Effective date: June 24, 2026 Version: 2026-06-24
This Privacy Policy explains how xAct Labs, Inc. ("xAct," "we," "us") collects, uses, shares, and protects information in connection with the xAct.ai Service. It is incorporated into the End User License Agreement. By using the Service, you acknowledge this Policy.
For business customers, xAct processes Customer Content as your processor / service provider, on your instructions, to deliver the Service; you are the controller of the personal data you and your collaborators submit.
Account and profile data. Your email address, display name, organization, role, avatar (if you upload one), notification preferences, and the federated identity provider you use to sign in (e.g., Google or GitHub). Authentication is handled by Amazon Cognito.
Customer Content. The statements of intent, dialogue questions and answers, uploaded documents, course corrections, project and collaboration metadata, and the PRDs, task lists, and other artifacts generated from them.
Connection status. When you connect an external account (e.g., GitHub or Google) for data grounding, we store a connection-status record (provider, scope, status). We do not store your third-party OAuth access tokens — those are held in a managed, key-encrypted credential vault (AWS Bedrock AgentCore Identity) and are used only at the time of a dialogue turn. For the legacy repository-creation flow, a GitHub token may be stored on your user record to create the repository you request; you can disconnect to remove it.
Usage and operational data. Logs, request metadata, model-usage metering, error and performance telemetry, and records of consent (including your acceptance of this Policy and the EULA, with version, timestamp, and source IP address). We use minimal browser local storage for application state (e.g., your last-approved view); we do not use advertising cookies.
We use information to: operate, secure, and support the Service; conduct the AI dialogue and generate Output; enable collaboration among the participants you invite; send transactional and notification messages (including via email, and via Slack or Microsoft Teams where you configure them); meter and manage usage and limits; maintain audit and security logs; comply with law; and maintain and improve the Service. We record your acceptance of our agreements as a legal and compliance record.
To generate Output, the Service sends relevant Customer Content to large language models and embedding models hosted on Amazon Bedrock in the United States, including models provided by Anthropic, Amazon, and Meta. These models are accessed as a processing service to respond to your dialogue; Customer Content processed through Bedrock is not used by xAct to train foundation models. Some questions may trigger a web search through a third-party search provider to ground answers in public sources.
We share information with:
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
The Service is operated in the United States (AWS region us-west-2; a content-delivery and certificate edge may operate elsewhere). If you access the Service from outside the United States, you understand your information will be processed in the United States.
We apply technical and organizational safeguards, including encryption in transit (TLS) and at rest (AWS KMS-managed keys on our databases and storage), least-privilege access controls, an append-only audit log for sensitive actions, and isolation of third-party credentials in a managed vault. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security, particularly during the pre-release period.
We retain account data for as long as your account is active and as needed to provide the Service. Customer Content is retained to provide collaboration history and artifacts; audit and consent records are retained on an append-only basis for compliance. You can export a project's dialogue and artifacts, archive or delete projects, and delete your account; deletion removes data from active systems within a commercially reasonable period, subject to backups and legal-retention obligations.
Depending on your location, you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can update your profile and preferences in the application, disconnect external integrations, and delete projects or your account. To exercise rights or make a request, contact us at the address below; where xAct acts as a processor for a business customer, we will refer your request to that customer or act on their instructions. We will not discriminate against you for exercising your rights.
The Service is not directed to, and is not intended for use by, anyone under 18, and we do not knowingly collect personal information from children.
We may update this Policy. When we make material changes, we will update the version and effective date above and prompt you to review and accept the updated agreements before you continue using the Service. Your acceptance is recorded.
xAct Labs, Inc. — privacy@xact.ai.