Your documents are yours. We process them to run the AI employees you configure, and for nothing else.
No customer data trains any model, ours or a provider's.
We hold very little about you directly: your account, and what you told us when you got in touch.
We do not sell data, run ad tracking, or share with anyone beyond the three named subprocessors.
1. Who is responsible for what
XCM-AI Ltd, a company registered in the United Kingdom, operates the Xalios service. There are two distinct relationships and it matters which one applies.
Your content. When personal data sits inside the documents and systems your AI employees work with, you are the controller and we are the processor. We act on your instructions, and those instructions are set by how you configure the product. Our obligations there are in the data processing agreement, which forms part of the contract.
Data about you. For your own account details, our correspondence with you and this website, we are the controller. This notice covers that, and explains the content side so the whole picture is in one place.
2. What we hold
Account data
Name, work email, organisation, role, and the permissions granted to you. The minimum needed to give you access and attribute actions.
Usage and audit
Sign-ins, approvals you gave, configuration changes you made. This exists because a decision record has to be attributable; it is not behavioural profiling.
Correspondence
What you send us through the contact form, a demo request or email, and our replies.
Customer content
Documents you connect or upload, the memory built from them, and the decision records produced. Held as processor, on your instruction.
Website
Only what is needed to serve and secure the site, plus Google Analytics and the booking calendar if you consent to them. No advertising or cross-site tracking. See the cookie notice.
3. Why we hold it, and on what legal basis
Providing the service
Performance of a contract. Without account data there is no access, and without content there is no work to do.
Security and audit
Legitimate interests: keeping the service secure and making decisions attributable. It is also what makes the product defensible for you.
Replying to you
Legitimate interests, or steps towards a contract if you asked for a demo. You are not signed up to marketing by contacting us.
Legal obligations
Tax, accounting and responding to lawful requests. We keep only what those require.
Two things we do not do, stated because the question always comes: we do not use your content or usage data to train models, and we do not use it to build a product benchmark or case study without asking you first, in writing, about the specific thing.
5. International transfers
Storage is in the United Kingdom, one region, with no residency selection to offer. Model providers operate internationally, so text sent for inference may be processed outside the UK, under the UK International Data Transfer Addendum or equivalent safeguards. If processing must never leave the UK, tell us early, and we will tell you plainly whether we can meet that today.
6. How long we keep it
Customer content
For as long as your contract runs, then deleted within 30 days of termination unless you ask us to hold it longer in writing. Backups age out within a further 30 days.
Decision records
Same as content, but exportable first. They are usually the thing you most need to keep, so we will not delete them without confirming.
Account and audit
Up to 12 months after the contract ends, for security investigation and dispute handling.
Enquiries
24 months if nothing comes of it, then deleted. Tell us to delete it sooner and we will.
7. Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing based on legitimate interests, ask us to restrict it, and ask for it in a portable form. We respond within one month.
If your request concerns data inside a customer's documents, we are the processor and cannot act unilaterally. We will point you to the customer who controls it, and support them in responding. If you are not satisfied with how we handle a request you can complain to the Information Commissioner's Office, though we would rather you came to us first so we can fix it.
8. Security
Encryption in transit and at rest, a dedicated knowledge graph per organisation with tenant binding tested in CI, permissions enforced per request against the source system, and access to production limited to the people who need it. Our trust and compliance page starts with the certifications we do not hold, which is the part most notices leave out. If you believe you have found a vulnerability, contact us and we will tell you what to expect.
9. Automated decision-making
The product exists to let AI employees take actions, so this section deserves a straight answer. What they may do alone is granted by our customer, stated as a boundary in business terms, and enforced outside the model. Every decision is recorded with the documents it rested on and the trust level in force at the time, which means it can be explained and challenged rather than shrugged at.
Where a decision would have a legal or similarly significant effect on an individual, our expectation is that the customer keeps it supervised so a person decides. We do not use the product to make automated decisions about individuals for our own purposes.
10. Changes, and how to reach us
When this notice changes materially we tell customers directly rather than quietly updating a date. The date at the top always reflects the version in force.
Privacy questions, rights requests and complaints all go through the contact page and reach a person, not a queue.