Privacy Policy
Effective:
This policy explains what personal data xmob.ai collects, why, who sees it, and the choices you have. xmob.ai is a B2B growth platform with an AI Sales Crew: AI agents that research prospects, draft outreach, follow up and book meetings for a company, with the company's owner approving every action.
1. Who we are
xmob.ai is operated by Zee Design ("we", "us"). For the personal data of people who use xmob.ai (account holders and their team members) we are the controller.
For the contact data that a customer company enters or has the crew research about its own prospects, the customer decides why and how it is used and we process it on the customer's behalf (we are the processor). Section 12 explains what that means for the people concerned.
Contact for anything in this policy: sales@xmob.ai.
2. The data we collect
- Account data: name, work email, password (stored only as a hash by our authentication provider) or the sign-in identity from Google or Microsoft, role and language.
- Company and workspace data: company name, website, country, industry, team members, plan and settings.
- Content you give the crew: company descriptions, product and pricing information, documents you upload to the Brain, ideal-customer settings and the approvals and edits you make.
- Prospect data processed for you: business contact details of people at companies you target (name, job title, work email, company), the drafts written for them, and their replies.
- Connected mailbox and calendar data, only if you connect one (see sections 4 and 5).
- Payment data: handled by Stripe. We receive the plan, status and the last four digits and brand of a saved card, never the full card number.
- Technical data: device and browser type, IP address, pages and actions used, and error logs, collected for security and to keep the service working.
3. How we use it
- To provide the service you asked for: run the crew, show the approval inbox, send what you approve, record the results.
- To keep the service secure, prevent abuse and enforce our Terms.
- To bill you and to give support.
- To improve the product, using aggregated or de-identified usage information.
- To meet legal obligations.
Our legal bases under the GDPR are: performing our contract with you; our legitimate interests in running a secure and reliable service; compliance with legal obligations; and your consent where we ask for it, for example when you connect a mailbox.
We do not sell personal data and we do not use it for advertising.
4. Google user data
If you choose to connect a Google account, xmob.ai asks only for the access needed for the feature you turn on:
- Gmail send (gmail.send): to send, from your own mailbox, the emails you have approved.
- Gmail read (gmail.readonly): to read replies to emails the crew sent for you, so that the Chaser agent can classify them, stop follow-ups when someone opts out or answers, and show you the reply. We only keep messages that belong to a thread started from an email we sent for you. Other mail in the mailbox is ignored and not stored.
- Google Calendar (calendar events and free/busy): to check when you are free and to create the meeting you approve in your own calendar.
xmob.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In practice that means: we use Google user data only to provide and improve the user-facing features described above; we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger with notice to you; we do not use it for advertising; and no person at xmob.ai reads it unless you ask us to for support, it is needed to investigate abuse or a security problem, or the law requires it.
Mailbox access tokens are encrypted when stored. You can disconnect at any time in the product, or remove access at https://myaccount.google.com/permissions. When you disconnect we delete the stored tokens, and the mailbox content we kept is deleted under section 9.
5. Microsoft user data
If you connect a Microsoft 365 or Outlook account, we ask for the equivalent access and use it in the same way and under the same limits as in section 4: Mail.Send to send emails you approve, Mail.Read to read replies to emails the crew sent, Calendars.ReadWrite to check availability and create the meetings you approve, and offline_access so the connection keeps working without asking you to sign in each time.
You can disconnect in the product or remove access at https://account.live.com/consent/Manage (personal accounts) or https://myapps.microsoft.com (work or school accounts).
6. AI processing
The crew uses large language models from an AI provider (currently Anthropic) to research companies, write drafts and classify replies. To do that we send the provider the text it needs for the task: company information, the prospect brief, the draft and, for reply handling, the reply text.
We use the provider through its API under commercial terms. We do not allow our provider to use this content to train its models, and we do not use mailbox content to train any model. AI agents never act on their own: every email or invitation is shown to the account owner for approval first, and a safety layer checks it before anything is sent.
Web pages, documents and replies are treated as data, never as instructions to the agents.
8. International transfers
Our database is hosted in the European Union. Some providers, including our AI provider, process data in the United States or other countries. Where personal data leaves the European Economic Area we rely on an adequacy decision or standard contractual clauses and equivalent safeguards.
9. How long we keep data
- Account and workspace data: while your account is active and then up to 90 days after it is closed, unless the law requires longer (for example invoices).
- Mailbox access tokens: until you disconnect, then deleted.
- Replies and mailbox content kept for the crew: until you disconnect the mailbox or delete the workspace, then deleted within 30 days.
- Logs and backups: for a limited period needed for security and recovery, then removed.
You can ask us to delete your data earlier (section 11).
10. Security
Data is encrypted in transit. Access tokens and stored mailbox passwords are encrypted at rest. Every workspace is isolated from every other by row-level security in the database, access is limited to the people who need it, and sending is subject to approval and safety checks. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.
11. Your rights
If the GDPR or a similar law applies to you, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. You also have the right to complain to your data protection authority.
To exercise a right, write to sales@xmob.ai. We may need to confirm who you are first, and we answer within one month.
12. If a customer contacted you
If you received an email sent through xmob.ai, the company named in the email is responsible for it and xmob.ai sent it for that company. The email says who sent it and why you are receiving it, includes an AI disclosure line and a way to opt out.
You can opt out at any time by replying to say so or by using the unsubscribe link, or on https://xmob.ai/unsubscribe. An opt-out stops all further messages to your address from every xmob.ai customer workspace that has used the address, immediately. To ask what data a company holds about you, or to have it deleted, write to the company or to sales@xmob.ai and we will pass the request on or act on it ourselves.
14. Children
xmob.ai is a business service and is not directed to anyone under 16. We do not knowingly collect their data.
15. Changes
We will update this policy when our practices change. For material changes we will tell account holders by email or in the product before they take effect. The effective date is at the top of the page.
16. Contact
Zee Design, https://xmob.ai. Email: sales@xmob.ai.