commission that says that the applicable countries are considered to provide an adequate level of data protection When we transfer your personal data to such countries.
6.1.2.When we transfer your personal data to entities in the US that are covered under the Data Privacy Framework, we rely on the decision by the European Commission that says that these entities are considered to provide an adequate level of data protection.
6.1.3.Where we transfer your personal data to other countries, we (i) take additional security measures to protect the data and (ii) use specific contracts approved by the European Commission, known as the Standard Contractual Clauses, to give your personal data the same protection it has in the EEA.
7.Security. The security of your personal data is our highest priority. We work hard to make sure that your personal data will be held securely and that it will not be shared or lost accidentally. However, it is impossible to guarantee absolute security. The security of your data also depends on the security of the devices you use and the way in which you protect your user IDs and passwords. The measures we take include:
7.1.Technical Measures. The electronic safeguards we employ to protect your personal data include secure servers, firewalls, and antivirus protections. We encrypt data in transit using secure HTTPS/TLS protocols and at rest using a variety of methods, including provider-managed encryption, IAM-based access controls, managed secrets, and least-privilege permissions.
7.2.Access Control. We limit access to your personal data only to authorized personnel who have a need to know, including authorized XRAY personnel with a legitimate business need, such as providing support, operating the services, troubleshooting, security review, incident response, or maintaining production systems. Access is role-based, granted according to least-privilege principles, and approved through our internal access management process. We review these permissions regularly and revoke an employee's access immediately after his/her termination.
7.3.Internal Policies. We maintain and regularly review and update our privacy related and information security policies.
7.4.Personnel. We require employees to sign non-disclosure agreements according to applicable law and industry standard practice.
7.5.Database Backup. Our databases are backed up and verified regularly. Backups are encrypted and stored within the production environment to preserve their confidentiality and integrity.
8.Your Rights - How to Control Our Use of Your Personal Data. Depending on which laws apply, you have certain legal rights over your data. Below is some general information about rights that may apply to you but we recommend checking the law or consulting with a lawyer to understand what applies in your specific case. We may ask for reasonable evidence to verify your identity before we can comply with any request.
8.1.Right of Access. You may have a right to know what personal data we collect about you. We may charge you with a fee to provide you with this information, if permitted by law. If we are unable to provide you with all the information you request, we will do our best to explain why. See Article 15 of the GDPR for more details, if your personal data is subject to GDPR.
8.2.Right to Correct Personal Data. You may request that we update, complete, correct or delete inaccurate, incomplete, or outdated Personal Data. See Article 16 of the GDPR for more details, if your personal data is subject to GDPR.
8.3.Deletion of Personal Data ("Right to Be Forgotten"). If you are located in the EU, you may have the right to request that we delete your personal data. Note that we cannot restore information once it has been deleted. Even after you ask us to delete your personal data, we may be allowed to keep certain data for specific purposes under applicable law. See Article 17 of the GDPR for more details, if your personal data is subject to GDPR.
8.4.Right to Restrict Processing. If you are located in the EU, you may have the right to ask us to stop processing your personal data. See Article 18 of the GDPR for more details, if your personal data is subject to GDPR.
8.5.Right to Data Portability. If you are located in the EU, you may have the right to request that we provide you with a copy of the personal data you provided to us in a structured, commonly-used, and machine-readable format. See Article 20 of the GDPR for more details, if your personal data is subject to GDPR.
8.6.Right to Object. If you are located in the EU, you may have the right object to certain processing activities. See Article 21 of the GDPR for more details, if your personal data is subject to GDPR.
8.7.Withdrawal of Consent. If we are processing your data based on your consent, you are always free to withdraw your consent, however, this won't affect processing we have done from before you withdrew your consent.
8.8.Right to Lodge a Complaint with Your Local Data Protection Authority. If you are located in the EU, you have the right to submit a complaint to the relevant data protection authority if you have any concerns about how we are processing your personal data, though we ask that as a courtesy you please attempt to resolve any issues with us first.
8.9.Your Rights Under the CCPA. If you are a resident of the State of California, depending on the applicability of certain laws and exemptions, you may have certain rights over your data, as detailed in Annex A to this Privacy Notice.
9.Data Retention. We retain your personal data as long as necessary to fulfill each of the purposes we described above. Once we're done with your data, we delete it. When deciding how long to store personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized access, the purposes for which the personal data was collected, as well as applicable legal requirements. Please note that we may delete information from our systems without notifying you first. Retention by any of our service providers or subcontractors may vary in accordance with each business's retention policy. In some circumstances, we may store your personal data even after we're finished processing it if required to do so by law (e.g. to fulfill tax or audit requirements), or to keep accurate records of our interactions in case there is a prospect of litigation relating to your personal data. In such cases, we will maintain the same security measures as described above.
10.Cookies and Similar Technologies
10.1.What are Cookies? A cookie is a small piece of text that is sent to your browser by a website you visit. This piece of text acts as a sort of tag, letting the website know that it's you (really, your device) that's visiting. There are other technologies that act similarly, like web beacons, pixel tags, and Device IDs for apps, but for simplicity's sake we'll refer to them all as "cookies".
10.2.First-Party / Third-Party Cookies. Websites can place their own cookies (called "first-party cookies") but can also place cookies from other sites (called "third-party cookies"). If your browser holds both first and third-party cookies for a given website, both the website and the third party are notified when you visit the site. We may place both first and third-party cookies on our platform.
10.3.How We Use Cookies. While the specific names and types of cookies we use may change from time to time, they generally fall into one of the categories listed below. We will not place any cookies on your browser that are not strictly necessary unless you have first consented to receive them.
Cookie Type | Function |
Necessary | These cookies allow the platform to work correctly. They enable your access to the platform, move around, and access different services, features, and tools. These cookies may also help us identify and prevent security risks. They may be used to store your session information to prevent others from changing your password without your login information. These cookies cannot be disabled. |
Functionality | These cookies remember your settings, preferences, and other choices you make (like placing an item in a shopping cart) in order to help personalize and streamline your experience. |
Performance/Analytics | These cookies collect analytical information to help us understand how you use our platform, for example whether you have viewed messages, clicked on links, and how long you spent on each page. This helps us improve our platform to better suit your needs. |
10.4.Third Party Cookies. In addition to our first-party cookies, we place cookies from the third parties listed below who serve as independent data controllers of your personal data and who process such data in accordance with their respective privacy notices:
a.PostHog
b.HubSpot
10.5.How to Adjust Your Preferences. Most web browsers are initially configured to accept cookies, but you can change the settings so your browser refuses all cookies or certain types of cookies. In addition, you are free to delete any existing cookies at any time. Please note that some features of the services may not function properly when cookies are disabled or removed. For example, if you delete cookies that store your account information or preferences, you will be required to input these each time you visit.
11.Third-Party Services. You may have access to third-party services through our services. Please note that all use of third-party services is at your own risk and subject to such third party's terms and privacy policies. We do not take any responsibility for the performance of other services.
12.Children. We do not knowingly collect nor transfer personal data from/of children under the age of sixteen (16). In the event that you become aware that an individual under the age of sixteen (16) has registered without parental permission, please advise us immediately.
13.Changes to the Privacy Notice. We may update this Privacy Notice from time to time to keep it up to date with legal requirements and the way we operate our business. We will place any updates on this webpage. Please come back to this page every now and then to make sure you are familiar with the latest version.
Annex A
Your Rights Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA)
Applicability of the CCPA. Please note that the CCPA may not apply to us based on our current business operations and the applicable statutory thresholds. Nevertheless, as a matter of good faith and our commitment to transparency, we voluntarily provide California residents with the rights and disclosures set forth above. Nothing in this Annex shall be construed as an admission that the CCPA applies to us.
If you are a resident of the State of California, depending on the applicability of certain laws and exemptions, you may have certain rights over your data. Below is some general information about rights that may apply to you. We recommend that you check the law or consult with a lawyer to understand what applies in your specific case. We may ask for reasonable evidence to verify your identity or to verify that you have been authorized to act on behalf of the relevant individual. For the purposes of this section, "personal data" shall have the meaning of "Personal Information" as defined under the CCPA.
1.Right to Know. You have the right to request that we disclose to you any or all of the following in respect of the 12-month period preceding your request:
-The specific personal data we have collected about you.
-The categories of personal data we have collected about you.
-The categories of sources from which we collected the personal data about you.
-The categories of third parties to whom we disclose personal data about you.
-The categories of personal data about you we have sold and the categories of third parties to whom we have sold such personal data.
-The categories of personal data about you we have disclosed for a business purpose and the categories of third parties to whom we have disclosed such personal data.
-Our business or commercial purpose(s) for collecting or selling your personal data.
2.Right to Delete. Subject to certain exceptions, you have the right to request that we or any of our service providers delete your personal data.
3.Right to Correct. You have the right to request that we correct any inaccurate personal data that we maintain about you, considering the nature of the personal data and the purposes of the processing of the personal data.
4.Right to Opt-Out of the Sale or Sharing of Personal Data. If you are 16 years of age or older or have consented to the sale of your personal data, you have the right to direct that we do not sell or share your personal data at any time. You may change your mind and opt back into the sale of your personal data at any time by contacting us. We may deny any request to opt-out of the sale of personal data that we deem in our good-faith, reasonable and documented belief is fraudulent.
5.Right to Limit Use and Disclosure of Sensitive Personal Data. To the extent we collect any sensitive personal data about you, you have the right to instruct us to limit our use of such personal data only to for the purpose of providing you with our services and certain business operation purposes.
6.Right to Non-Discrimination for Exercising your Consumer Privacy Rights. You have the right not to be discriminated against for exercising any of your consumer privacy rights, such as, not being denied any goods or services or charged different prices or rates.
7.How to Exercise your California Privacy Rights
-Contact Information. To exercise any of the rights detailed above, please submit a verifiable request to us by contacting us at support@xrayai.ai. You may only request to exercise your right of access twice within a 12-month period.
-Submitting a Verifiable Request. In order to exercise your right to know or right to delete you must submit a request containing sufficient information that allows us to reasonably verify you are the person about whom we collected the applicable Personal Data or an authorized agent of such person, which may include details relating to your account. Any requests made through your password protected account will be verified through our existing authentication procedures for such an account.
-Submitting Requests through an Authorized Agent. An authorized agent may exercise requests on your behalf. In order to exercise your right to know or right to delete through an agent, we may ask for reasonable evidence to verify your identity and the agent’s identity, and written authorization permitting the agent to act on your behalf before complying with your request. In order to submit a request to opt-out of the sale of your personal data through an agent, we may ask for written authorization permitting the authorized agent to act on your behalf before complying with your request. We reserve the right to deny the request of any agent that does not provide proof that they have been authorized to act on behalf of the applicable consumer in accordance with applicable law.
8.The Past 12 Months. In the past 12 months we have not "sold" nor "shared" (as such terms are defined in the CCPA) any personal data about you. In the past 12 months, we have disclosed the following categories of personal data for a "business purpose" (as defined in the CCPA), all as specifically detailed in Section 2 of the Privacy Notice:
a.Category A: Identifiers such as a real name, alias, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.
b.Category F: Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.