Privacy Policy

Overview

This AI platform is operated by Xicoia Ltd ("Xicoia"), a company registered in England and Wales (company number: 16248273) whose registered office is at 20 Vespasian Way, Dorchester, England, DT1 2RD. Xicoia Ltd is the data controller of the personal data described in this policy.

Xicoia is an AI-first company and provides AI-powered platform services to its users.

Our representative in the European Economic Area. Xicoia Ltd is established in the United Kingdom. Because we offer our platform to individuals in the European Economic Area, we have appointed a representative in the EEA under Article 27 of the EU GDPR:

Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• The European Economic Area (EEA) — the member states of the European Union, together with Iceland, Liechtenstein and Norway

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative Prighter, or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/XicoiaLtd

If you are in the EEA, you may also contact our EEA representative by post on any matter relating to our processing of your personal data, including to exercise your rights. Please mark your correspondence "For the attention of the Article 27 representative of Xicoia Ltd" and include your contact details. Contacting our representative does not affect your right to contact us directly using the details in Section 13, or to complain to your local supervisory authority.

All references to 'Xicoia', 'our', 'us' or 'we' within this policy refer to Xicoia Ltd. Where third-party providers process personal data on our behalf, they do so as our service providers under contract, as described in Section 6.

We value the privacy of those who provide personal data to us. This policy applies to our platform users (and potential users) and members of the public. It describes:

• the data identifying you that we collect
• how we use this data
• the legal basis upon which we process it
• with whom it is shared
• how it is stored

This privacy policy applies to personal data we collect through our AI platform, associated applications, social media platforms, or that you provide to us by email, telephone, or otherwise.

Please read this privacy policy carefully to understand how we handle your personal data before you access or use our platform, or provide your personal data to us.

Policy in Detail

The Policy comprises the following Sections:

• Section 1: Data collection
• Section 2: Use of data
• Section 3: Legal basis for use of your personal data
• Section 4: AI processing of your inputs and conversations
• Section 5: Automated decision-making and profiling
• Section 6: Disclosure of personal data
• Section 7: Retention of personal data
• Section 8: Your rights
• Section 9: Marketing
• Section 10: Transfers of data
• Section 11: Security
• Section 12: Changes to our privacy policy
• Section 13: Further questions or making a complaint

Section 1: Data Collection

Most of the data we hold about you comes directly from you. We may also receive limited data about you from third parties such as our sign-in and payment providers when you register or pay ("Third Party Sources").

We, or third parties on our behalf, may collect and use any of the following data about you and we refer to this as "personal data" throughout this policy:

Personal Data Which You (or a Third Party Source) Give Us

You may give us personal data about yourself by registering for an account on our platform, using the AI platform services, ordering services from us, or by contacting us by phone, email, or other means.

This personal data will include:

Data about you if you are a platform user:

• your name
• email address
• data provided when you correspond with us
• any updates to data provided to us
• account registration data, including username and password credentials
• a normalised version of your email address, which we retain to enforce fair-usage limits (for example, one free trial per person)
• financial payment details

Data generated through your use of the AI platform:

• prompts, queries, and inputs submitted to the AI platform
• conversation histories and interaction logs
• video and audio recordings of your calls with our AI characters — every call is recorded, including your image and voice, and a link to your recording is emailed to you (see Section 4)
• age-check data — before your first call, a selfie (and, if the result is unclear, an image of a photo ID) is analysed by our age-check provider to estimate or confirm your age; the images are not kept after the check and we keep only the result (see Section 4)
• memory data — information our AI characters retain from your previous conversations to personalise future sessions (see Section 4)
• feedback and ratings provided on AI-generated outputs

Data about our platform users:

• your IP address
• your username
• your behaviour on our platform (for example, the features you use, queries submitted, and session duration)

Data about the services we provide to you:

• data needed to provide our services (including details of your order, our services, order history, payment details, and tax information)
• customer services data

Please note that we need certain types of personal data so that we can provide services to you. If you do not provide it — for example your email address when you register, or access to your camera and microphone when you start a call, or the selfie for the age check before your first call — we will not be able to create your account or run your call. If you later ask us to delete it, you may no longer be able to access our platform and services. Your personal data is processed in the United Kingdom, in Ireland (where our database and recording storage are located) and by the service providers listed in Section 6, some of which are in the United States; Section 10 explains the safeguards that apply.

Personal Data We Collect Automatically

Each time you use our platform we may automatically collect any of the following data:

• Technical data, including the Internet protocol (IP) address used to connect your device to the internet, device type, browser type and version, operating system and platform
• Data about your use of the platform, including the features accessed, time and length of sessions, interaction data (such as clicks and navigation patterns), traffic data, and location data

Cookies and Similar Technologies

Our platform uses a small number of cookies and similar storage, all of it needed to provide the service you have asked for: sign-in cookies set by our authentication provider; if you arrive via one of our promotional or feedback links, a short-lived cookie that remembers that link so we can apply its complimentary minutes to your account (deleted after 7 days); local storage on your device recording your acceptance of our terms and your marketing preference; temporary storage that lasts only until you close the tab and keeps your call working; and cookies set by our payment provider to help prevent fraud when you buy minutes. We do not use third-party advertising or analytics cookies, and we do not store any analytics identifier on your device; the usage analytics described in this policy are collected first-party. Some browsers can send "Do Not Track" signals; there is no common industry standard for responding to these signals, and we do not currently respond to them.

Section 2: Use of Data

We, or our service providers acting on our behalf, collect, use and store the personal data listed above for the following reasons:

Operating and Providing the AI Platform

• to allow you to access and use our platform and services
• to provide technical support
• to provide you with the information and services that you request from us
• to ensure the security and integrity of our services and platform
• to store information about your preferences
• to recognise you when you return to our platform
• to process orders which you place for information or services from us
• for improvement and maintenance of our platform

Providing Services to You

• to register you as a user of our services
• to provide relevant AI platform services to you (including to confirm and process orders, and for administration of your account, tax and invoicing purposes)
• to deal with any enquiries or issues you have about our services, including any questions about how we collect, store, and use your personal data, or any requests made by you for a copy of the data we hold about you
• to send you certain communications (including by email) about our services such as service announcements and administrative messages
• to send you marketing communications where you have opted in to receive them (see Section 9)
• for statistical analysis of platform usage
• for internal corporate reporting, business administration, ensuring adequate insurance coverage, and to identify and implement business efficiencies
• to comply with any procedures, laws and regulations which apply to us
• to establish, exercise, or defend our legal rights

We will not use your personal data in any way that is incompatible with the purposes set out in this section without contacting you first.

Section 3: Legal Basis for Use of Your Personal Data

We consider that the legal bases for using your personal data as set out in this privacy policy are as follows.

In summary: we rely on contract to run your account, your calls, your recording and your transcript; on consent for marketing email (Section 9); on legal obligation for tax and financial records; and on legitimate interests for security, fair-usage enforcement, safety review, first-party analytics, the age check before your first call (Section 4), the aggregate analysis of conversations described in Section 4, and for the AI character sensing your mood during a call so that she can respond naturally (Section 4). The detail is below.

• our use of your personal data is necessary to perform our obligations under any contract with you (for example, to comply with the platform terms of use which you accept by using our platform and our terms if you pay for any additional services).
• our use of your personal data is necessary for complying with our legal obligations (for example, providing information to HMRC).
• your consent (which we rely on only for marketing email — see Section 9).
• where none of the above applies, use of your personal data is necessary for our legitimate interests or the legitimate interests of others (for example, to ensure the security of our platform). Our legitimate interests are to:
  • run, grow and develop our business
  • operate our platform and AI services
  • market research and business development
  • provide services to our customers, make and receive payment, and provide customer service support
  • for internal administrative purposes

If we rely on our (or another person's) legitimate interests for using your personal data, we will undertake a balancing test to ensure that our (or the other person's) legitimate interests are not outweighed by your interests or fundamental rights and freedoms which require protection. You can ask us for information on this balancing test by contacting us at the details set out at the end of this policy.

Where we rely on your consent for us to use your personal data in a particular way but you later change your mind, you may withdraw your consent by contacting us at the details set out at the end of this policy, and we will stop doing so. Because we rely on consent only for marketing email, withdrawing it does not affect your use of the platform.

Section 4: AI Processing of Your Inputs and Conversations

When you use the Xicoia AI platform, you speak and appear on camera, and may type or say prompts, questions and other content ("inputs") to the platform. The following describes how such data is handled.

Conversation and Interaction Data

We collect and process the inputs you submit to the AI platform and the outputs generated in response. This data may be retained to:

• provide and operate the AI platform services
• improve platform performance and user experience
• conduct quality assurance and safety monitoring
• comply with our legal obligations

What the AI Character Sees and Hears During Your Call

During a call, the AI character analyses the live video from your camera and the sound of your voice so that she can respond to what is happening — for example, objects around you, what you are doing, and whether you are looking at the screen. This analysis also infers your likely emotional state from your facial expression and your tone of voice, so that the character can respond in a way that fits the mood of the conversation.

This analysis is used to generate the character's responses while your call is running, and for one safety purpose: the same analysis checks whether explicit sexual content is being shown on camera. If it is, the call ends automatically and you are told why on screen (see Our Safety Checks below). It is not used to identify or recognise you, it does not create a faceprint, voiceprint or other biometric template, and apart from a record of any safety decision we do not store its results. It is separate from the recording of your call, which is described below and in Section 7.

The basis on which we do this. Analysing what is happening on camera and sensing your mood are both part of running a responsive video call. We rely on our legitimate interest in providing a natural, engaging conversation. This processing cannot be switched off for an individual call; if you do not want it, please do not start a call, and you can stop it at any time by ending the call. It creates no faceprint or voiceprint and is not used to identify you. You have the right to object to processing based on our legitimate interests — see Section 8.

Your Image and Voice

To run a video call, we and our platform provider Tavus necessarily process live video and audio of you — your image, facial movements, and voice — for the duration of the call and in the resulting recording and transcript. We use this data only to operate the call, generate our AI character's responses, and produce your recording. We do not use your image or voice to identify you: we do not operate facial recognition, voice identification, or any biometric identification system, and we do not create biometric templates or voiceprints for identification purposes. The basis on which we do this. Processing your image and voice is how the call works and how we produce the recording you asked for, so under UK and EU data protection law we do it to perform our contract with you rather than on the basis of your consent. We take that approach deliberately: we could not deliver the service without this processing, so presenting it as a choice would not be an honest one. You can end the processing at any time by ending the call, and you can ask us to delete your data as described in Section 8.

Separately, before every call we ask you to confirm that you understand and agree to being recorded. If you are a resident of a US state with a biometric privacy law, that pre-call confirmation, together with this section, is intended to provide the notice and consent those laws require — those laws work differently from UK and EU data protection law, and require consent even where we rely on contract here.

The Age Check Before Your First Call

Our platform is for adults only. Before your first call we check your age using an automated age check provided by Didit, our age-check provider. You take a selfie, and Didit analyses your face to estimate your age and to confirm that a live person is present rather than a photograph or screen. If the estimate is clearly 18 or over, you pass. If the estimate is unclear, you are asked to photograph a government-issued photo ID instead, and Didit confirms your age from the date of birth on the document. You take the selfie on Didit's own page, and the image goes from your device straight to Didit; we never receive it. The images are analysed to estimate or confirm your age, not to identify you: no faceprint or other biometric template is kept, and neither the selfie nor any ID image is kept after the check — we delete the Didit session as soon as we have the result. We keep only the result of the check (passed or not), which method decided it, an approximate age band, the date and a reference number, so that we do not need to check you again. We never hold your date of birth, your ID number or any image.

The basis on which we do this. We rely on our legitimate interest in ensuring that an adults-only service is used only by adults and in protecting children, which is also what our Terms require. The check is a condition of using the platform, so it cannot be skipped; if you do not want to take it, please do not use the platform. You have the right to object to processing based on our legitimate interests — see Section 8. If you are a resident of a US state with a biometric privacy law, the notice you see before the check and your agreement to it are intended to be the written notice and consent those laws require for a scan of your face; our retention policy for that data is stated above and in Section 7 — the scan is not kept after the check.

If the check declines you. The result is produced automatically. If the check indicates that you are under 18 you will not be able to use the platform, and we keep a minimal record that your account did not pass (the account identifier, the outcome and the date, nothing else) so that the check is not repeated; any other personal data on the account is deleted. If you believe the result is wrong, email support@xicoiatalent.com and a member of our team will review it; see Section 5.

Our Safety Checks During and After Your Call

Two automated checks run on every call, to keep the platform within our Terms of Use. The first looks at what is shown on camera for explicit sexual content; if it finds it, the call ends and you see a short explanation. The second looks at what is said. The words you speak are transcribed during the call, screened against a list of terms, and passed to an AI classifier that reads the surrounding words to decide whether language was directed abuse — such as slurs used as an attack, threats, or sexual harassment aimed at the character — rather than a word used in discussion or in passing; the classifier reads the whole transcript once more after the call. The classifier reads only the text of what was said, never your video or audio, does not attempt to identify you or infer anything about who you are, and runs on infrastructure in Ireland under contract to us. If abusive speech is confirmed, the call continues but your recording is withheld and you are told this on the end screen.

Where either check flags a call, its transcript is kept for review by our team (see Human Review of AI Interactions below) and the recording is not sent. A member of our team can release a call that was flagged in error, which restores the recording if it has not yet been deleted; if you think a check got it wrong, email support@xicoiatalent.com. A flagged transcript is reviewed within the normal 8-week retention period and is then deleted on the normal schedule unless it is needed for one of the reasons in Section 7. Every safety decision is recorded in an internal log. Our legal basis for these checks is our legitimate interest in keeping the platform safe and enforcing our Terms; see Section 3.

Call Recordings, Transcripts and Memory

Every video call with our AI characters is recorded (video and audio, including your image and voice). Recordings are stored in a private storage bucket controlled by us and are permanently deleted after 24 hours. Within that window, we email you a link to view and download your recording; the link stops working when the recording is deleted. Before the link is sent, the recording is checked by our automated safety systems; we may withhold or delete a recording whose content breaches our Terms, is unlawful or is likely to cause harm, and will tell you if so (see Section 7 of the Terms of Use). A withheld recording is deleted on the same 24-hour schedule as every other recording.

A transcript of each conversation is retained for up to 8 weeks (see Section 7), may be reviewed as described under Human Review of AI Interactions below, and is analysed in aggregate before it is deleted, as described under Aggregate Analysis of Conversations below.

Our AI characters retain limited memory of your previous conversations in order to personalise future sessions. This memory is processed by our platform provider Tavus on our behalf. You can ask us to delete your memory data at any time using the contact details in Section 13.

Use of Your Data to Train or Improve AI Models

We do not use your conversations, recordings or other content to train AI models, and our platform provider Tavus is contractually prohibited from using them to train or improve its models. Tavus may use aggregated and de-identified usage statistics for platform analytics. If this position ever changes, we will update this policy and, where required by law, seek your consent first.

Third-Party AI Model Providers

The Xicoia AI platform is operated with Tavus Inc., our conversational video platform provider, whose sub-processors include Daily (real-time video infrastructure) and third-party AI language-model and voice providers used to generate our characters' responses and speech. Your inputs are processed by this infrastructure in order to generate outputs. Tavus also logs sessions for reliability and support purposes. We ensure that all such providers are bound by appropriate data processing agreements and transfer safeguards consistent with this privacy policy and applicable data protection law.

Human Review of AI Interactions

Certain interactions with our AI platform may be reviewed by authorised Xicoia personnel or trusted third-party partners for the purposes of quality assurance, safety monitoring, and platform improvement. In addition, automated content-safety measures apply to conversations (see Our Safety Checks above), and content flagged by those measures may be reviewed by trained personnel for safety purposes, including responding to indications of a risk of serious harm. Where such review occurs, it is subject to strict confidentiality obligations. We will not use personally identifiable information from such reviews for any purpose inconsistent with this privacy policy.

Aggregate Analysis of Conversations

Before transcripts are deleted, we analyse them in aggregate to understand how the service is used and how the AI character performs — for example, how long conversations last, which broad topics come up most often, how often the character declines a request, and how often our safety measures are triggered. This analysis is automated and produces only statistics about the service as a whole. The results do not identify you, contain no quotations from any conversation, are not linked to your account or to any individual conversation once produced, and are not reported for any category so small that a person could be picked out. Topics are recorded only at a general level; we do not classify conversations by reference to health, sexuality, religion, politics or any other sensitive characteristic. The analysis is not used to train AI models and is not used to make any decision about you. We rely on our legitimate interests in understanding and improving our service for this processing; you can object at any time using the contact details in Section 13, and we will exclude your conversations from analysis while they are held.

Sensitive Personal Data

Our AI platform is not designed to process special categories of personal data (including data relating to health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation, or criminal records), and — as described under Your Image and Voice above — we do not process your image or voice for the purpose of uniquely identifying you. You should avoid submitting sensitive data to the platform. Where you do submit sensitive personal data, we will treat it in accordance with applicable data protection law.

Children’s Privacy

Our AI platform is for adults only: it is not intended for use by anyone under 18, and every user must pass the age check described in Section 4 before their first call. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will delete it promptly, keeping only the minimal block record described in Section 4 so that the age check is not repeated. If you believe we have inadvertently collected data from a child, please contact us using the details at the end of this policy.

Section 5: Automated Decision-Making and Profiling

The Xicoia AI platform uses automated processing, including artificial intelligence and machine learning, to generate outputs in response to your inputs. Automated content-safety measures may also restrict or end a session, or limit particular content, in order to keep the platform safe. The age check described in Section 4 produces an automated result, and a user the check identifies as under 18 cannot use the platform; if you believe that result is wrong you can ask for a member of our team to review it by emailing support@xicoiatalent.com. Otherwise we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you: significant account decisions (such as suspension or termination) involve human review, and you can contest any such decision using the contact details in Section 13.

You have the right to:

• request human review of any significant automated decision
• express your point of view in relation to any such decision
• contest any such decision

We do not profile you. Our statistical analysis uses only anonymised or aggregated data. Please see Section 8 (Your Rights) for further information.

Section 6: Disclosure of Personal Data

We may share your personal data with any company that is a member of our group where it is in our legitimate interests to do so for internal administrative purposes (for example, ensuring consistent and coherent delivery of services to our customers, corporate strategy, compliance, auditing and quality assurance).

We will share your personal data with the following service providers, each of which processes personal data only on our instructions and under a data processing agreement, with appropriate safeguards for any transfer outside the UK/EEA (see Section 10):

We will also share your personal data with:

• public agencies (including tax officials)
• if we engage them in future, companies that assist us in our marketing and promotional activities, and analytics providers that assist us in the improvement and optimisation of our platform — we will update this policy before doing so

Any third parties with whom we share your personal data are limited (by law and by contract) in their ability to use your personal data for any purpose other than to provide services for us. We will always ensure that any third parties with whom we share your personal data are subject to privacy and security obligations consistent with this privacy policy and applicable laws.

We will also disclose your personal data to third parties:

• where it is in our legitimate interests to do so to run, grow and develop our business, such as:
  • if we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets
  • if substantially all of Xicoia's assets are acquired by a third party, in which case personal data held by Xicoia will be one of the transferred assets
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, any lawful request from government or law enforcement officials, and as may be required to meet national security or law enforcement requirements or prevent illegal activity
• in order to enforce or apply our terms and conditions or any other agreement or to respond to any claims, to protect our rights or the rights of a third party, to protect the safety of any person, or to prevent any illegal activity

Save as expressly detailed above, we will never share, sell, or rent any of your personal data to any third party without notifying you and, where necessary, obtaining your consent.

Links to other websites and services. Our platform and communications may contain links to websites and services operated by third parties (for example, crisis support organisations or our payment provider's checkout pages). Those websites and services have their own privacy policies, which we encourage you to read; we are not responsible for them.

Section 7: Retention of Personal Data

We keep your personal data for no longer than necessary for the purposes for which the personal data is processed. The length of time we retain personal data depends on the purposes for which we collect and use it and/or as required to comply with applicable laws and to establish, exercise, or defend our legal rights. Our retention policy is based on the following criteria:

• if you were an active contact but have not interacted with us or any of our platforms or materials for 12 months, we will delete our contact record of you
• if you are a new prospective contact but have not interacted with us or any of our platforms or materials within 12 months, we will delete our contact record of you
• transcripts of your conversations are retained for up to 8 weeks from the date of the call, so that we can review calls for safety and handle any complaint or refund query. They are then deleted from our live systems, and from backup copies on our provider's standard cycle shortly afterwards. The exception is a transcript needed for a live complaint, refund dispute, safeguarding incident, serious breach of our Terms, or legal or regulatory request: we keep that transcript until the matter is closed and then delete it. A transcript flagged by our safety checks is reviewed within the same 8-week period and then follows the normal schedule unless one of those exceptions applies. Before deletion, transcripts are analysed in aggregate as described in Section 4; the aggregate results contain no personal data and may be kept
• call recordings are retained for 24 hours and then permanently deleted. There are two exceptions, and they are the only ones: we will keep a specific recording for longer if we are legally required to (for example under a court order or a regulator's request), or if we need it to investigate a serious safety incident or a serious breach of our Terms arising from that call. In either case we keep only the recording concerned, only for as long as needed for that purpose, and it stays subject to this policy while we hold it
• age-check images — your selfie and any photo-ID image — are not kept after the check by us or by our age-check provider; we keep the result of the check, which method decided it, an approximate age band, the date and a reference number for as long as you hold an account with us. Where the check indicates a user is under 18, we keep only the account identifier, the outcome and the date until the Service End Date (11:59 PM Pacific Daylight Time on 19 September 2026, when Talking Tilly closes) so that the check is not repeated, and delete the rest of the account's data
• your account data is retained for as long as you hold an account with us; normalised email records used to enforce fair-usage limits are retained for the life of the service
• memory data retained by our AI characters is deleted when you ask us to delete it, when your account is deleted, or at the Service End Date (11:59 PM Pacific Daylight Time on 19 September 2026), whichever happens first
• session records that contain no conversation content — when a call took place, how long it lasted, minutes used and payment references — and platform usage analytics are retained for up to 18 months, for payment disputes, financial records and safety reporting, after which they are anonymised or aggregated
• records of your consents (for example, marketing preferences and terms acceptance) are retained for as long as necessary to evidence them

If you have any specific queries in relation to our data retention policy please contact us for more information.

Section 8: Your Rights

You have certain rights in relation to your personal data. If you would like further information or would like to exercise any of them, please contact us by email at the details set out at the end of this policy. Subject to certain exemptions permitted by law, you have the following rights:

Right of access. You have a right of access to any personal data we hold about you. You can ask us for a copy of your personal data; confirmation whether your personal data is being used by us; details about how and why it is being used; and details of what safeguards are in place if we transfer your personal data outside of the UK or EEA.

Right to update your information. You have a right to request an update to any of your personal data which is out of date or incorrect. Please note that AI-generated outputs are probabilistic in nature and we cannot guarantee their factual accuracy; where an output contains inaccurate information about you, we will make reasonable efforts to address it, but it may not always be technically feasible to correct the underlying model.

Right to delete your information. You have a right to ask us to delete any personal data which we are holding about you in certain specific circumstances. This includes your call transcripts and the memory data our AI characters hold about you.

Right to restrict use of your information. You have a right to ask us to restrict the way that we process your personal data.

Right to stop marketing. You have a right to ask us to stop using your personal data for direct-marketing purposes. If you exercise this right, we will stop using your personal data for this purpose.

Right to data portability. Where we use your personal data on the basis of your consent or performance of a contract, you have a right to ask us to provide your personal data to a third party provider of services.

Right to object. You have a right to ask us to consider any valid objections which you have to our use of your personal data where we process your personal information on the basis of our or another person's legitimate interest, or where we use your personal data for profiling purposes.

Right not to be subject to automated decision-making. Where we make decisions about you solely by automated means that have legal or similarly significant effects on you, you have the right to request human review of such decisions, to express your point of view, and to contest the decision.

We will consider all such requests and provide our response within a reasonable period (and in any event within one month of your request unless we tell you we are entitled to a longer period allowed by applicable law). Please note, however, that certain personal data may be exempt from such requests in certain circumstances, for example if we need to keep using the information to comply with our own legal obligations or to establish, exercise, or defend legal claims.

We may request you provide us with information necessary to confirm your identity before responding to any request you make.

Alternatively, the Information Commissioner's Office (ICO) website sets out further information on individuals' rights: www.ico.org.uk

Section 9: Marketing

We will send you marketing communications by email only if you have opted in to receive them (for example, by ticking the marketing checkbox when you first use the platform). We record your choice — whether you opt in or not — together with the time you made it.

You can withdraw your consent and stop receiving marketing communications at any time, by contacting us at the details set out below or by using the unsubscribe link in any marketing email we send you. Withdrawing consent does not affect your use of the platform.

We will always obtain your consent before disclosing your personal data to any third party for that third party's own marketing purposes.

Additional Information for US Residents

If you live in a US state with a comprehensive privacy law (for example, California), you may have additional rights, including the right to know, correct and delete personal information we hold about you and the right to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information other than to provide the Services. You can exercise these rights using the contact details in Section 13, or through an authorised agent, and we will not discriminate against you for doing so. If we decline a request, you may appeal by replying to our decision, and we will respond to your appeal as required by the law of your state.

Section 10: Transfers of Data

We may share your personal data with third parties as set out in Section 6. This may involve transferring your data outside the UK and EEA. Whenever we transfer your personal data out of the UK and EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
• Where we use certain service providers, we may use specific contracts approved for use in the UK/EEA which give personal data the same protection it has in the UK/EEA, including where relevant ensuring that standard contractual clauses for international data transfers apply to the relevant contract.

Several of our service providers (including Tavus, Clerk, Stripe, Vercel and Resend) are located in, or process data in, the United States. Whenever your personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place before the transfer, such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or, where the recipient is certified, the EU–US or UK–US Data Privacy Framework.

Where your data goes, and what protects it there. Your account data, transcripts and call recordings are stored in Ireland, within the European Economic Area, which the United Kingdom recognises as providing adequate protection and which Japan's Personal Information Protection Commission designates as having an equivalent system. Your age check is processed in the European Union. The live processing of your call and some supporting services take place in the United States, through the providers named above. The United States has no single, comprehensive federal data protection law of the kind that applies in the United Kingdom, the European Union or Japan; protection there depends on sector-specific federal laws and on the laws of individual states, and United States public authorities have legal powers, in defined circumstances, to require access to data held by companies in the United States. Because of that, we do not rely on United States law to protect your data. Each United States provider is bound by contract to process your data only on our instructions and only to deliver our service, not to use it for its own purposes or to train its models, to apply appropriate security measures, to help us respond to your requests about your data, to tell us of any security incident, and to delete your data when the service ends. Those contracts incorporate the standard contractual clauses approved by the UK and EU authorities, and we have assessed the risks of each transfer before making it. Where you are asked before your first call to confirm that you understand your call will be processed by our providers in the United States, that confirmation is the consent that the law of some countries, including Japan, requires for such a transfer.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK and EEA, or on the protections that apply in any particular country. Our contact details are set out at Section 13 below.

Section 11: Security

The main risk of our processing of your personal data is if it is lost, stolen, or misused. This could lead to your personal data being in the hands of someone else who may use it fraudulently or make public information that you would prefer to keep private.

Xicoia is committed to protecting personal data from loss, misuse, disclosure, alteration, unauthorised access, unavailability and destruction, and takes all reasonable precautions to safeguard the confidentiality of personal data, including through use of appropriate organisational and technical measures.

Organisational measures include physical access controls to our premises, implementing internal policies and staff training, and ensuring confidentiality obligations are imposed on our employees and third parties.

Technical measures include requiring passwords and multi-factor authentication for access to our systems, the use of encryption and anti-virus software, logically separating data, and applying access controls to AI platform infrastructure.

However, you should be aware that the transmission of data via the internet is not completely secure. We protect your personal data with the measures described above, but no transmission over the internet can be made completely secure, so please take care with the devices and connections you use to access our platform.

Section 12: Changes to Our Privacy Policy

We may update our privacy policy from time to time. Any changes we make to our privacy policy in the future will be posted on this page and, where the change is significant, notified to you by email or on the platform. Please check back from time to time to see any updates or changes to our privacy policy.

Section 13: Further Questions or Making a Complaint

If you have any queries or complaints about our collection, use, or storage of your personal data, or if you wish to exercise any of your rights in relation to your personal data, please contact us at the details below. We will investigate and attempt to resolve any such complaint or dispute regarding the use or disclosure of your personal data.

Our contact details are:

By email: privacy@xicoiatalent.com

By post: Xicoia Ltd, 20 Vespasian Way, Dorchester, England, DT1 2RD.

If you are in the European Economic Area, you may instead contact our Article 27 representative via the Prighter portal at https://app.prighter.com/portal/XicoiaLtd, or by post to Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria, marking your correspondence "For the attention of the Article 27 representative of Xicoia Ltd".

You may also make a complaint to the Information Commissioner's Office in the UK or, in certain circumstances, the data protection authority in the EEA country where you usually live or work. Alternatively, you may seek a remedy through local courts if you believe your rights have been breached.