Privacy Policy

[DRAFT — pending legal review. Not yet in effect. Remove this line when approved.]

Last updated: [EFFECTIVE DATE]

This Privacy Policy explains what personal data XIOT LLC, a company registered in the Arab Republic of Egypt, [REGISTERED ADDRESS] (“XIOT”, “we”, “us”) collects when you use xiot.io, your XIOT Account, Wall Unit, xChip, xAgent, the XIOT app, XIOT Console and our other services (the “Services”), how we use it, who we share it with, and the choices you have. Words like “Services” and “AI Features” mean the same as in our Terms of Service.

In short

  • xAgent listens for its wake word on the device. Audio is sent to our servers and AI providers only after the wake word or a button press.
  • Conversation history, long-term memory, voiceprints and voice clones are optional. You control them in XIOT Console and can delete them.
  • Character Studio turns photos into characters inside your browser. The photo is not uploaded.
  • We do not sell your personal data.
  • To delete your data, use the Data deletion page or email contact@xiot.io.

1. Data we collect

1.1 Account

Name, email address, phone number (optional), password (stored only as a secure hash), sign-in method and identifier if you use Google, Apple or Facebook, two-factor settings, roles, and the devices and sessions you are signed in on.

1.2 Orders and pre-orders

Products, quantities, delivery name and address, phone, order history and communications about your order. Card payments are handled by Stripe; we receive a payment confirmation and limited card details (such as brand and last four digits), never your full card number. Pre-order requests sent by email contain whatever you include in the email.

1.3 Devices and home

Device identifiers and serial numbers, model, firmware version, the places and rooms you name, device state (on/off, dimming level), schedules, routines and automations, connection status and error logs. Products with power metering (Wall Unit, xChip PM models) record electricity use per device. We use this data to run your home, show history and suggest automations. Your Wi-Fi password is sent from the app to the device during setup and stored on the device. [CONFIRM whether the network name or password is stored in the cloud.]

1.4 xAgent voice and AI data

  • Wake word. xAgent devices listen for their wake word on the device itself. Audio before the wake word is not sent to us. Sometimes a device may wake by mistake when it mishears something.
  • Voice audio and transcripts. After the wake word or a button press, your voice is streamed to our servers and AI providers to transcribe it, generate a reply and speak it back. [RETENTION PERIOD for raw audio when conversation history is off.]
  • Conversation history. Depending on the setting you choose for each agent in XIOT Console, we store no history, the text of conversations, or text and audio. You can view and delete history.
  • Memory. If you turn on memory for an agent, it keeps short summaries of facts and preferences from past conversations so it can refer to them later. You can view, clear or turn off memory.
  • Voiceprints (biometric data). If you choose to enrol a voiceprint so an agent can recognise who is speaking, we create and store a mathematical representation of that person’s voice. We do this only with the person’s consent (or a parent’s, for a child), use it only for speaker recognition in your home, and delete it when you remove it or delete your account.
  • Voice clones. If you create a custom voice from a recording, we store the recording and the resulting voice model to use as your agent’s voice. Only clone your own voice or a voice you have permission to use.
  • Characters and personas. Names, personalities, styles and expressions you create in Character Studio. When you build a character from a photo, the photo is processed in your browser and is not uploaded; only the finished character is saved. When you describe a character in words, that description is sent to an AI provider to draw it.
  • Agent settings. Chosen models, voices, languages, quiet hours, allowed topics and session limits. If you add your own AI provider API key, we store it encrypted and use it only to call that provider for you.

1.5 Website

  • Analytics. With your consent, we use Google Analytics to understand how the site is used (pages viewed, approximate location, device and browser type, referrer, and events such as “Pre-order” clicks). See section 8.
  • Bag. Items in your bag are stored in your browser’s local storage, not on our servers, until you send a pre-order request or check out.
  • Forms and email. Contact, pre-order and data-deletion requests open your email app; we receive what you send.

1.6 Support

Messages, call notes, and any diagnostics you share when you contact us.

2. How we use data

  • To provide the Services: run your devices and agents, process voice requests, keep history and memory you turned on, process orders and deliveries.
  • To suggest automations based on your routines, which you can accept or ignore.
  • To keep the Services safe and secure: authentication, fraud prevention, detecting misuse of AI Features, and fixing faults.
  • To improve the Services using aggregated or de-identified data. [CONFIRM: we do not use voice recordings or conversation content to train AI models without your separate opt-in consent.]
  • To communicate with you about your account, orders, safety notices and changes to our terms. Marketing emails only with your consent; you can unsubscribe at any time.
  • To meet legal, tax and accounting obligations.

We process personal data in line with Egypt’s Personal Data Protection Law (Law No. 151 of 2020) and, where they apply to you, the data protection laws of the country you live in. Where data protection law requires a legal basis, we rely on performing our contract with you, your consent (for analytics, marketing, voiceprints and voice clones), our legitimate interests (security, improving the Services, which we balance against your rights), and legal obligations.

3. Who we share data with

We share personal data only as needed for the purposes above:

  • Cloud and infrastructure: hosting, databases, storage and email delivery (Amazon Web Services, including Amazon SES and S3). [CONFIRM other hosting providers.]
  • AI providers: speech recognition, language model, text-to-speech and memory providers that process voice, text and characters to power AI Features. [AI PROVIDER LIST AND LOCATIONS]. If you use your own API key, data for that agent goes to the provider you chose under its own terms.
  • Payments: Stripe, to process payments, prevent fraud and calculate tax.
  • Analytics: Google, for Google Analytics on our website, if you consent.
  • Integrations you turn on: Amazon Alexa or Google Assistant receive device names and states needed to control your devices; sign-in providers confirm your identity.
  • Delivery partners: name, address and phone to deliver orders.
  • Legal and safety: authorities or others where required by law, or to protect people’s safety or our rights.
  • Business changes: a buyer or successor if XIOT is involved in a merger, acquisition or sale of assets, under the same protections.

We require service providers to protect data and use it only on our instructions. We do not sell personal data or share it for cross-context behavioural advertising.

4. International transfers

Our providers may process data outside Egypt and outside your country, including in [COUNTRIES]. We transfer personal data abroad only as permitted by Egypt’s Personal Data Protection Law, including any licence or permit it requires, and, where other laws apply, with safeguards such as standard contractual clauses.

5. How long we keep data

  • Account data: while your account is open, then deleted or anonymised within [PERIOD] of closure, except what we must keep by law.
  • Order records: as long as tax and accounting law requires ([PERIOD]).
  • Conversation history and memory: until you delete them, change the setting, or close your account.
  • Voiceprints and voice clones: until you remove them or close your account.
  • Device and power history: [PERIOD].
  • Security logs: [PERIOD].

6. Your rights and choices

  • See, correct or download your data; delete your account and data (Data deletion); object to or restrict certain processing; withdraw consent at any time.
  • In XIOT Console: turn conversation history and memory on or off, delete history, remove voiceprints and voice clones, and set limits for each person.
  • Decline or withdraw analytics consent in the cookie banner at any time.
  • Unlink Alexa, Google Assistant or sign-in providers from your account.

Email contact@xiot.io to use these rights. We may need to verify your identity. You can also complain to Egypt’s Personal Data Protection Center or to the data protection authority where you live.

7. Children

  • XIOT Accounts are for adults. Children may use xAgent through a profile set up by a parent or guardian who owns the account.
  • The parent controls the child’s agent: hours, topics, voice, history and memory, and can view and delete the child’s conversation history.
  • We collect only what is needed to provide the agent the parent configured, and do not use children’s data for marketing.
  • If you believe a child has given us personal data without a parent’s permission, contact contact@xiot.io and we will delete it.

8. Cookies and similar technologies

Our website uses strictly necessary storage (for example, to remember your bag and language) and, only with your consent, Google Analytics cookies. You can change your choice at any time from the cookie settings link in the footer. Our apps use similar device storage to keep you signed in.

9. Security

We use encryption in transit, hashed passwords, access controls and monitoring to protect data. No system is completely secure; please use a strong, unique password and turn on two-factor authentication.

10. Changes to this policy

We will post updates here with a new “Last updated” date and tell you by email or in the app about material changes before they take effect.

11. Contact

Privacy questions and requests: contact@xiot.io. [DATA PROTECTION OFFICER OR REPRESENTATIVE, IF REQUIRED].