Contact

Legal

Privacy policy

Last updated: October 26, 2026

1. Introduction

XPFlow, Inc. ("XPFlow," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit xpflow.app (the "Site") or otherwise engage with us in a business context, such as submitting a form or contacting our team.

By using the Site, you acknowledge the practices described in this policy.

2. Scope, and what this policy does not cover

This policy covers information we collect as a business through the Site and general commercial interactions, where we act as the controller of that information.

This policy does not cover data that we process on behalf of our customers within the XPFlow platform, Alfie, or the private AI environments we operate. When we handle partner or program data as part of delivering our services, we act as a processor or service provider under the instructions of the customer, and that processing is governed by the applicable customer agreement and Data Processing Agreement, not by this policy.

3. Information we collect

Information you provide to us. When you fill out a form on the Site (for example, to request access, contact the team, or express interest in the Advisory Council, investor relations, press, or careers), we collect the information you submit. This typically includes your name, business email address, company, role, and the content of your message.

Information collected automatically. When you visit the Site, we and our service providers may automatically collect certain technical information, which may include your IP address, device and browser type, operating system, referring pages, pages viewed, and the dates and times of your visits. We collect this through cookies and similar technologies (see Section 6).

Information from third parties. We may receive limited business contact information from analytics providers, marketing platforms, or professional networks, consistent with those parties' terms and applicable law.

We do not intentionally collect special categories of sensitive personal information through the Site, and we ask that you not submit such information through Site forms.

4. How we use information

We use personal information to:

  • Respond to your inquiries and route them to the appropriate team.
  • Evaluate and process requests for access, demos, or program participation.
  • Operate, maintain, secure, and improve the Site.
  • Communicate with you about XPFlow, including relevant updates and marketing where permitted, subject to your right to opt out.
  • Understand how the Site is used through aggregated analytics.
  • Comply with legal obligations and enforce our Terms.
  • Protect the rights, property, and safety of XPFlow, our users, and others.

Where required by law, we rely on a lawful basis for each use, as described in Section 10.

5. How we share information

We do not sell your personal information in the traditional sense of exchanging it for money. We may share personal information with:

  • Service providers who perform functions on our behalf, such as website hosting, form processing, analytics, customer relationship management, and email delivery. These providers are permitted to use the information only to perform services for us.
  • Professional advisors, such as lawyers, auditors, and insurers, where necessary.
  • Corporate transactions, such as a merger, acquisition, financing, or sale of assets, in which case information may be transferred as part of that transaction, subject to this policy.
  • Legal and safety reasons, where we believe disclosure is necessary to comply with law, respond to lawful requests, or protect rights and safety.

6. Cookies and similar technologies

We use cookies and similar technologies to operate the Site, remember preferences, understand usage, and, where applicable, support marketing. You can control cookies through your browser settings and, where provided, through our cookie banner or preference center. Some features may not function properly if you disable certain cookies.

7. Data retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, to comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of information and the context. When information is no longer needed, we take reasonable steps to delete or de-identify it.

8. Data security

We maintain reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International data transfers

We may process and store information in countries other than the one in which you reside, including the United States. Where we transfer personal information across borders, we take steps to ensure appropriate safeguards are in place as required by applicable law.

10. Your rights, EEA and UK (GDPR)

If you are in the European Economic Area or the United Kingdom, you have rights under the GDPR and UK GDPR, which may include the right to access, correct, delete, restrict, or object to processing of your personal information, the right to data portability, and the right to withdraw consent where processing is based on consent.

We process your information on one or more of the following lawful bases: your consent, the performance of a contract, our legitimate interests (such as operating and improving the Site and pursuing business development), and compliance with legal obligations.

To exercise your rights, contact us using the details in Section 13. You also have the right to lodge a complaint with your local supervisory authority.

11. Your rights, California (CCPA and CPRA)

If you are a California resident, you may have the right to:

  • Know what personal information we collect, use, and disclose.
  • Request access to and deletion of your personal information.
  • Correct inaccurate personal information.
  • Opt out of the sale or sharing of personal information, if applicable.
  • Not receive discriminatory treatment for exercising your rights.

To exercise these rights, contact us using the details in Section 13. We will verify your request as required by law. You may use an authorized agent where permitted.

12. Product data and our customers' end users

If you are an employee, partner, or end user of a customer that uses the XPFlow platform or private AI environments, and your data is processed within those environments, our processing is governed by our agreement with that customer, not by this policy. Please direct privacy requests to the customer that controls that data. We will support our customers in responding to such requests as required by our agreements and applicable law.

13. Contact us

For questions about this policy or to exercise your rights, contact us.

14. Changes to this policy

We may update this policy from time to time. The "Last updated" date indicates the most recent revision. For material changes, we will provide notice as required by law. Your continued use of the Site after the effective date constitutes acknowledgment of the updated policy.