Privacy Policy

XactSight AI is the trading name used for this service. XactSight AI is the controller of personal information used for our own business purposes. You can contact us about privacy at info@xactsight.ai.

A business customer may be the controller of personal information it submits about its clients, staff, tenants, contractors or other people. In that situation, we generally process the information on the customer’s behalf, and the customer should deal with rights requests in the first instance.

Depending on how you interact with us, we may collect:

• Contact and business details, such as your name, work email, telephone number, company, role, address, website and communication preferences.
• Enquiry and customer records, including demo requests, correspondence, support messages, agreements, billing details and feedback.
• Service content, such as WhatsApp messages, profile names, telephone numbers, videos, photographs, voice notes, documents, transcripts, job details, property information, report text, evidence, notes and branding that users provide.
• Generated and usage information, including draft findings and reports, actions taken in the Service, dates and times, message and report identifiers, delivery and processing status, and error or security logs.
• Website information, such as pages viewed, referral source, approximate location, browser, device type and operating system. Our current Vercel Web Analytics setup is cookie-free and reports aggregated data rather than identifying visitors across websites or days.

The editable public demo stores your demo changes in your own browser’s local storage. We do not receive those saved edits unless you separately send them to us. You can remove them by resetting the demo or clearing this site’s stored data in your browser.

We receive information directly from you, from the organisation that gives you access to the Service, from people who communicate with our WhatsApp business account, and from the content users submit. We also receive delivery, account and message information from Meta’s WhatsApp Business Platform, and technical information from our hosting, cloud and security providers.

If you provide information about another person, you must have authority to do so and give them any privacy information required by law.

• To respond to enquiries and arrange demonstrations: to take steps at your request before a contract and for our legitimate interest in developing business relationships.
• To provide and support the Service: to perform our contract with you or our customer, and for our legitimate interest in delivering a reliable business service.
• To analyse submitted content and create drafts: to perform the contract and provide the feature requested by the user.
• To secure, troubleshoot and improve the Service: for our legitimate interests in preventing misuse, monitoring performance and improving functionality.
• To keep business and compliance records: to comply with legal obligations and for our legitimate interests in establishing, exercising or defending legal claims.
• To send product or service updates: with consent where required, or for our legitimate interests in marketing relevant services to business contacts where the law permits. You can opt out at any time.
• To measure website use: for our legitimate interest in understanding aggregate website performance and improving the visitor experience.

Where we rely on legitimate interests, we consider whether the use is necessary, proportionate and reasonably expected, and balance it against people’s rights. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

We use Google’s Gemini services to transcribe and analyse submitted content and produce draft text and structured results. Outputs are intended for human review. The Service does not make decisions based solely on automated processing that produce legal or similarly significant effects about individuals.

Users should not submit unnecessary personal information or use the Service as the sole basis for decisions about employment, housing, safety, legal rights or access to services. Our Terms & Conditions require a competent person to verify output.

We share information only where needed with:

• Google Cloud, Firebase and Gemini for cloud hosting, databases, file storage, server functions, transcription and AI analysis;
• Meta and WhatsApp to receive and send business messages and media;
• Vercel for website hosting and privacy-focused website analytics;
• IT, security, monitoring and professional advisers who support our business under suitable confidentiality and data-protection obligations;
• regulators, courts, law enforcement or other parties where disclosure is required by law or needed to protect rights, safety and security; and
• a buyer, investor or successor in connection with a genuine financing, reorganisation or sale, subject to appropriate safeguards.

We do not sell personal information.

Some providers operate in the United States and other countries, so information may be processed outside the United Kingdom. Where UK data-protection law restricts a transfer, we use an applicable UK adequacy regulation or recognised safeguards such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or a provider’s valid certification under the UK Extension to the EU–US Data Privacy Framework. You may contact us for more information about the safeguard used for a particular transfer.

• Uploaded job media and extracted evidence images: normally removed from our active cloud storage after 30 days. Temporary copies used by providers may be subject to their shorter operational and abuse-monitoring periods.
• Report text, transcripts, messages and profile details: kept while needed to provide the Service, maintain the business record, resolve issues and meet the customer’s instructions. They remain until deleted under our retention process, following a valid request, or when no longer needed.
• Early-access and sales enquiries: normally kept for up to 24 months after our last meaningful contact, unless you become a customer or ask us to delete them sooner.
• Contracts, invoices and essential transaction records: normally kept for six years after the relevant relationship or transaction for tax, accounting and legal purposes.
• Security, rate-limit and technical records: kept for the shortest period reasonably needed for security, diagnostics and legal compliance.

We may retain information longer where law, a dispute, a legal hold or a customer instruction requires it. Backup copies are removed on their normal rotation.

We use technical and organisational measures intended to protect information, including encrypted connections, access controls and provider security features. No internet service is completely secure. You must protect access links and devices and tell us promptly if you suspect unauthorised access.

Depending on the circumstances, UK data-protection law may give you the right to:

• ask for a copy of your personal information;
• correct incomplete or inaccurate information;
• ask us to delete or restrict use of information;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable format; and
• withdraw consent where processing relies on consent.

You have an absolute right to object to direct marketing at any time.

To exercise a right, email info@xactsight.ai. We may need to verify your identity. If your information was supplied through your employer or another XactSight AI customer, we may refer the request to that controller.

Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator, at ico.org.uk/make-a-complaint/.

The Service is for business users aged 18 or over and is not directed to children. Please do not deliberately submit information about children unless it is necessary for a lawful business purpose and you have established an appropriate legal basis and safeguards.

We may update this policy as the Service, providers or law changes. We will publish the new version here and change the date at the top. We will give additional notice where a change materially affects how we use personal information.