Privacy Policy

Tracking, Profiling & Automated Identification

We believe transparency beats fine print, so here is everything this site does to understand its visitors — including the parts most sites leave out. All of it is first-party: we use no third-party analytics service, advertising network, or social-media tracker, and none of this data leaves our own server.

• First-party page tracking: our own server records each page view with the path, referring page, IP address, browser user agent, and any campaign (UTM) parameters. This powers our traffic dashboards and abuse prevention.
• Company (not person) identification: we look up visitor IP addresses against a locally stored database to identify the organization or network a visit came from (for example, “a visitor from Acme Corp's network”). The lookup happens on our own server, identifies companies rather than individuals, and sends no data to anyone else.
• Repeat-visit linking: we compute a short hash of IP address + browser user agent to connect a day's repeat visits into one anonymous session. This record contains no name or email unless you later identify yourself (for example by signing in), at which point your visits may be linked to your contact record.
• Landing-page recovery: a small script on our pages reports the address of the page your browser says referred you. It exists because some browsers pre-load our pages in a way that hides that information from our server.
• Form submissions and their source: when you submit a form we record which traffic source you arrived from — the referring site, landing page and campaign parameters above — alongside the email address you provide, and a session identifier linking it to the pages you viewed on this site. We keep these records for up to 730 days.

AI Agent Processing & Human Oversight

Conversations with XLAnt — web chat, SMS, email, and voice — are processed by our AI systems and stored so the agent can answer you and we can review quality.

Every email XLAnt sends is copied to a human at XL.net, so an unsupervised AI is never our only record of what was said.

Phone Calls

If you call +12245051527, XLAnt, an AI, answers the call. Calls are recorded as audio from the start of the conversation, and the recording is kept by XL.net together with the call record and transcript for the number you called from. Like every other conversation with XLAnt, it is stored so the agent can answer you and we can review quality.

Texting FORGET to +12245051527 erases the call recordings and transcripts for your number along with everything else XLAnt remembers about it (see Persona Memory below). To have a call recording erased without texting, contact [email protected].

Chat Page Context

While you use the chat widget, XLAnt can see the page you are on — its address, title, and visible text — so it can answer questions about what you are looking at.

Nothing is captured while the chat is closed, form values and passwords are never read, and shared page context is stored with the conversation like any other chat content.

Issue Reports

If you report a problem through the chat, your report — including a short excerpt of the conversation and, when page sharing is on, a snapshot of the page you were viewing — is emailed to XL.net staff so a human can act on it. If you include a contact address, staff may use it to follow up. To review or erase a report, contact [email protected].

Persona Memory

XLAnt keeps a private, per-person memory: facts you share and your conversation history, so later conversations can pick up where you left off. Your memory is visible only to you (and to XL.net staff reviewing quality) — never to other visitors — and XLAnt's own published knowledge always outranks remembered facts when they conflict.

• One memory across channels: if you verify your mobile number on your account, your web chat, SMS, email, and voice conversations share one memory keyed to that number. Email conversations join it only when the email provably came from you (it must pass DKIM authentication for your address's domain); mail that fails authentication is answered without reading or writing any stored memory.
• Anonymous web chat remembers nothing. Memory applies to web chat only when you are signed in, and signed-in chat has a MEMORY ON/OFF toggle in the chat window — turn it off and that conversation is not saved to memory.
• SMS always remembers. Texting XLAnt keeps memory for your phone number (possession of the handset is the authentication); the first reply you receive says so and names the erasure keyword.
• Erasure by text — “FORGET”: text FORGET to +12245051527 and we permanently erase the stored memories, conversation history, and call transcripts and call recordings for that number — and, if the number is verified on an account, and the texter is confirmed as that account's holder, for that account's chat and email memory too. If the number is verified on an account and we cannot confirm that the texter holds it, FORGET erases nothing — that memory belongs to the account — and the reply says so; to ask about it, contact [email protected]. Either way you get a reply: a confirmation once an erasure has completed, or the message that nothing was erased. The one exception: once a number has sent it three times within the hour (a request that erased nothing because the number could not be confirmed does not count), further requests that hour get no reply. FORGET is not STOP: STOP opts you out of receiving messages, FORGET erases what we remember.
• What FORGET does not delete: SMS consent records (kept for legal compliance), usage metadata that contains no conversation content, the deletion-audit record proving the erasure happened, server and diagnostic logs, and the human-oversight copies of emails already sent. A FORGET that erased nothing still leaves a deletion-audit record for the number, with an empty list of ids and no counts: it records that the request came in and that nothing was erased. That is what such a record means where it appears in your data export.
• Recycled numbers: memory is keyed to the phone number itself. If a number is reassigned by a carrier, its new holder could encounter memory from the previous holder. When an account holder removes or replaces their number, the memory kept under it moves to their account and the number's next holder starts fresh: they are told again that XLAnt is an AI and what it remembers. While a number is still verified on someone's account and we cannot confirm that the texter still holds it, FORGET from it erases nothing that account holds — contact [email protected].
• Caller-ID caveat: voice calls recall memory by the calling number, and caller ID can be spoofed — a determined attacker who spoofs your number on a call could expose that number's memories. If this concerns you, text FORGET to erase the memory, or skip verifying your number.

Account Data

If you sign in, we store your email address and display name (provided via Google OAuth or Microsoft OAuth, or an emailed sign-in link). This information is used only to authenticate you and personalize your experience. We never post on your behalf or access anything else in your provider account.

If you register a mobile number for text messaging, we also store that number, the date you verified it, and your opt-in consent record (see SMS / Text Messaging Data below).

Your Data Rights

Signed-in users can exercise both rights directly, without emailing anyone:

• Export (data portability): download everything we hold about you — your account record, consent and notice history, and your stored conversations and memories with XLAnt — as a machine-readable file from /api/account/export while signed in.
• Deletion (right to erasure): delete your account and its data via a signed-in request to /api/account/delete, confirmed by typing your account email. This permanently erases your conversations, memories, and personal records, then removes the account itself, and returns an itemized count of what was erased.

Deletion keeps the narrow records the law or basic security requires: SMS consent records, the deletion-audit record proving the erasure happened, security logs with the account link removed, and — where you have made purchases — financial records with your identity removed. If anything blocks a deletion (for example an active paid subscription), the request tells you exactly what to resolve first. Questions or problems with either right: [email protected].

What We Do NOT Do

• We do not sell your data to anyone
• We do not use your data for advertising
• We do not use third-party analytics or tracking cookies
• We do not serve third-party advertisements
• We do not use your data to train AI foundation models. XLAnt processes and stores your conversations to answer you, but your data is never sold to, or used to train, third-party models.

Cookies

Essential cookies only. We set a single httpOnly session cookie (xlantai_session, 30 days) when you sign in, plus short-lived cookies during the sign-in handshake. A first-party cookie (xlantai_attrib) remembers the landing page, the site that referred you, any advertising click identifier in the address (gclid, msclkid, fbclid and similar), and campaign parameters of your first visit; it is read only by our own server. Your theme preference and interface choices are kept in your browser's localStorage, and the chat widget's conversation state in sessionStorage. If you listen to an article, your chosen playback speed and how far through that article you got are also kept in localStorage, so you can pick up where you left off; that stays on your device. None of this is sent to any third party.

Because we set no analytics or advertising cookies, there is no cookie consent banner — there is nothing to consent to. Blocking all cookies in your browser will prevent you from signing in but does not affect the rest of the site.

Third Parties

We share data only with services necessary to operate the site:

• Google OAuth / Microsoft OAuth: authentication only
• Resend: email delivery and receiving for [email protected]
• Twilio: SMS and voice-call transport (phone numbers and message/call content, as required to deliver the service)
• Cloudflare: DNS and secure tunnel (no personal data stored)
• Large-language-model providers: when you interact with XLAnt, your conversation content is sent to one or more of these providers via their APIs solely to generate the response. We use API terms under which providers do not use this content to train their models.
• Text-to-speech provider: to produce the audio version of an article, the published article text is sent to a speech-synthesis API. Only the article — which is already public on this site — is sent; nothing about you, your visit, or your listening is included.

None of these providers receive your data for their own marketing purposes.

SMS / Text Messaging Data

If you communicate with us via SMS, your mobile phone number and message contents are used solely to respond to your inquiry. Your mobile information will not be sold, rented, or shared with third parties or affiliates for their own marketing purposes. Mobile opt-in data and consent are not shared with any third parties except service providers that help us operate our messaging program, and those providers are restricted from using your information for any other purpose.

If you register your number with us, we record your opt-in consent (the consent language you agreed to, your IP address, and browser) and verify the number with a one-time code before it is added to your account. Message frequency varies based on your interactions with us. Message and data rates may apply. Text STOP to opt out at any time.

For full details on our text messaging program, see our SMS Terms & Conditions.

Data Retention & Deletion

• Account data: as long as your account exists
• Sign-in logs: up to 365 days
• Page-view records: up to 730 days
• IP-to-organization records: up to 365 days
• Conversion records: up to 730 days
• Email oversight copies: up to 730 days
• Unverified phone-verification codes: 10 minutes
• SMS consent records: for the life of the messaging program plus four years, as required for compliance

Upon a deletion request, all associated personal data is permanently removed within 30 days, except records we are legally required to keep (such as SMS consent logs).

Changes to This Policy

We may update this Privacy Policy from time to time. Changes are effective when posted to this page, and the “Last updated” date above reflects the most recent revision. Your continued use of the site after changes are posted constitutes acceptance of the updated policy.

Contact

To object to any of this processing, request deletion of your account and associated data, or ask privacy questions, contact [email protected].