Privacy Policy

1. Who is responsible for your data

XRX, based in the Republic of Korea, operates XALIVE and is responsible for your personal data ([privacy officer, address, and contact details to be added]). If a United States affiliate later takes over operations for some regions, we will update this policy first.

This policy covers the services at xalive.ai. Questions or requests: [privacy contact email to be confirmed] or the contact page on this site.

2. What we collect

XALIVE handles some kinds of data that most services do not, so we list them explicitly:

• Account basics — your email address, sign-in method, and profile name.
• Conversations — what you and your characters say to each other, in text and voice. Voice may be converted to text so the character can respond.
• Character memories — things you deliberately teach a character, which it keeps as its memory. You can review, correct, and delete these at any time.
• Emotional signals — the service estimates the mood of a conversation so characters can react naturally. These are rough estimates used for expression only. They are not a psychological assessment and are never treated as medical data.
• Face data (optional) — if you turn on face recognition, the camera is used so your character can recognize you and mirror your expressions. This only happens after you give separate, explicit consent, and you can withdraw that consent at any time in settings.
• Uploaded material — character files, images, and audio you upload.
• Payment details — handled by our payment provider (Stripe is planned). We do not store your full card number.
• Usage and device data — logs, device type, and language settings, used to keep the service working and secure.

3. Why we use it

We use your data to run XALIVE: to let characters talk, remember what you taught them, and react to you; to process subscriptions; to keep the service safe; to provide support; and to improve how the service works. We do not sell your personal data, and we do not use your private conversations for advertising.

4. Who processes data for us

We rely on a small set of service providers, bound by contracts, to run XALIVE:

• Hosting and delivery — Vercel (web hosting).
• Data storage — Supabase (accounts, conversations, memories, uploaded files).
• AI providers — companies whose AI models generate character responses, voices, and image understanding, such as Anthropic, OpenAI, Google, and ElevenLabs. Conversation content is sent to them to produce a response and is handled under our agreements with them.
• Payments — Stripe (planned).

5. Where your data travels

Some of the providers above run their systems outside your country, including in the United States. When your data crosses borders, we require contractual safeguards from the provider. [Detailed cross-border transfer table — recipients, countries, items, retention — to be completed for Korean PIPA and GDPR compliance.]

6. How long we keep it

We keep your data while your account is active. Conversations and character memories stay until you delete them or delete your account.

Some records must be kept for legally required periods even after deletion — for example, payment and contract records under commerce law. Face data is deleted promptly when you withdraw consent. [Statutory retention table to be confirmed by counsel.]

7. Deleting your data — the 30-day window

You can delete individual memories and conversations inside the service at any time.

You can also ask for full deletion of your account and data. When you do, your data enters a 30-day grace period: it is taken out of use immediately, and you can change your mind during those 30 days. After the window closes, everything is permanently deleted and cannot be recovered, except for records the law requires us to keep.

8. Your rights

You can ask to see the data we hold about you, correct it, delete it, or stop certain uses. You can withdraw consent — including face-data consent — at any time without losing access to the rest of the service. To exercise any right, use the in-service settings or contact us; we will respond within the time the law requires.

9. If you are in the EEA or UK (GDPR)

We process your data to perform our contract with you (running the service), with your consent (face data, optional features), and for our legitimate interests (security, service improvement). You have the rights of access, rectification, erasure, restriction, portability, and objection, and you may lodge a complaint with your local supervisory authority. [EU representative appointment to be reviewed by counsel.]

10. If you are in California (CCPA/CPRA)

The categories we collect are listed in section 2. We do not sell or share your personal information as those terms are defined in California law. You have the right to know, delete, correct, and to not be discriminated against for exercising your rights. [Sensitive-personal-information handling disclosures to be reviewed by counsel.]

11. Children

XALIVE is not directed at children under 14 (or the higher minimum age of your country). We do not knowingly collect data from children below that age; if we learn we have, we will delete it.

12. Security and changes

Data is encrypted in transit, access is restricted, and face data is gated behind separate consent records. No system is perfectly secure, but if a breach affects you, we will notify you as the law requires.

If this policy changes in a meaningful way, we will tell you in advance through the service or by email.