Privacy Policy
Last updated: August 4, 2026
Xpander, Inc., including our subsidiaries and affiliates (collectively “xpander”, “we”, “our” or “us”), is an AI agents lab. We develop and operate a vendor-neutral platform and related solutions that enable companies and individuals (our “Customers”) to build, deploy, run, and manage AI agents and agentic workflows across the AI models, infrastructure, and applications of their choice (the “Platform”). Our offerings include our enterprise agent platform, specialized and in-product agents, and Omni, our generalist AI agent.
Please note: Where a Customer self-deploys and operates the Platform within its own environment (for example, on its own compute, virtual private cloud, or on-premises infrastructure) and uses both an AI service provider other than xpander and its own private connectors, the Customer — and not xpander — is the Controller for all processing activities, and this Privacy Policy does not apply to such processing.
This Privacy Policy describes how we collect, store, use and disclose personal information of:
Users who are registered to xpander’s Platform.
Representatives who interact with us as the business contacts of our Customers.
Prospects who visit our website at https://www.xpander.ai (the “Website”), interact with our online ads and content, surveys, emails or other communications under our control (collectively with the Platform, the “Services”) or any other representative of a prospective customer (collectively – “you” or “your”).
Privacy is important to us, and we are strongly committed to transparency and fairness in our data processing activities. Please read this Privacy Policy carefully and make sure that you fully understand and agree to our practices.
You are not legally required to provide us with any personal information, and may do so (or avoid doing so) at your own free will.
If you do not wish to provide us with your personal information, or to have it processed by us, please avoid any interaction with us or with our Services, or submit a request to exercise your rights as further explained in Section 10 below, but please keep in mind that limiting our processing may also result in us not being able to provide you the ability to use our Services, or with the best user experience when using our Services.
Specifically, this Privacy Policy describes our practices regarding –
When we use the term “personal information” (which we also refer to as “personal data”) in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or anonymized information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.
We may collect or generate the following types of personal information about you:
Usage and device information: Connectivity, technical and usage data, such as IP addresses and approximate general locations derived from such IP addresses, device and application data (like type, operating system, mobile device or app id, browser version, location and language settings used); system logs of actions and events attributed to those IP addresses, devices and applications; the relevant cookies and pixels installed or utilized on your device; and the recorded activity (sessions, clicks, use of features, logged activities and other interactions) of Prospects and Users in connection with our Services. We collect and generate this information automatically, including through the use of analytics and system monitoring tools (including cookies and pixels) – which collect data such as: how often Prospects visit or use the Website, which pages they visit and when, which website, ad or email message brought them there, how Users interact with and use the Platform and its various features, and technical data concerning the performance, functionality and stability of the Platform.
Content Data: Interactions with the Platform or resulting APIs. This includes prompts or Platform responses, which may include text, files and documents, photos and images, other materials and associated metadata and information or any other content that was inserted to the chat interface or API.
User Account data: personal information collected for Users’ registration to the Platform, including full name, contact information and password.
Business Details Information: including your contact details, position and workplace, contractual and billing details.
Direct interactions and communications with us: personal information contained in any forms and inquiries that you may submit to us, including form submissions, emails, and chats with us, recordings and transcripts of your calls (e.g., for customer service, feedback and support).
We may obtain the categories of personal information listed above from the following categories of sources:
Directly from you: You may provide us with personal information when you choose to use our Services, request information from us or contact us for any other reason, including via email or through your interactions with the Platform.
Data automatically collected or generated: When you interact with or use our Services, we may collect certain technical data about your device (such as your operating system, IP address, device identifier, browsing history, etc.). We collect or generate such data either independently or with the help of our Service Providers (as detailed in Section 5 below), including through the use of “cookies” and other tracking technologies (as further detailed in Section 7 below).
Data received from third party services: Our Services may be used in connection with third party services, sites, and mobile applications. If you use our Services with or through such third parties, we may receive personal information about you from such third parties. Please note that when you directly engage with such third-party services, sites and mobile applications, any aspect of that engagement that is not directly related to the Services and directed by xpander is beyond the scope of xpander’s Terms of Use and this Privacy Policy, and their own terms and privacy policies will govern your use of those services.
Data Uses & Business Purposes
We use your personal information as described in Section 1 as necessary for the performance of our Services (“Performance of a Contract”); to comply with our legal and contractual obligations (“Legal Obligations”); and to support our legitimate interests in maintaining and improving our Services (“Legitimate Interests”).
If you reside or are using the Services in a territory governed by privacy laws which determine that “consent” is the only or most appropriate legal basis for the processing of personal information as described in this Privacy Policy (either in general, based on the types of personal information you expect or elect to process or have processed by us or via the Service, or due to the nature of such processing) (“Consent”), your acceptance of our Terms of Service and of this Privacy Policy will be deemed as your consent to the processing of your personal information for all purposes detailed in this Privacy Policy, unless the applicable law requires a different form of consent. If you wish to withdraw such consent, please contact us at privacy@xpander.ai.
Specifically, we collect and use personal information for the following purposes (and in reliance on the legal bases for processing noted next to them, as appropriate):
Purpose
Legal basis for processing
Users and Prospects personal information
To facilitate, operate, enhance, and provide usage of our Services.
Performance of a Contract
Legitimate Interests
Consent
To provide you with assistance and support.
Performance of a Contract
Legitimate Interests
To develop, customize and improve the Services and our Users’ and Prospects’ experience, based on common or personal preferences, experiences, difficulties and feedback.
Performance of a Contract
Legitimate Interests
Consent
To authenticate the identity of our Users, and to allow them to access and use our Services.
Performance of a Contract
Legitimate Interests
Individual Users only: to train and refine our AI models. This purpose refers strictly to individual Users and Prospects. We do not train on personal information of Users and Prospects who are using our Platform on behalf of a corporate Customer. This does not apply to data received from Google Workspace APIs (e.g. Gmail, Drive, Calendar, Docs, Sheets, Meet), which is never used to develop, improve, or train any AI/ML model (ours or a third party’s), and is used solely at inference time to fulfill the user’s request.
Legitimate Interests
Users, Representatives and Prospects personal information
To contact you with general or personalized service-related messages (such as password-retrieval or billing); or with promotional messages (such as newsletters, special offers, new features etc.); and to facilitate, sponsor and offer certain events and promotions.
Performance of a Contract
Legitimate Interests
Consent
To support and enhance our data security measures, including for the purposes of preventing and mitigating the risks of fraud, error or any illegal or prohibited activity.
Performance of a Contract
Legitimate Interests
Legal Obligations
To create aggregated statistical data, inferred non-personal data or anonymized or pseudonymized data (rendered non-personal), which we or our business partners may use to provide and improve our respective services or for any other business purpose.
Legitimate Interests
To facilitate and optimize our marketing campaigns, ad management and sales operations, and to manage and deliver advertisements for our Services more effectively, including on other websites and applications. Such activities allow us to highlight the benefits of using our Services, and thereby to increase your engagement and overall satisfaction with our Services.
Consent
Legitimate Interests
To comply with our contractual and legal obligations and requirements, and maintain our compliance with applicable laws, regulations and standards.
Performance of a Contract
Legitimate Interests
Legal Obligations
For any other lawful purpose, or other purpose that you consent to in connection with provisioning our Services.
Legal Obligations
Consent
Google User Data and Limited Use
xpander’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google Workspace APIs is used only to provide and improve user-facing features at the user’s explicit request, is never sold, and is not used to develop, improve, or train generalized or third-party AI/ML models. Where xpander sends this data to third-party AI/LLM providers, it does so only at inference time to fulfill the user’s request, exclusively on commercial/enterprise API tiers whose terms prohibit training on submitted data.
Cookies and Tracking Technologies
Communications
Data Security
Data Subject Rights
Additional Information and Contact Details