Introduction
XAI Agency ("we," "our," or "us") is an AI-powered digital agency that provides businesses with intelligent automation, custom AI agents, and embeddable customer support solutions. We are committed to protecting the privacy and security of all personal data entrusted to us — whether by the businesses (our "Clients") who use our platform, or by the end-users who interact with AI-powered widgets deployed on our Clients' websites and applications.
This Privacy Policy explains what data we collect, why we collect it, how we use and protect it, and the rights available to you. It applies to all services provided through xai-agency.vercel.app and any associated sub-domains or APIs.
By accessing or using our services, you acknowledge that you have read and understood this policy. If you do not agree to these terms, please discontinue use of our services.
Data We Collect
We collect data across several categories, depending on your role (website visitor, Client admin, or end-user of an embedded widget):
- IP address and approximate geographic location (city/country level)
- Browser type, version, and operating system
- Device type (desktop, mobile, tablet)
- Referring URL and pages visited within the Client's website
- Session identifiers and timestamps
- Visitor email address (only if voluntarily provided in the chat widget)
- Chat messages and conversation history with the AI agent
- Full name and business email address
- Encrypted authentication credentials (hashed passwords or OAuth tokens)
- Workspace name, configuration settings, and API preferences
- Billing information (name, country — full card details are handled exclusively by Stripe)
- Support agent profiles (name, role, email) within a Client's workspace
- URLs submitted for website crawling and indexing
- Uploaded documents (PDFs, Word files, plain text) and their extracted content
- Vector embeddings generated from the above content, stored per workspace
- Full conversation logs between end-users and the AI agent
- AI confidence scores and retrieved source chunks for each response
- Escalation events (handoffs from AI to human agents)
- CSAT (Customer Satisfaction) ratings and feedback, where collected
- Session metadata: start/end times, message count, resolution status
- Stripe Customer ID and Subscription ID (non-sensitive identifiers only)
- Plan tier, billing cycle, and payment status
- Invoice history (accessible within your account dashboard)
How We Use the Data
We use the data we collect for the following purposes:
- Generating vector embeddings from ingested documents and URLs using LangChain and OpenAI's Embeddings API
- Performing similarity search (RAG) against your workspace's knowledge base to produce accurate, context-aware responses
- Routing queries to large language models (OpenAI GPT series) to generate natural language answers
- Analyzing retrieval logs and escalation patterns to improve AI response quality
- Using CSAT feedback to surface underperforming topics in your knowledge base
- Monitoring system latency, error rates, and uptime for infrastructure stability
- Provisioning and maintaining your workspace and user accounts
- Processing subscription payments and sending invoices via Stripe
- Sending transactional emails (account confirmations, password resets, billing alerts) via Resend
- Providing Clients with aggregated, workspace-level analytics on widget usage, conversation volume, and resolution rates
- Internal monitoring of platform health via Vercel Analytics
We do not sell, rent, or trade your personal data to third-party advertisers or data brokers, under any circumstances.
Data Sharing & Third Parties
We engage the following sub-processors to operate our platform. All vendors are bound by contractual data processing agreements and industry-standard security obligations:
| Vendor | Purpose | Data Shared |
|---|---|---|
| OpenAI | LLM inference and text embeddings | User chat messages, knowledge base content chunks |
| Vercel | Hosting, edge functions, and server-side rendering | Server logs, IP addresses, request metadata |
| Cloudflare R2 | Object storage for uploaded documents | Uploaded files (PDFs, documents) |
| Stripe | Payment processing and subscription management | Billing name, email, country, payment status |
| Resend | Transactional email delivery | Recipient email address, email content |
| Upstash (Redis) | Caching, rate limiting, and background job queuing (BullMQ) | Temporary session data, job payloads |
| Neon / PostgreSQL | Primary database with pgvector for vector storage | All structured data and vector embeddings |
We may also disclose your data if required by applicable law, court order, or government authority, or to protect the rights, property, or safety of XAI Agency, our Clients, or the public.
Data Retention
We retain data only for as long as necessary to fulfil the purposes described in this policy:
- Chat logs & conversation history: Retained for 12 months from the date of the conversation, after which they are automatically deleted from our primary database.
- Uploaded documents & crawled content: Retained for the lifetime of your active workspace. Deleted within 30 days upon account termination or explicit deletion request.
- Vector embeddings: Deleted immediately upon document deletion or workspace termination.
- Active user accounts: Retained for the duration of the subscription and 90 days following cancellation, to allow for account recovery.
- Inactive accounts: Accounts with no activity for 24 consecutive months may be automatically purged, following a 30-day email notice.
- Billing records: Retained for 7 years in compliance with financial and tax regulations.
- Server and access logs: Retained for 90 days for security and debugging purposes.
Security Measures
We implement robust technical and organizational measures to protect your data against unauthorized access, loss, or disclosure:
- Encryption in transit: All data transmitted between clients, users, and our servers is encrypted using TLS 1.2 or higher (HTTPS).
- Encryption at rest: Data stored in our PostgreSQL database and Cloudflare R2 is encrypted at rest using AES-256.
- Authentication: Secure session management via JSON Web Tokens (JWT) with short expiry windows. Passwords are hashed using bcrypt with a minimum cost factor of 12.
- Workspace isolation: All vector embeddings and knowledge base data are strictly isolated by workspace ID, preventing cross-tenant data leakage at the database and retrieval layer.
- Rate limiting: API endpoints are rate-limited via Upstash Redis to mitigate abuse and brute-force attacks.
- Access controls: Internal access to production data is restricted on a need-to-know basis, with audit logging for all access events.
- Dependency security: We regularly audit and update third-party dependencies to patch known vulnerabilities.
No system is completely immune to security risks. We encourage Clients to use strong, unique passwords and enable two-factor authentication where available. Please report any suspected security vulnerabilities to us immediately.
User Rights
Depending on your jurisdiction, you may have the following rights with respect to your personal data. We honour these rights for all users, regardless of location:
- Right of Access: You may request a copy of the personal data we hold about you.
- Right to Rectification: You may request correction of inaccurate or incomplete personal data.
- Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal data, subject to our legal retention obligations.
- Right to Data Portability: You may request a machine-readable export of your data in a common format (e.g., JSON or CSV).
- Right to Object: You may object to certain processing activities, such as the use of your data for analytics.
- Right to Restrict Processing: In certain circumstances, you may request that we limit how we use your data.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at the details in Section 11. We will respond to all verified requests within 30 days. We may ask you to verify your identity before processing your request.
Cookies & Tracking
We use minimal, strictly necessary cookies and tracking technologies:
- Used to maintain your authenticated session within the Client dashboard. These are HttpOnly, Secure cookies that expire at the end of your browser session or after a configurable inactivity timeout.
- When an end-user interacts with an embedded chat widget, a unique session token is stored in
localStorageto persist the conversation across page navigations within the same site. - No cross-site tracking is performed. Widget data is scoped entirely to the Client's domain.
- We use Vercel Analytics on our own website (xai-agency.vercel.app) to measure page performance and visitor behaviour using privacy-preserving, aggregated metrics. No personal identifiers are collected through this mechanism.
- We do not use Google Analytics, Facebook Pixel, or any third-party advertising trackers on our platform.
You may disable cookies in your browser settings; however, doing so may impair the functionality of the Client dashboard.
International Data Transfers
XAI Agency operates globally, and some of our third-party vendors process data in jurisdictions outside your country of residence, including the United States and the European Union. Specifically:
- OpenAI processes data on servers primarily located in the United States. By using our AI-powered features, you acknowledge that your chat messages and knowledge content may be transmitted to and processed by OpenAI in the US.
- Cloudflare R2 may store objects in globally distributed edge locations. You may configure your bucket region during workspace setup.
- Vercel deploys serverless functions at globally distributed edge nodes, which may process requests in regions close to the end-user.
- Stripe processes payment data under its own Privacy Policy and complies with applicable financial data regulations globally.
Where required by applicable data protection law (e.g., GDPR), we rely on lawful transfer mechanisms such as the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), or the vendor's own adequacy certifications.
Policy Updates
We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or industry best practices. The "Last Updated" date at the top of this page will always reflect the most recent revision.
For material changes — those that meaningfully alter your rights or our data practices — we will notify you by:
- Sending an email to the primary address associated with your Client account at least 14 days before the changes take effect.
- Displaying a prominent in-app banner within the Client dashboard.
- Updating the version number and effective date on this page.
Your continued use of our services after the effective date of any updated policy constitutes your acceptance of the revised terms. If you do not agree, you should discontinue use and contact us to delete your account.
Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact our privacy team:
Get in Touch
We aim to respond to all privacy-related enquiries within 2 business days. For data deletion or export requests, please allow up to 30 days.
Email: krishilagrawal026@gmail.com
Company: XAI Agency
Website: xai-agency.vercel.app
For EU/EEA residents: If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local Data Protection Authority (DPA).