XEELAA Privacy Policy

1. Policy Application

This Privacy Policy applies to the processing of personal information of the following categories of data subjects:

• • Website Visitors: Those who visit our Websites, including those who register for product trials, view documentation, or interact with public support links.
• • Customers and Administrative Users: Individuals and business entities who enter into an agreement with XEELAA to use our AI Operating System, conversational memory APIs, WhatsApp dual-node gateways, or Universal Action Engine, as well as team members authorized to access customer accounts.
• • End-Users of Customer Chatbots: End-users who interact with chatbots deployed by our Customers on websites or WhatsApp. For these interactions, our Customer acts as the data controller and XEELAA acts strictly as a data processor under our customer agreement.

2. Information We Collect (Categories of Data Subjects)

We collect information directly from you, automatically through your use of the platform, and through authorized integrations:

• • Account Credentials: Full name, verified email address, avatar, and hashed passwords collected during account creation or Google OAuth registration.
• • Conversational Data & Prompts: Prompts, chat queries, uploaded files (PDF, DOCX, CSV, TXT), and voice recordings submitted to our AI models or indexed into knowledge bases.
• • Vector Embeddings: 1,536-dimensional semantic representations derived from conversations and training data, indexed in PostgreSQL using PGVector for similarity matching.
• • Connected Account Credentials: Encrypted OAuth refresh tokens and API secret keys for third-party integrations (Google Workspace, Microsoft 365, LinkedIn, Slack, Shopify, Stripe, etc.).
• • Usage & Diagnostic Telemetry: Log files, IP addresses, browser user-agents, request timestamps, response latencies, and system performance metrics.

3. How We Use Information

We use collected personal information solely for legitimate business operations:

• • To provide, operate, maintain, and improve the XEELAA AI Operating System.
• • To perform semantic similarity searches and inject relevant context into AI conversations.
• • To execute user-authorized actions across external SaaS services via our Action Engine.
• • To process billing, manage subscription quotas, and prevent denial-of-service abuse.
• • To send transactional notices, security alerts, and system status communications.

4. Data Aggregation & Memory

XEELAA may aggregate anonymized usage telemetry across the platform to evaluate system reliability, cache hit rates, and queue throughput. We never aggregate or cross-pollinate private vector knowledge bases between distinct accounts: all vector embeddings are partitioned strictly with tenant-level isolation.

5. Information Sharing

We share information only under strict contractual safeguards:

• • Foundational AI Providers: Prompts are dispatched to upstream model endpoints (such as OpenAI or DeepSeek) to generate responses. Prompts processed on private, locally-hosted models remain on your infrastructure.
• • Authorized SaaS Services: When you trigger an action (such as drafting an email or updating a CRM deal), parameters are passed to the recipient service on your command.
• • Infrastructure Subprocessors: Cloud hosting, database clusters, and Redis instances operating under strict data processing agreements.
• • Legal Compliance: When required by valid subpoenas, court orders, or applicable Nigerian and international law to protect life or prevent cyber fraud.

6. Notice to International Users

XEELAA adheres to international privacy principles, including the Nigeria Data Protection Act (NDPA), the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA). Users in protected jurisdictions maintain full rights of access, portability, and erasure.

7. International Transfers

Data may be processed across secure data centers located in Nigeria, the European Union, and North America. Where cross-border transfers occur, we implement Standard Contractual Clauses (SCCs) and robust cryptographic standards to preserve data integrity.

8. Data Subject Rights & Choices

You maintain the right to:

• • Access and review the personal information associated with your account.
• • Correct inaccurate profile attributes or update knowledge base entries.
• • Request complete erasure of your conversation histories and vector embeddings.
• • Export your data in structured, machine-readable JSON format.

To exercise these rights, submit a verified request to hello@xeelaa.com.

9. Communication Preferences

You can manage notification preferences in your dashboard settings. Transactional emails (such as billing receipts and security alerts) cannot be disabled as they are essential to account security.

10. Security & Access

We implement defense-in-depth measures, including AES-256-GCM encryption for integration secrets, salted Bcrypt password hashing, TLS 1.3 transport security, role-based access control, and automated audit logging.

11. Data Retention

Personal data and vector embeddings are preserved while your workspace remains active. API audit logs are pruned after 90 days. Backups are retained on an encrypted 30-day rolling rotation.

12. Notification of Changes

If we enact material modifications to this Privacy Policy, we will notify registered users via email or platform notification prior to the change taking effect.

13. Business Transactions

In the event of a merger, acquisition, or sale of platform assets, customer data will remain subject to the commitments made in this Privacy Policy until a new policy is established.

14. Dispute Resolution & Governing Law

This Policy is governed by the laws of the Federal Republic of Nigeria. Inquiries or disputes shall be handled through our Data Protection Office, with escalation to competent courts sitting in Abuja, Nigeria.

15. Cookies & Tracking

XEELAA uses strictly essential cookies for authentication and CSRF security. We do not use third-party behavioral ad trackers. For a detailed matrix of cookies, refer to our Cookie Policy.

16. Contact Information

For inquiries, data access requests, or compliance questions: