1. Introduction
Amalgam Holdings Pty Ltd (ABN pending) ("we," "us," "our") operates XESO, a knowledge management platform. This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information when you use our Service. We are committed to complying with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and, where applicable, the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). By using the Service, you consent to the practices described in this policy.2. Information We Collect
2.1 Account Information. When you create an account, we collect your name, email address, and profile photograph (if provided by your authentication provider).
2.2 User Content. We store the content you submit to the Service, including URLs, documents, text, and the structured notes, summaries, and metadata generated from that content.
2.3 Usage Data. We automatically collect technical and usage data including browser type, operating system, device type, pages visited, features used, session duration, and performance metrics. When you are signed in, this data is linked to your account through a pseudonymous user ID, so it is not anonymous. We remove emails, tokens, and similar identifiers from event properties before they are stored. You can turn off product analytics in Settings → Privacy, or decline them in the analytics notice shown on our website.
2.4 Payment Information. If you subscribe to a paid plan, payment is processed by Stripe, Inc. We do not store your credit card number, CVV, or full payment details on our servers.
2.5 Cookies and Similar Technologies. We use strictly necessary cookies (session tokens, CSRF protection) to operate the Service. Our own product analytics are on by default; your choice in the analytics notice is stored in your browser's local storage, and if you decline we also set a cookie (kept for up to 400 days) so we stop recording analytics before the page fully loads. We do not use advertising cookies or tracking pixels. If we turn on forwarding to PostHog, the same pseudonymous analytics events are also sent to PostHog (see section 4).
2.6 Security Data. When you sign in, Cloudflare Turnstile collects browser, network, and challenge data to check that the request is not automated abuse.3. How We Use Your Information
We use your information exclusively to: (a) provide, maintain, and improve the Service; (b) authenticate your identity and maintain account security; (c) process transactions and send billing-related communications; (d) transmit User Content to third-party AI model providers for processing as part of core Service functionality; (e) generate embeddings and search indexes to enable knowledge retrieval; (f) send Service-related notifications; and (g) comply with legal obligations. We do not use your personal information for advertising, profiling, or automated decision-making. We do not sell your personal information to third parties under any circumstances.4. Third-Party Data Processing
We disclose personal information to the following service providers so they can run parts of the Service for us. The full registry, including optional providers that stay disabled unless configured, is at /subprocessors.
Google Cloud (Cloud Run and Cloud SQL): Hosts the application and stores all account data and User Content, in the us-central1 region (United States).
Google (Gemini API): Used for natural language processing, summarisation, conversational AI, and generating text embeddings. Google's handling of prompts and responses is governed by the terms attached to the active API project and service tier, and Google may process this data in countries other than the United States. Provider processing and limited safety or abuse-monitoring retention are not the same as XESO using your content to train a model.
Google (OAuth): Used for authentication. We receive your name, email, and profile photo via Google Sign-In.
Google Workspace APIs (Gmail, Calendar, Drive): Only if you connect them; see section 5.
Microsoft (Microsoft Graph): Only if you connect a Microsoft calendar. XESO reads your events from now to 14 days ahead (title, description, location, times, attendees, and meeting link) and stores them to prepare meeting briefs. Read-only.
Zoho CRM: Only if you connect it. XESO imports the CRM records you choose, and, if you turn on scheduled import, keeps importing new records. Data is processed in your Zoho data centre.
Granola and Readwise: Only if you connect them. XESO imports the meeting notes or highlights you choose.
Tavily: Only when you use web research. Your research question, or search queries generated from it, are sent to Tavily, which returns public web results. Tavily's terms allow it to use queries to improve its service, so avoid including confidential details in web-research questions.
OpenAI or Anthropic: Only if you add your own API key (see 4a.4).
Resend: Sends account email such as sign-in links and notifications, and receives email you send to a XESO import address if you use that feature.
Stripe: Used for payment processing. Stripe is PCI DSS Level 1 certified and processes payment data in accordance with their privacy policy.
Cloudflare (Turnstile): Protects sign-in against automated abuse.
Sentry: Error monitoring, only when enabled. Receives error reports with request metadata and scrubbed user context.
PostHog: Product analytics, only when forwarding is enabled. Receives pseudonymous analytics events with identifiers removed.
Public sources you ask us to fetch: When you import a public link (for example a YouTube video or a web page), we request it from that site.
Overseas disclosure. XESO is operated by an Australian company, but most of these providers store or process data in the United States. Google's Gemini API and Tavily may process data in other countries; Microsoft and Zoho process data in the region of your account. By using the Service, your personal information will be disclosed to recipients outside Australia, principally in the United States.4a. Training Data Pledge
We do not use your content to train or evaluate AI models. This is a hard commitment by XESO, not a marketing line:
4a.1 No training by XESO. We do not train, fine-tune, distill, or evaluate any model (proprietary, open-source, or third-party) on your notes, chat transcripts, prompts, embeddings, uploaded files, or any content you submit to the Service.
4a.2 Provider processing. AI providers process the context needed to serve a request under the terms attached to the active deployment and account. Those terms can differ by provider, service tier, optional integration, and user-supplied key. We publish current provider references in our Trust Center and subprocessor documentation. We do not represent provider processing as zero retention, and a provider-policy statement does not replace deployment-specific verification.
4a.3 No aggregate or anonymised exception. We also do not build “anonymised” training corpora from your data. De-identification is still derivation, and we do not derive models from your content.
4a.4 Bring-your-own-key. When you supply your own Anthropic or OpenAI API key, chat requests go from our backend to your configured provider under your account's terms. Search embeddings for your content are still created with XESO's Google Gemini key, and some supporting AI steps may also use it, so Google still processes your content even when you use your own key.
4a.5 Audit. A machine-readable version of this pledge is published at /.well-known/ai-training-pledge.txt and mirrored in docs/security/DATA_HANDLING.md in our source repository for verification.
If we ever change this policy, we will: (a) notify all active users by email at least 30 days before the change takes effect, (b) make the change opt-in rather than opt-out, and (c) publish a dated record of the change in our Trust Center.5. Google User Data and Limited Use
Some optional features let you connect a Google account so you can bring your own Google data into XESO. These connections are always started by you and are read-only. Each one accesses only the data described below. If you never connect a Google account, none of the access below applies.
5.1 Gmail (gmail.readonly). Gmail import works by search, not by picking individual messages. When you import, XESO uses a Gmail search to find messages: the default search is your inbox (in:inbox), and you can choose another search such as starred, unread, or all mail. Each import fetches up to 25 matching messages (10 by default), newest first, and reads the full content of each one; repeating the import continues through older matching messages. If you turn on scheduled import, XESO runs your saved search every 6 or 24 hours (as you choose) and imports up to 10 of the newest matching messages each time. Imported messages are added to the folder you choose. That is your private library unless you choose a folder in a shared team workspace, in which case other members of that workspace can see them. Imported messages become searchable and citable alongside your other notes. XESO never sends, modifies, deletes, or manages email.
5.2 Google Calendar (calendar.readonly). When you connect Google Calendar, XESO reads your events from now to 14 days ahead, including title, description, location, start and end times, attendees, and meeting link, and stores them so it can generate pre-meeting briefs drawn from your own notes. It refreshes these events on a schedule while the connection is active. This access is read-only. XESO never creates, edits, or deletes calendar events.
5.3 Google Drive (drive.file). When you import from Google Drive, XESO accesses only the files or folders you pick through Google's file picker. If you pick a folder and turn on scheduled import, XESO checks that folder for new files on a schedule and imports up to 15 new files per run. XESO cannot see files in your Drive that you have not picked.
5.4 How we handle Google data. Data imported from Google is stored in the folder you choose (your private library, unless you choose a shared team workspace folder) and used solely to provide the Service to you. It is not used for advertising, is not sold, and is not transferred to others except as necessary to provide the Service or as required by law. It is not used to train generalised AI models. You can disconnect any Google connector at any time in Settings → Connectors, which revokes XESO's access, and deleting the imported notes removes that data from your library.
5.5 Limited Use. XESO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.6. Data Storage and Security
Your data is stored in PostgreSQL databases on Google Cloud in the us-central1 region (United States), protected by security measures including: TLS encryption in transit, encryption at rest by Google Cloud (AES-256), an additional encryption layer for stored connector credentials, access control, regular security patches, and automated backups.7. Data Retention
We retain your account information and User Content for as long as your account is active. If you delete your account, we will delete your personal information and User Content within 30 days, except where retention is required by law. Backup copies may persist in encrypted archives for up to 90 days after deletion.8. Your Rights
Depending on your jurisdiction, you may have the following rights: Access, Correction, Deletion, Export, Restriction, Objection, and Non-discrimination. To exercise any of these rights, contact us at privacy@xeso.ai. We will respond within 30 days.9. International Data Transfers
Your data may be processed in jurisdictions outside your country of residence, including the United States and Australia. Where data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses or other approved transfer mechanisms.10. Children's Privacy
The Service is only for people aged 18 or over. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, contact us at privacy@xeso.ai.11. Data Breach Notification
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will: (a) notify the relevant supervisory authority within 72 hours; (b) notify affected individuals without undue delay; and (c) provide details of the nature of the breach, the data affected, and the measures taken to address it.12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 14 days before the changes take effect.13. Contact Us and Complaints
If you have questions, concerns, or complaints about this Privacy Policy, contact us at:
Amalgam Holdings Pty Ltd
Email: privacy@xeso.ai
How to make a complaint. Email privacy@xeso.ai with your name, how to contact you, and what your complaint is about. We will look into it and respond in writing within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, if you are in the EU or UK, to your local data protection authority.