Privacy Policy

Effective date: October 5, 2026

xysq is built on a simple belief: your memory belongs to you. This policy explains what data we collect, why we collect it, how we protect it, and the controls you have over it. We do not sell your data. We do not use your memories to train AI models. Everything you store stays yours.

1. Who We Are

xysq ("we", "us", "our") is a context platform for AI agents and teams. We run the website at xysq.ai, the app at app.xysq.ai, and the API at api.xysq.ai. To contact us about privacy, email privacy@xysq.ai.

2. What We Collect

Information you provide

Memories, the text content you or your AI agents store through xysq.
Files and images you upload, and images you attach in a chat.
WhatsApp messages and your phone number, if you use the WhatsApp agent, including any chat history you choose to import.
Email and calendar content, only if you connect Gmail or Google Calendar.
Public LinkedIn, X, and website content you choose to import.
Account information, your email address and display name, provided when you sign in through Auth0 (for example with Google).
Profile data, optional fields you choose to fill in: your role, company, focus, location, and preferences.

Information generated automatically

Activity logs, which agents accessed which memories and when (used for your dashboard, not for advertising).
API tokens, stored as one-way SHA-256 hashes; the raw token is shown to you once and never stored in plain text.
Usage metadata, memory counts, timestamps, and tags attached to memories.
Request logs, the time, the action called, your user ID, and your IP address for each request to our API.
Website analytics, our marketing site (xysq.ai) uses Google Analytics and the Apollo.io website tracker to understand visits to the site. The xysq app (app.xysq.ai) loads no analytics trackers.

What we do NOT collect

We do not take payments today, so we hold no payment information.
We do not read or analyse your memory content for advertising purposes.

3. How We Use Your Data

We use your data solely to operate and improve the xysq service:

Storing, indexing, and retrieving your memories on demand.
Authenticating you and your connected AI agents.
Displaying activity and usage statistics on your dashboard.
Sending account emails (such as invites and contact requests) and occasional product emails. Every product email has an unsubscribe link.
Diagnosing errors and improving reliability.

We never sell your data, share it with advertisers, or use your memories to train AI models.

4. Third-Party Services

We use the following sub-processors to operate xysq. Each is contractually bound to protect your data:

Provider	Purpose	Data shared
Amazon Web Services (AWS)	Our main host: servers, search index, and your wiki files (EC2); the AI models that read your content (Bedrock); daily backups of your vault and uploads (S3)	All of your content
Supabase	Database	Your account and profile, the text you save and upload, your wiki's facts and quotes, chats, WhatsApp history, and request logs (with IP address)
Google Cloud	Hosts the app's web pages (Cloud Run); reads images you attach in a chat and indexes your text for search (Vertex AI)	Web requests to the app (with IP address), images you attach, and the text of your memories
Auth0 (Okta)	Sign-in and identity, including Sign in with Google	Email, name, and the identity of the account you sign in with
Meta (WhatsApp Cloud API)	The WhatsApp agent, if you use it	Your phone number, messages, media you send, and chat history you import
Composio	Gmail and Google Calendar actions, only if you connect them	Access to your Gmail and Calendar, and the email and calendar content the agent reads or writes
LlamaIndex (LlamaParse)	Reads the text in PDFs you upload	The full PDF file
Resend	Sends our emails	Email addresses, names, and the content of the email
Mindcase	Imports public LinkedIn and X profiles and posts you ask us to import	Profile URLs and handles
Google Analytics	Visit statistics for xysq.ai (marketing site only)	Pages you view and details about your browser and device
Apollo.io	Website visitor tracker on xysq.ai (marketing site only)	Pages you view and your IP address

Your data is stored mainly in the USA (AWS, us-east-1) and Japan (Supabase, Tokyo). Google's Vertex AI processing runs in US regions. A few AI requests on AWS Bedrock use AWS global routing and can be processed in another AWS region.

If you connect your own AI client (ChatGPT, Claude, or another) to xysq over MCP, what that client sends and receives is also governed by that provider's privacy policy.

5. Data Retention

Memories, kept until you delete them or close your account. Deleting a source removes it and the lines drawn from it, but earlier copies can remain in your vault's version history and in our backups. Email us to erase those too.
Activity logs, kept as long as your vault exists.
Request logs (including IP address), deleted after 30 days. Error logs are deleted after 90 days.
Account data, deleted within 30 days of account closure.

6. Your Rights & Controls

You have full control over your data at all times:

Access, view all stored memories from your dashboard.
Edit, update or correct the text you saved. Files such as PDFs can't be edited, but you can delete them and upload a new version.
Delete, remove any source you saved from your vault. To wipe your whole vault, email us.
Export, request a full export of your data by emailing us.
Revoke access, delete a key on the Keys page and it stops working. Disconnect Gmail or Google Calendar on the Apps page and the agent can no longer act through them.
Close account, email us and we will delete your account and all associated data.

If you are in the European Economic Area (EEA) or the UK, you also have rights under GDPR including the right to restriction of processing and the right to lodge a complaint with your local supervisory authority. If you are in California, you have rights under the CCPA including the right to know, delete, and opt out of sale (we do not sell data).

7. Security

We apply industry-standard security measures to protect your data:

All data is encrypted in transit (TLS). Data held by Supabase and our backups on AWS S3 are encrypted at rest by those providers.
API tokens are stored as one-way SHA-256 hashes, we cannot recover your raw token.
Authentication is handled by Auth0 with RS256-signed JWTs.
Access to production systems is restricted to authorised personnel only.

If you discover a security vulnerability, please disclose it responsibly to security@xysq.ai.

8. Children's Privacy

xysq is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us at privacy@xysq.ai and we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time. When we do, we will update the effective date at the top and, for material changes, notify you via email or an in-app notice. Your continued use of xysq after changes take effect constitutes acceptance of the updated policy.

10. Contact Us

For privacy questions, data requests, or to exercise your rights, contact us at:

privacy@xysq.ai

We respond to all privacy requests within 30 days.