سياسة الخصوصية

Effective date: 10 January 2026
Last updated: 10 January 2026

This Privacy Policy explains how Xerix AI ("Xerix", "we", "us" or "our") collects, uses, shares and protects personal information when you use Xero Agent — our platform for building and running AI voice and messaging agents, available at app.xerix.ai and through our website xerix.ai (together, the "Service").

It applies to two groups of people:

• Customers — businesses and individuals who create an account and build agents on the Service.
• End users — people who talk to a Customer's agent, for example by sending a message to a Customer's WhatsApp number or speaking to a voice agent.

For end-user data, the Customer decides why and how it is processed, and we process it on the Customer's behalf. If you are an end user, please also read the privacy policy of the business you are contacting.

1. Information we collect

1.1 Information you give us (Customers)

• Account information: your name, email address and password. Passwords are stored only in hashed form.
• Profile information collected during onboarding: company name, phone number, company size, number of users or agents, your main use case, the products you are interested in, and the software you would like us to integrate with.
• Agent content: the agents you create, including their names, instructions (prompts), greeting messages, language and voice settings, tool and integration settings, and the knowledge-base documents you upload (for example PDF, DOCX or text files) together with the text we extract from them.
• Connected accounts: when you connect a WhatsApp Business account through Meta, we receive and store your WhatsApp Business Account ID, phone number ID, business phone number and display name, and an access token that Meta issues to let us send and receive messages for you. Access tokens are encrypted at rest.
• Support communications: anything you send us when you contact support.

1.2 Information created when agents are used

• Voice sessions: audio from your microphone is streamed in real time to our AI providers to generate the agent's spoken reply. We do not record or store the audio. We store the session's text transcript, its duration, token usage and cost.
• WhatsApp conversations: the end user's WhatsApp phone number, the content of the messages exchanged between the end user, the AI agent and any human team member, message IDs and timestamps, and a record of hand-offs between the AI and a human.
• Usage data: usage measures such as minutes used and number of sessions, so we can apply plan limits and show you statistics.

1.3 Information collected automatically

• Technical data: IP address, browser type, device information and request logs. We use these to operate, secure and debug the Service, and IP addresses are used to rate-limit our public demo.
• Browser storage: we use your browser's local storage to keep you signed in (a login token) and to remember preferences such as light or dark mode. We do not use advertising cookies or third-party advertising trackers.

2. How we use information

We use personal information to:

1. provide, operate and maintain the Service, including running your agents and delivering their replies;
2. create and manage your account, verify your email address and authenticate you;
3. connect and operate the third-party channels you choose, such as WhatsApp;
4. measure usage, apply plan limits and show you analytics about your agents;
5. provide support and send you service messages, such as verification codes and important account notices;
6. keep the Service secure, prevent fraud and abuse, and fix problems;
7. improve the Service, using aggregated or de-identified information where possible;
8. comply with the law and enforce our terms.

We do not sell personal information, and we do not use your content or your end users' conversations to train our own AI models or for advertising.

3. Information we receive from Meta (WhatsApp)

When you connect WhatsApp through Meta's Embedded Signup, Meta shares with us the business assets you choose to grant (your WhatsApp Business Account and phone number), along with the permissions whatsapp_business_management and whatsapp_business_messaging. We use this data only to:

• set up and manage your WhatsApp Business phone number on the Service;
• receive messages sent to your number and send replies on your behalf, written by your AI agent or by your team;
• manage message templates and account settings that you control from the Service.

We do not use data from Meta for advertising, do not sell it, and do not share it with third parties except the service providers listed in Section 4 that we need in order to deliver the Service. Our use of this data complies with the Meta Platform Terms and Developer Policies. You can disconnect WhatsApp at any time from the Service, or remove our app's access in your Meta Business settings.

4. How we share information

We share information only as follows:

• AI model providers, which process prompts, conversation text, voice audio and knowledge-base excerpts to generate agent replies: OpenAI, xAI and Moonshot AI. Which provider is used depends on the agent's settings. We send them only what is needed to produce a reply.
• Meta Platforms, to deliver WhatsApp messages through the WhatsApp Business Platform.
• Hosting and infrastructure providers: Vercel (web application hosting) and Hostinger (application servers, database and file storage).
• Integrations you enable, such as an e-commerce store or a CRM that you connect to an agent. When an agent uses one of these tools, we send it the data needed to complete the action.
• Legal and safety: when required by law, or to protect the rights, property or safety of Xerix, our users or others.
• Business transfers: if we are involved in a merger, acquisition or sale of assets, subject to this Policy.

Our service providers may process information only on our instructions and for the purposes above.

5. Data retention

• Account and agent data are kept while your account is active.
• Voice transcripts and WhatsApp conversations are kept while your account is active, unless you delete them sooner.
• Knowledge-base files are kept until you delete them or delete the agent they belong to.
• When you delete your account, we delete or anonymise your personal information within 30 days. Server backups are overwritten within a further 90 days. We may keep limited information longer where the law requires it.

6. Security

We protect information using industry-standard measures, including:

• encryption in transit (HTTPS/TLS);
• encryption at rest for third-party access tokens;
• hashed passwords;
• access controls that limit who can reach production systems.

No system is completely secure, but we work to protect your information and will notify you of a data breach as required by law.

7. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct it;
• delete it;
• object to or restrict certain processing;
• receive a copy in a portable format;
• withdraw consent where we rely on it.

You can update most account and agent information directly in the Service. To exercise any of these rights, email legal@xerix.ai. We will respond within the time the law requires (usually 30 days). You also have the right to complain to your local data protection authority.

End users: if you messaged or spoke to a business that uses Xero Agent, please contact that business first. We will help them respond to your request.

8. Data deletion instructions

You can ask us to delete your data at any time:

1. From the app: delete individual agents, knowledge-base files and conversations from your workspace. Deleting a WhatsApp agent also deletes its knowledge-base files and conversation history.
2. Disconnect WhatsApp: remove the WhatsApp channel in the Service. You can also remove Xero Agent's access in Meta Business Settings → Integrations → Connected apps.
3. Delete your account: email legal@xerix.ai from the email address registered to your account with the subject line "Delete my account". We will confirm the request and delete your account and its associated data as described in Section 5.

If you are an end user who messaged a business through WhatsApp and want your messages deleted, contact that business, or email us with the phone number you used and the business you contacted.

9. International data transfers

We and our service providers may process information in countries other than your own, including the United States and the European Union. Where required, we use appropriate safeguards, such as Standard Contractual Clauses, for these transfers.

10. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and notify Customers by email or in the Service.

12. Contact us

Xerix AI
73/2 C Block Model Town
Lahore 54000, Pakistan
Email: legal@xerix.ai
Website: https://xerix.ai