Privacy Policy

1. Information we collect

Information you give us

• Account data. When you sign in with Google or GitHub, our authentication provider passes us your email address, your name and your profile image, plus an identifier for the provider account. We never receive your Google or GitHub password.
• Content data. Briefs, prompts, project and shot structure, notes, and any images, video or audio you upload or generate.
• Team data.If you create or join a team, the team’s name and membership, and which projects are shared within it.
• Communications. Anything you send us by email or through a support or feedback channel.

Information we collect automatically

• Usage data. Which features you use, what you generate, when, and the credits it consumed. We keep a credit ledger so both of us can see what a balance was spent on.
• Device and connection data. IP address, browser and operating system, device type, screen size, language, and referring page.
• Diagnostic data. When something breaks, our error monitoring records the error, a stack trace, the page you were on and an identifier for your account, so we can find the fault.
• Cookies and local storage.We use cookies for the session that keeps you signed in and for your theme preference. We use browser storage to hold in-progress work so a reload does not lose it. See our Cookies & Browser Storage notice for purposes, retention and controls, including storage left by a previous Google Ads tag. Read the cookie notice and manage browser data.

2. How we use information

• To run the service. Authenticate you, store your projects, route generations to model providers, deliver media, and keep your credit balance accurate.
• To support you. Answer your questions and investigate problems you report.
• To improve the service. Understand which features are used and where they fail, in aggregate.
• To keep the service safe. Detect abuse, enforce the acceptable-use rules, prevent fraud, and secure accounts.
• To communicate with you. Send service messages about your account, changes to the product, and changes to this document. Marketing email, if we ever send it, will be something you can opt out of.
• To comply with the law and to establish, exercise or defend legal claims.

3. Training and your content

We do not train AI models on your content, and we do not sell your content or your personal information. dot ai, Inc. does not build or fine-tune models on the briefs, prompts, images or video you put into xDots.

To generate anything, we must send your prompt and any reference material to the model provider you are generating with. Those providers are named in the table below, and what they do with data they receive is governed by their own terms. If this matters to your work, read the terms of the provider behind the model you are using, and write to us at privacy@xdots.app and we will tell you what arrangement we have with them.

A small number of people on our team can access content when it is necessary to investigate a fault you have reported, to respond to a legal request, or to act on a report of abuse. We do not browse user projects otherwise.

4. Who we share it with

We share personal information with the service providers below, each only to the extent needed for the purpose shown. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

We may also disclose information:

• To comply with a law, regulation, subpoena or other valid legal process, after reviewing whether the request is properly scoped.
• To protect the rights, property or safety of dot ai, Inc., our users or the public.
• To an acquirer, in connection with a merger, financing, reorganisation or sale of assets — with notice to you, and subject to this policy continuing to apply.
• To anyone else, with your direction or consent.

5. International transfers

dot ai, Inc. operates from the United States, and the providers above process data in the United States, with one exception: generations routed to Jimeng are processed in China. Data protection law in those countries may differ from the law where you live.

Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses, or the UK Addendum to them, together with additional safeguards where they are needed.

6. Your rights and choices

Wherever you live, you can ask us to give you a copy of the personal information we hold about you, correct it, or delete it. You can delete individual projects and media in the product at any time, and you can close your account, which deletes the content associated with it.

Write to privacy@xdots.app. We will respond within the period the applicable law requires — 30 days in most cases, 45 in California. We may need to verify your identity before we act, and we will not treat you differently for exercising a right.

7. EEA and UK residents

If you are in the European Economic Area or the United Kingdom, dot ai, Inc. is the controller of your personal data, and we rely on these legal bases:

• Performance of a contract — to provide the service you have asked for, including running generations and storing your projects.
• Legitimate interests — to secure the service, prevent abuse and fraud, understand how features are used, and improve the product, where those interests are not overridden by your rights.
• Consent — where we ask for it, such as for optional communications. You can withdraw consent at any time.
• Legal obligation — where the law requires us to process or retain data.

You also have the right to object to processing based on legitimate interests, to request restriction of processing, to data portability, and to lodge a complaint with your local supervisory authority. We would rather hear from you first, at privacy@xdots.app.

8. California residents

Under the California Consumer Privacy Act, as amended, you have the right to know what personal information we collect and disclose, to request deletion, to request correction, and not to be discriminated against for exercising those rights.

In the past twelve months we have collected the categories of personal information described in section 1: identifiers, account and profile data, commercial information (your credit ledger), internet and device activity, and the user-generated content you create. We collect it from you and from your device, for the purposes described in section 2, and we disclose it for business purposes to the providers in section 4.

We do not sell personal information. A previous site-wide Google Ads tag made advertising measurement requests; see Cookies & Browser Storage notice at /cookies for details and controls. Contact us to exercise any applicable right to opt out of sale or sharing. We do not use or disclose sensitive personal information for purposes that require an opt-out. We do not knowingly sell or share the personal information of anyone under 16.

9. Other US state rights

Residents of other US states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana — have comparable rights to access, correct, delete and obtain a portable copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. As described above, we do not sell personal information, do not conduct targeted advertising, and do not carry out profiling that produces legal or similarly significant effects.

Use the same address — privacy@xdots.app — to exercise a right or to appeal a decision we have made about a request.

10. Security

Data is encrypted in transit and at rest with our infrastructure providers. Access to production systems is restricted to the people who need it. Authentication is handled by a dedicated provider, so we never hold your password.

No service is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulators as the law requires.

11. Retention

We keep personal information only as long as we need it for the purposes described here.

• Projects and media — until you delete them, or until you close your account.
• Account data — for the life of your account. When you close it, we delete or anonymise account data within 30 days, except where we must keep something to meet a legal obligation or to resolve a dispute.
• Backups — deleted content persists in backups for a limited window before those backups roll over.
• Diagnostic and log data — retained on a short rolling window and then discarded.

12. Children

xDots is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, write to privacy@xdots.app and we will delete it.

13. Other sites and services

xDots links to and integrates with services we do not control. This policy does not cover them, and we are not responsible for their practices. Read their policies before giving them information.

14. Changes to this policy

We will update this page when our practices change, and we will move the date at the top when we do. For material changes we will give notice in the product or by email before they take effect.

15. How to contact us

dot ai, Inc., operator of xDots. For any privacy question, any request about your data, or anything in this document: privacy@xdots.app.