Privacy Policy

Support: [email protected] Privacy: [email protected]

LEGAL ENTITY AND CONTROLLER INFORMATION This Privacy Policy is issued jointly by the following legal entities, which together constitute Xelta and act collectively as the Data Controller for all personal data processed under this policy.

Xelta LLC. (United States of America) Xelta LLC. is incorporated in the State of Delaware, United States of America. As a Data Controller, Xelta LLC. is responsible for determining the purposes and means of processing personal data for users accessing our services from the United States and internationally where US law applies.

Xelta Private Limited (India) Xelta Private Limited is a company incorporated under the laws of India. The Registered Office Address: H.NO. 906/15, Sonipat-131001, Haryana, India is inserted as per the incorporation documents filed with the Ministry of Corporate Affairs, Government of India. As a Data Controller operating in India, Xelta Pvt. Ltd. is responsible for compliance with the Digital Personal Data Protection Act, 2023 and other applicable Indian laws governing data protection.

Where this policy refers to Xelta, we, us, or our, it refers collectively to both legal entities above. For all privacy-related inquiries, users may contact us directly at [email protected]. We are committed to transparency in how we handle your personal data and to upholding your rights under all applicable data protection frameworks.

SCOPE OF THIS POLICY This Privacy Policy applies to all platforms and channels through which Xelta delivers its services to users. This includes our iOS mobile application available for download on the Apple App Store, our Android mobile application available on the Google Play Store, and our web-based platform accessible at https://www.xelta.ai.

This policy has been drafted with the intent of full compliance with all major global data protection frameworks. We have designed our data practices to satisfy the requirements of the General Data Protection Regulation as applicable to users in the European Union and the United Kingdom. We comply with the California Consumer Privacy Act and the California Privacy Rights Act as applicable to California residents. We comply with the Digital Personal Data Protection Act of 2023 as applicable to users in India. We also comply with the UAE Personal Data Protection Law as applicable to users in the United Arab Emirates.

By using any of our platforms or services, you acknowledge that you have read and understood the terms of this Privacy Policy and consent to the collection and use of your information as described herein.

WHAT INFORMATION DO WE COLLECT? 1.1 Account Data We collect personal information that you voluntarily provide to us when you register for an account, when you use the features and tools on our platform, or when you reach out to us through our support channels. The types of information we collect through this process include your full name, your email address, the username you select, and your account password which we store in encrypted form.

The purpose of collecting this information is to enable account creation and authentication, to allow you to log in and maintain access to your account, and to communicate with you about your account status, our services, and any updates that may affect your use of our platform. We collect only the minimum information necessary for these purposes.

1.2 User Content When you use the creative tools and features available on our platform, you may upload or generate various types of content. This includes images and photographs that you upload for editing or transformation purposes, video files that you submit for processing, and text prompts or instructions that you provide to our artificial intelligence systems in order to generate or modify content.

The purpose of collecting this content is strictly to execute the services you request, to store the generated outputs so you can access them across sessions, and to enable the cloud-based functionality of our platform. Your uploaded content is not used for any purpose beyond the specific feature you are actively using, and it is not shared with third parties for their independent use.

1.3 Biometric and Face Data Xelta offers certain advanced features that involve the processing of facial images and related attributes. These features are classified as sensitive by applicable data protection law, and we treat them with a correspondingly higher level of care and protection. Before we collect or process any biometric or facial data, we will present you with a clear and specific consent request. We will not process any such data without your explicit affirmative consent.

The types of biometric data we may collect in connection with face-based features include photographs or video frames containing your face, and derived attributes such as facial landmarks which are geometric points used to identify the position of facial features. These are processed strictly for the purpose of executing face-based creative features such as face swap. They are not used for identity recognition, profiling, behavioral analysis, or training any artificial intelligence model.

We guarantee that face data is not retained beyond a maximum period of Thirty days following its submission. After this period, all such data is automatically and permanently deleted from our systems. You may withdraw your consent to the processing of face data at any time, and we will cease processing and delete any stored data upon your request.

1.4 Technical and Usage Data When you access and use our services, certain information is collected automatically by our servers and infrastructure. This data does not directly reveal your identity in the way that your name or contact information does, but it is necessary for the operation, security, and optimization of our services.

The automatically collected information includes your Internet Protocol address, which is a numerical label assigned to your device by your internet service provider. It also includes your browser type and version, the operating system installed on your device, your preferred language settings, the URL from which you arrived at our platform, the name and model of your device, your general country and region as inferred from your IP address, timestamps and records of how you interact with our platform including which pages you view and which features you use, and technical diagnostic data such as error reports and system activity logs.

This information is used primarily to maintain the security and proper functioning of our platform, to detect and prevent fraud and unauthorized access, to monitor system performance, and to support our internal analytics and reporting processes. Like many online services, we also collect some of this information through the use of cookies and similar technologies. Please see the cookies section of this policy for more details.

1.5 Location Data We collect approximate location information derived from your Internet Protocol address. This allows us to determine your general geographic region, typically at the country or city level. We use this information for security purposes, to detect unusual access patterns that may indicate unauthorized use, and to provide region-appropriate versions of our services where applicable.

We do not collect precise GPS coordinates from your device unless you explicitly enable this through your device settings and grant us permission to do so. You can opt out of location data collection at any time by disabling the Location setting on your device or by refusing our request for location access. Please be aware that opting out of location services may affect the availability or functionality of certain features of our platform.

1.6 Social Media Integration Data Xelta allows you to connect your third-party social media accounts to our platform for the purpose of sharing content you have created using our tools. When you choose to connect a social media account, you authorize Xelta to access limited information and permissions associated with that account. This access is restricted to what is strictly necessary to publish content on your behalf.

The information we may access from your connected social media account includes your account identifier, the name of your page or profile, and the specific publishing permissions required to post content. We do not access your private messages, your contacts or friends list, your follower lists, or any other personal information beyond what is needed for content publishing.

All content sharing actions on social media are performed only after your explicit initiation and approval of each individual post. Xelta never posts to your social media accounts automatically or without your active instruction to do so. You may revoke social media permissions at any time through your account settings on our platform or directly through the settings of the respective social media platform.

Xelta is not responsible for the data collection or processing practices of third-party social media platforms. We recommend that you review the privacy policies of any social media platform you connect to our services to understand how they handle your data independently of Xelta.

CONSENT MECHANISM We obtain your consent to process your personal data through in-app prompts that require your explicit opt-in before any data collection begins, and through feature-level consent requests that are presented to you at the point of using any feature that involves the collection of sensitive data. Our consent mechanisms are designed to be clear, specific, and freely given. We do not bundle consent for multiple purposes into a single request.

You have the right to withdraw your consent at any time. You can do this through your account settings within the application, or by requesting account deletion which will result in the cessation of all consent-based processing and the deletion of your data. All consent events, including the time, nature, and scope of the consent given, and any subsequent withdrawals, are logged by our systems for the purposes of regulatory compliance and audit readiness.

HOW DO WE PROCESS YOUR INFORMATION? We process your personal information for a variety of specific purposes, each of which is described in detail below. We process data only for these defined purposes and only to the extent necessary to accomplish them.

We process your information to facilitate account creation and authentication and to otherwise manage user accounts. This includes enabling you to create and maintain your account, keeping your login credentials functioning, and ensuring that only authorized users can access your account and its associated data.

We process your information to deliver the services you have requested. When you use any feature of our platform, we process the data you provide or generate as a necessary step in executing that feature and delivering the output to you.

We process your information to respond to your inquiries and to provide customer support. When you contact us with a question, issue, or complaint, we use the information you provide along with your account information to investigate and resolve the matter.

We process your information to send you administrative communications. This includes notifications about changes to our terms of service, updates to this privacy policy, changes to our platform features, service downtime notifications, and other information that is necessary for your use of our services.

We process your information to request your feedback. We may periodically contact you to ask about your experience with our platform, to understand how we can improve our services, and to gather insights about your needs as a user.

We process your information to protect the integrity and security of our services. This includes monitoring for fraudulent activity, detecting and preventing unauthorized access, investigating suspicious behavior, and taking protective action where necessary to safeguard the platform and its users.

In limited and exceptional circumstances, we may process your information to protect the vital interests of an individual where there is a risk of serious harm. This is a narrow basis for processing that we would apply only in genuine emergency situations.

ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING Xelta is an AI-powered platform, and our services involve the use of artificial intelligence to generate, transform, and enhance content. It is important to us that you understand exactly how your data interacts with our AI systems.

All AI-generated outputs are produced in direct response to your specific requests and instructions. Our AI systems process your inputs in real time to produce the outputs you have requested. Your data is not used to train, fine-tune, or improve our AI models. We do not use your images, videos, prompts, or any other personal data you submit as training data for any machine learning system.

Our platform does not make automated decisions that produce legal effects or similarly significant effects on you. No decision that materially affects your rights, access to services, or legal status is made solely through automated means without human involvement. Where our systems engage in any form of automated processing that could affect you, human oversight is maintained as required by applicable law.

WHAT LEGAL BASES DO WE RELY ON? We only process your personal information when we have a valid and specific legal basis to do so under applicable law. The legal bases we rely on vary depending on your location and the nature of the processing involved. This section describes the legal bases applicable to users in different regions.

For Users in the European Union and United Kingdom (GDPR and UK GDPR) The General Data Protection Regulation and the UK GDPR require us to identify and document the lawful basis for each type of processing we undertake. The legal bases we rely on are as follows.

Consent. We may process your personal information where you have given us clear and specific permission to do so for a defined purpose. We rely on consent primarily for the processing of biometric and face data and for any optional features or communications that go beyond what is necessary to provide the core service. You may withdraw your consent at any time and we will cease the relevant processing upon receipt of your withdrawal.

Performance of a Contract. We may process your personal information where it is necessary to fulfill our contractual obligations to you. When you create an account and use our platform, you enter into a service agreement with us. Processing your account data and the content you submit is necessary to deliver the services you have contracted for.

Legitimate Interests. We may process your personal information where we have a legitimate business interest in doing so and that interest is not overridden by your fundamental rights and freedoms. We rely on this basis for activities such as fraud prevention and detection, security monitoring, and improving our platform based on usage patterns. We always assess the balance of our interests against your rights before relying on this basis.

Legal Obligations. We may process your personal information where it is necessary for us to comply with a legal obligation to which we are subject. This includes cooperating with law enforcement and regulatory authorities where required by applicable law, and retaining records as mandated by law.

Vital Interests. In exceptional circumstances, we may process your personal information where it is necessary to protect your vital interests or those of another natural person, such as in a genuine emergency involving a risk to life.

For Users in Canada (PIPEDA) In Canada, we rely on your express or implied consent to process your personal information. Express consent is obtained through explicit opt-in mechanisms. Implied consent may apply in circumstances where the purpose of collection is obvious and you have voluntarily provided your information. You may withdraw your consent at any time, subject to legal and contractual restrictions.

There are limited exceptional circumstances under Canadian law where we may process your information without your consent. These include situations where collection is clearly in your interests and consent cannot be obtained in a timely way, for fraud detection and prevention, for compliance with legal subpoenas or court orders, and where the information is publicly available. We invoke these exceptions only where truly applicable and do not use them as a routine basis for processing.

For Users in India (Digital Personal Data Protection Act 2023) For users in India, we process personal data on the basis of consent or on grounds of legitimate use as defined under the Digital Personal Data Protection Act of 2023. We obtain your explicit consent before processing your personal data, and we maintain records of that consent. You have the right to withdraw your consent at any time and to seek grievance redressal through our designated channels. You also have the right to nominate another individual to exercise your data rights on your behalf in certain circumstances.

For Users in the United Arab Emirates (PDPL) For users in the UAE, we process personal data in compliance with the UAE Personal Data Protection Law. We rely on your consent, the performance of a contract, or our legitimate interests as the legal basis for processing, depending on the specific activity involved. You have the right to data portability, the right to object to processing, and the right to access and correct your personal data.

WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION? We do not sell your personal information to third parties. We do not share your personal information with advertisers or marketing companies for their independent use. We share your information only in the limited circumstances described below, and only to the extent necessary for the purpose identified.

Business Transfers. In the event that Xelta is involved in a merger, acquisition, corporate restructuring, sale of company assets, or similar transaction, your personal information may be transferred as part of that transaction. We will notify you in advance of any such transfer and of any changes to how your data will be handled as a result of the transaction.

Affiliates. We may share your information with our affiliated entities, including our parent company, subsidiaries, joint venture partners, and other entities under common control with us. Any affiliate that receives your information is required to handle it in accordance with this privacy policy and to honor the rights and protections described herein.

Business Partners. We may share your information with trusted business partners where doing so is necessary to provide you with a specific product, service, or promotion that you have expressed interest in. We require our business partners to maintain appropriate data protection standards.

Subprocessors and Service Providers We engage third-party service providers to assist us in operating our platform and delivering our services. These providers act as data processors on our behalf, meaning they process your data only according to our documented instructions and are not permitted to use it for their own purposes.

All of our subprocessors are subject to Data Processing Agreements that define the scope of their access to your data, the security measures they must implement, and their obligations upon termination of the engagement. Our current core subprocessors include Amazon Web Services, which provides hosting and storage infrastructure, and Cloudflare, which provides content delivery network and security services.

We maintain an up-to-date list of all our subprocessors. This list can be accessed at the subprocessors page on our website. We will notify you of any material changes to our subprocessor arrangements where required by applicable law.

To confirm our commitment: Xelta has not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve months, and we commit to maintaining this standard going forward.

CROSS-BORDER DATA TRANSFERS As a global service, the data we collect may be transferred to, stored in, and processed in countries other than your country of residence. This may include transfers to countries that have different data protection laws to those in your jurisdiction.

Where we transfer your personal data outside of the European Economic Area, the United Kingdom, or other jurisdictions with data transfer restrictions, we implement appropriate safeguards to ensure that your data receives an equivalent level of protection. The primary safeguard we use for international transfers is Standard Contractual Clauses as approved by the European Commission, which impose binding data protection obligations on the parties to the transfer.

Our primary data storage and processing takes place in AWS regions. Specific region information is available upon request. By using our services, you acknowledge that your data may be transferred internationally in accordance with the safeguards described in this section.

HOW LONG DO WE KEEP YOUR INFORMATION? We retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or for as long as we are required to retain it under applicable law. We do not keep your data for longer than necessary and we regularly review our retention practices to ensure compliance.

Account data, meaning your name, email address, username, and related credentials, is retained for as long as your account remains active. This retention is necessary to provide you with continuous access to our services. When you delete your account, this data is removed from our active systems.

Face data and biometric information, where collected with your consent for specific features, is retained for a maximum of Thirty days following submission. This period allows for the completion of processing and provides a brief window for error recovery and resubmission if needed. After Thirty days, all such data is permanently deleted from our systems and cannot be recovered.

Generated content, meaning the outputs produced by our AI tools based on your inputs, is retained for a period of Thirty days from the date of creation. During this period, the content is accessible from your account. After Thirty days, the content is deleted from our servers unless you have taken steps to save or download it.

System backups, which are maintained for the purpose of disaster recovery and business continuity, are retained for a period of thirty days. Backup data is isolated from active systems and is not used for any purpose other than system restoration in the event of a failure.

As a general outer limit, we will not retain your personal information for longer than three months following the termination of your account, except where a longer retention period is required by applicable law such as tax, accounting, or other legal obligations. Where we are legally required to retain certain data for a longer period, we will segregate that data and restrict access to it during the extended retention period.

When we have no ongoing legitimate basis to retain your personal information, we will either delete it securely or anonymize it in such a way that it can no longer be associated with you. If immediate deletion is not technically feasible, for example because data is stored in backup archives, we will isolate the data and prevent it from being processed until deletion becomes possible.

HOW DO WE KEEP YOUR INFORMATION SAFE? The security of your personal information is a priority for us. We have implemented a comprehensive set of technical and organizational security measures designed to protect the personal information we process against unauthorized access, disclosure, alteration, and destruction.

Our technical security measures include the use of Transport Layer Security version 1.2 and above for the encryption of all data in transit between your device and our servers. All data stored on our systems is encrypted using AES-256 encryption, which is a widely recognized and highly secure encryption standard. We implement role-based access control, which ensures that our staff members can only access the data necessary for their specific job functions. We maintain comprehensive audit logs of all access to and actions taken on personal data within our systems. Our infrastructure is designed with isolation principles to prevent unauthorized lateral movement in the event of a security incident. We have formal incident response procedures in place so that we can respond quickly and effectively to any security event.

Despite our extensive security measures, we must be transparent with you that no system connected to the internet can be guaranteed to be completely and unconditionally secure. There are inherent risks in transmitting information over the internet, and we cannot guarantee that unauthorized third parties will never be able to breach our security measures. Transmission of personal information to and from our services is done at your own risk. You can help protect yourself by using our services only within a secure network environment and by keeping your account credentials confidential.

DATA BREACH NOTIFICATION In the event that we become aware of a data breach that is likely to result in a risk to the rights and freedoms of individuals whose data we process, we will take immediate steps to investigate and contain the breach. We will notify the relevant data protection supervisory authorities as required by applicable law. Under the GDPR and UK GDPR, this notification must be made within 72 hours of becoming aware of the breach where feasible.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay. Our notification will include a description of the nature of the breach, the categories and approximate number of individuals affected, the categories and approximate number of records affected, the likely consequences of the breach, and the measures we have taken or propose to take to address the breach.

Enterprise customers and business partners will be notified of any material breach that affects their data within 72 hours of our becoming aware of the breach, regardless of the regulatory threshold that would otherwise apply.

DO WE COLLECT INFORMATION FROM MINORS? Our services are not directed at children or minors, and we do not knowingly collect personal information from children. For the purposes of this policy, a child is defined as a person under the age of 13 in the United States, and under the age of majority as defined by the applicable law in other jurisdictions. In most jurisdictions where we operate, the applicable minimum age is 13 or higher.

By using our services, you represent and warrant that you are at least 18 years of age, or that you are the parent or legal guardian of a minor who is using the services with your knowledge and consent. If you are using the services on behalf of a minor, you accept responsibility for ensuring that the minor uses the services in accordance with this policy and all applicable terms of service.

If we become aware or have reason to believe that we have collected personal information from a user who is a minor below the applicable age threshold without appropriate parental consent, we will take immediate steps to deactivate that user account and to delete the associated personal information from our records.

Parents or guardians who believe that their child has provided personal information to Xelta without their consent are encouraged to contact us at [email protected]. We will take prompt action to investigate and, where appropriate, to delete the relevant information.

APP PERMISSIONS AND MOBILE COMPLIANCE When you use our mobile applications, we may request access to certain features and capabilities of your device. These permissions are requested only where they are necessary to provide specific functionality that you have chosen to use, and they are entirely within your control.

We may request access to your device camera to enable content creation features that involve capturing images or video directly within the application. We may request access to your device storage to enable the saving of generated content and outputs to your device. We require network access to deliver our services, as our platform operates through internet connectivity.

All permissions are optional in the sense that you can choose to decline them. If you decline a permission, the specific feature that requires that permission will not be available to you, but you will generally continue to be able to use other features of our platform that do not require that permission. You can review and manage the permissions granted to our application at any time through your device settings.

APPLE AND GOOGLE PLATFORM COMPLIANCE We have designed our applications to comply fully with the requirements of both the Apple App Store and the Google Play Store, including their respective policies on data collection, user privacy, and account management.

Apple App Store Compliance In compliance with Apple App Store Guideline 5.1.1(v), our application is designed so that users can explore and access a meaningful set of features without creating an account or providing personal information. Guest access is supported for features that do not require personalization or data storage. Users who wish to access account-based features such as AI generation, credit tracking, cloud storage, and social media integration are required to register, and the reasons for this requirement are clearly explained within the application.

Our application supports in-app account deletion, meaning you can permanently delete your Xelta account directly from within the iOS application without needing to contact support or visit an external website. The standard End User License Agreement that governs your use of our iOS application is available at https://www.apple.com/legal/internet-services/itunes/dev/stdeula/

Google Play Compliance Our Android application complies with Google Play requirements for data safety and transparency. All data transmitted by our application is encrypted in transit. We have disclosed our data collection and usage practices in the Data Safety section of our Google Play listing. Users can request the deletion of their account and associated data through the application, in accordance with Google Play policy on account deletion.

GUEST ACCESS AND ACCOUNT REGISTRATION We believe that users should be able to understand and explore our platform before committing to creating an account. Accordingly, we make a range of features and information accessible without requiring you to register or provide any personal information.

Without creating an account, you can browse the application interface and explore the range of tools and features we offer, view feature descriptions, tutorial content, and example outputs that demonstrate what our platform can do, and access any publicly available content within the application.

Account registration is required only for features that are inherently account-based or that involve the storage or processing of your personal data. These include our AI-powered image and video generation features, which operate on a credit basis and require a verified account to manage credit balances and access history. Usage and credit tracking requires an account to associate your usage with your subscription or purchase. Cloud storage of generated outputs across sessions requires an account to identify your content and make it available to you when you return to the platform. Social media integration for content sharing requires an account to maintain your connected social media authorizations.

We do not require registration for features that are not account-based. Where registration is required, we explain this requirement clearly and provide an alternative experience for users who prefer not to register.

COOKIES AND TRACKING TECHNOLOGIES We use cookies and similar technologies to operate and improve our platform. A cookie is a small data file that is placed on your device when you visit our website. Cookies help us remember your preferences, keep you logged in, and understand how you use our platform.

We use strictly necessary cookies that are essential for the operation of our platform. Without these cookies, features such as user authentication and session management would not function properly. We also use analytics cookies that help us understand how users interact with our platform, which pages are most frequently visited, and where users encounter difficulties. This information is used to improve the user experience.

We do not use cookies or tracking technologies for advertising purposes. We do not sell or share cookie data with advertising networks or marketing companies.

Most web browsers accept cookies by default. You can configure your browser to refuse all cookies or to notify you when a cookie is set. Please be aware that refusing cookies may affect the functionality of our website and may prevent certain features from working correctly. Specific information about the cookies we use and how you can manage your preferences is set out in our separate Cookie Notice, which is available on our website.

SOCIAL LOGIN AND GOOGLE YOUTUBE API DATA USAGE If you choose to connect your Google account to our platform, Xelta may request access to your YouTube account through the YouTube Data API v3. This access is requested solely to enable video publishing and management features that you have chosen to use.

We use this access to upload videos to your YouTube channel on your behalf when you instruct us to do so, to manage the metadata associated with those videos including titles, descriptions, and thumbnails, and to enable publishing actions that you explicitly initiate from within our platform.

We do not access or store your YouTube account password. We do not access private videos or content on your YouTube channel unless you explicitly request a feature that requires such access. We do not sell, transfer, or share your Google account or YouTube data with any third parties for their independent use. All actions involving your YouTube account are performed only after you explicitly consent to and initiate those actions within our platform.

Xelta’s use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements. This means that we use the data we receive from Google APIs only to provide or improve user-facing features that are prominent in our application, and not for serving advertisements, for data broking, or for other secondary purposes. The full text of the Google API Services User Data Policy is available at https://developers.google.com/terms/api-services-user-data-policy

ABUSE AND MISUSE POLICY Xelta is committed to ensuring that our platform, including our AI-powered features and face data processing capabilities, is used responsibly and ethically. We strictly prohibit the use of our services for any purpose that could harm, exploit, or violate the rights of others.

The following activities are strictly prohibited on our platform. Users may not use face-based features to process images of another person without that person explicit and informed consent. Users may not create deepfake content, meaning synthetic media that misrepresents a real person likeness, for the purpose of deception, defamation, harassment, or any other harmful purpose. Users may not use our platform to impersonate another person, whether a public figure or a private individual. Users may not use our services to create content that harasses, threatens, or intimidates any person.

If you believe that our platform is being used in violation of these prohibitions, or if you have been harmed by content created using our tools, you can report the abuse to us at [email protected]. We take all abuse reports seriously and will investigate promptly. Where a complaint is verified, we will remove the offending content and take appropriate action against the account responsible, which may include account suspension or termination.

WHAT ARE YOUR PRIVACY RIGHTS? Depending on where you are located, you may have a range of rights in relation to the personal information we hold about you. This section sets out the rights available to users in different jurisdictions and explains how you can exercise those rights.

All users, regardless of their location, have the following general rights. You have the right to access the personal information we hold about you and to receive a copy of that information. You have the right to request the correction of any inaccurate or incomplete personal information we hold. You have the right to request the deletion of your personal information, subject to certain legal exceptions. You have the right to restrict the processing of your personal information in certain circumstances. You have the right to withdraw your consent to any processing that is based on your consent, at any time, without this affecting the lawfulness of processing carried out before the withdrawal.

Users in the European Economic Area and the United Kingdom also have the right to data portability, which means the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. You also have the right to object to the processing of your personal information where we rely on legitimate interests as the legal basis. If you believe we are unlawfully processing your personal information, you have the right to lodge a complaint with your local data protection supervisory authority. Contact details for data protection authorities in the EU are available at https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm and for Switzerland at https://www.edoeb.admin.ch/edoeb/en/home.html

Users in California have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act. These include the right to know what categories of personal information we collect, the right to know whether your personal information is being sold or shared and to whom, the right to opt out of the sale or sharing of your personal information, the right to non-discrimination for exercising your privacy rights, and the right to limit our use and disclosure of sensitive personal information. As noted throughout this policy, we do not sell or share personal information under the CCPA definition of those terms.

Users in India have the right to grievance redressal under the Digital Personal Data Protection Act of 2023. If you have a concern about how we are handling your personal data, you may contact our Grievance Officer at [email protected] and we will respond within the timeframe prescribed by law.

Users in the UAE have the right to data portability and the right to object to processing under the UAE Personal Data Protection Law.

To exercise any of the rights described in this section, you may contact us by email at [email protected] or by visiting our contact page at https://xelta.ai/contact. We will respond to all legitimate requests within the timeframes required by applicable law. We may need to verify your identity before processing your request in order to prevent unauthorized access to your data.

You also have the right to opt out of receiving marketing and promotional communications from us at any time. You can do this by clicking the unsubscribe link in any marketing email we send you, by replying STOP to any marketing SMS we send you, or by contacting us using the details provided in this policy. Please note that opting out of marketing communications will not prevent us from sending you service-related messages that are necessary for the administration of your account.

CALIFORNIA-SPECIFIC PRIVACY RIGHTS This section provides additional information for residents of California as required by the California Consumer Privacy Act, the California Privacy Rights Act, and related regulations.

The Shine the Light Law California Civil Code Section 1798.83, also known as the Shine The Light law, permits California residents to request information about the categories of personal information we have disclosed to third parties for their direct marketing purposes during the preceding calendar year, and the names and addresses of those third parties. California residents may submit such a request once per year and free of charge by contacting us using the details provided in the contact section of this policy.

If you are under 18 years of age and a California resident with a registered account on our platform, you have the right to request the removal of content or information that you have publicly posted on our services. To request removal, please contact us with your account email address and a statement that you are a California resident. We will make commercially reasonable efforts to ensure the content is not publicly displayed on our platform, though we cannot guarantee complete removal from all systems including backups and cached copies.

Categories of Personal Information Collected (CCPA) The following describes the categories of personal information we have collected from consumers in the past twelve months and how long we retain each category.

Category A: Identifiers, including real name, email address, unique personal identifier, and Internet Protocol address. We have collected this category of information. We retain identifiers for a period of six months following account termination.

Category B: Personal information as defined in the California Customer Records statute, including name and contact information. We have collected this category of information. We retain this information for as long as the user maintains an active account with us.

We have not collected the following categories in the past twelve months: protected classification characteristics such as gender and date of birth, commercial information such as purchase history, biometric information as defined by California law such as fingerprints and voiceprints, internet or network activity information such as browsing history and online behavior, precise geolocation data from devices, audio, electronic, or visual information collected in connection with business activities, professional or employment-related information, education information, inferences drawn from personal information to create profiles, or sensitive personal information as defined by the CPRA.

How We Use and Share California Consumer Information More information about our data collection and sharing practices is set out throughout this privacy policy. For California-specific inquiries, you may contact us by email at [email protected] or by visiting https://xelta.ai/contact.

We may disclose your personal information to our service providers pursuant to written contracts that require those providers to maintain the same level of privacy protection mandated by the CCPA. We use personal information for our own internal business purposes, including research and development, which does not constitute a sale of personal information. We have not sold or shared any personal information with third parties for a business or commercial purpose in the preceding twelve months, and we will not do so in the future.

Verification of Rights Requests When you submit a request to exercise any of your California privacy rights, we are required to verify your identity to ensure that we disclose or delete information only to or at the direction of the individual to whom that information belongs. We accomplish this by asking you to provide certain information that we can match against information already in our records, or by contacting you through a communication channel such as your registered email address that you have previously used with us.

We will use the information you provide for verification purposes only and will not retain it for any other purpose. Where we cannot verify your identity from the information already in our possession, we may ask you to provide additional information. Any additional information collected solely for verification purposes will be deleted once verification is complete.

If you wish to submit a request through an authorized agent, the agent must provide proof of their authorization to act on your behalf. We may deny a request made through an authorized agent that cannot demonstrate valid authorization.

DO-NOT-TRACK SIGNALS Most web browsers and some mobile operating systems and applications include a Do-Not-Track feature or setting that you can activate to signal your preference not to have your online browsing activities monitored and collected across websites.

At this time, no uniform technical standard for recognizing and responding to Do-Not-Track signals has been finalized or widely adopted across the industry. As a result, we do not currently respond to Do-Not-Track browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a recognized standard for online tracking is adopted in the future that requires our compliance, we will update this privacy policy to reflect our practices and notify you of the change.

GOVERNING LAW This Privacy Policy is primarily governed by and construed in accordance with the laws of the State of Delaware, United States of America, without regard to its conflict of law provisions. Xelta LLC. is incorporated in Delaware, which is the primary legal jurisdiction for our corporate operations.

Notwithstanding the foregoing, where mandatory local laws apply, including the GDPR for EU and UK residents, the Digital Personal Data Protection Act for Indian residents, the UAE Personal Data Protection Law for UAE residents, and the CCPA and CPRA for California residents, those local laws will govern to the extent that they impose stricter obligations than Delaware law. We do not use this governing law provision to diminish the mandatory rights you have under your local law.

DO WE MAKE UPDATES TO THIS NOTICE? We review this privacy policy regularly and may update it from time to time to reflect changes in our data practices, changes in applicable law, or changes to our services. When we make changes, we will update the Last Updated date at the top of this document.

If we make material changes to this privacy policy, meaning changes that significantly affect how we process your personal information or that significantly reduce your rights, we will notify you in advance. We may do this by posting a prominent notice on our platform, by sending you a notification through the application, or by emailing you at the email address associated with your account. We encourage you to review this privacy policy periodically to stay informed about how we are protecting your information.

Your continued use of our services following the effective date of any updated privacy policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using our services and may request deletion of your account.

HOW CAN YOU CONTACT US ABOUT THIS NOTICE? If you have any questions, comments, or concerns about this privacy policy or about our data practices, we encourage you to contact us. We are committed to addressing your concerns promptly and transparently.

You may contact our privacy team by email at [email protected] for all privacy-related inquiries including requests to exercise your data rights.

You may contact our general support team by email at [email protected] for questions about your account or our services.

Our registered address for formal correspondence is H.NO. 906/15, Sonipat-131001, Haryana, India.

You may also visit our contact page at https://xelta.ai/contact to submit an inquiry through our online form.

HOW CAN YOU REVIEW, UPDATE, OR DELETE YOUR DATA? Based on the applicable laws of your country or state, you may have the right to request access to the personal information we collect from you, to request that inaccurate information be corrected, or to request that your personal information be deleted. We take these rights seriously and will act on your requests in accordance with applicable law.

To request access to your personal information, we will provide you with a copy of the data we hold about you in a portable and readable format within the timeframe required by applicable law. To request correction of your information, please provide us with the information you believe is inaccurate and the correct information that should replace it. To request deletion of your personal information, we will delete or anonymize your data as requested, subject to any legal obligations that require us to retain certain information.

To submit any of these requests, please contact us at [email protected] or visit https://xelta.ai/contact. Please include your full name, your registered email address, and a clear description of the request you are making. We may need to verify your identity before processing your request. We aim to respond to all requests within 30 days, although complex or numerous requests may take longer. We will inform you if we require an extension.

Please note that even after account deletion, we may retain certain information where we have a legitimate legal basis to do so, such as for fraud prevention, to resolve disputes, to enforce our agreements, or to comply with legal obligations. In such cases, we will inform you of the specific reason for retaining the information.

Last Updated: April 25, 2026 | [email protected] | https://www.xelta.ai EULA: https://www.apple.com/legal/internet-services/itunes/dev/stdeula/