Privacy Policy

XomiW is an AI assistant that writes documents, reports and spreadsheets and works with your email, calendar and files. This policy explains what XomiW collects, why, who receives it, where it is stored, for how long and what your rights are. It follows Vietnam's Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP. The Vietnamese version is the governing version.

XomiW is in a free beta. Features, providers and this policy may change; when a change matters, we will tell you and ask for your consent again before it applies.

1. Who is responsible

• Operator: [Legal entity name, address, tax code — to be added when the entity is incorporated]. During the beta, XomiW is run by the xomi.app team.
• Personal data contact: privacy@xomiw.com.

2. Data we collect

Category	Examples	Source
Account	Email, name, how you want to be addressed, occupation, company size, what you want help with, language, theme	You, at sign-in and onboarding
Content	Messages, files you upload, files XomiW creates for you, workflows, schedules, projects and project instructions	You, while using the service
Data from apps you connect	Email, calendar, documents… from apps you choose to connect. Read only when needed for your request; sending, editing or deleting always asks you first, every time	The apps you connect
Usage and credits	Credits used, models called, time, cost	Recorded by the system
Technical	Sessions, IP address, browser type, error logs	Recorded by the system
Error and crash reports (app, web, servers)	When something fails unexpectedly or the app stops suddenly: the error type, where in the code it happened, app version, device model, operating system, device language, time. Personal data is filtered out before sending: no chat content, prompts, file names or contents, email addresses, people's names, sign-in tokens or the query part of links; no user id, no screenshots, no session recording	Recorded by the app, the website and the servers when an error happens
Advertising (Free plan, mobile app only)	The Google AdMob SDK in the app collects: IP address (used to estimate an approximate location), the device's advertising identifiers (Android: Advertising ID and app set ID; iPhone: only the developer-scoped identifier, no IDFA, because XomiW never asks for tracking permission), device model, operating system, app version, ads shown and taps, SDK diagnostics; in the EEA, UK and Switzerland: your choice in Google's consent dialog. XomiW itself only records how many banners were shown (slot, device type) with your account, to cap how often they show	Collected by Google's SDK when it shows an ad; the app counts impressions
Memory (only if you turn it on)	Short notes about you and your work that you said in chat (e.g. software you use, writing style), with the quoted words and source chat; notes you add yourself or import from another assistant	Your own words (never web pages, emails, files or the assistant's words); you
Usage measurement (only if you press "Allow measurement")	Which pages or screens open (paths with chat, project and share-link ids and every query part removed), which buttons are pressed (for example "Try it", a starter task, whether a message had a file), the kind of file opened (docx, xlsx, pdf…), where the visit came from (the website, the blog, another site), device type, operating system, browser, language, app version, approximate location from the IP address (Google does not store the IP), and a random measurement id of the browser (cookie _ga) or of the app installation. No chat content, file names or contents, chat titles, search text, email, name, phone number or account id; no advertising id (IDFA, Advertising ID)	The website and the app send it to Google Analytics / Firebase Analytics after you agree
Proof of consent	Which document and version you accepted, and when; IP and browser stored only as one-way hashes. For usage measurement: the choice (agree / withdraw), when, and where it was made (web, Android, iPhone) while you are signed in	When you accept or withdraw

XomiW does not actively collect sensitive personal data, but content you provide (for example bank statements or HR files) may contain it. Only provide what your task needs and what you are entitled to share.

3. Purposes

1. Doing what you ask: understanding requests, looking things up, building files, running scheduled workflows, working with connected apps.

2. Personalisation: addressing you correctly, suggesting starter tasks and workflows for your occupation. Memory (a separate purpose with its own consent): remembering what you say about your work and how you like things done, so you are not asked again. Memory is off until you press "Turn on memory". XomiW never remembers passwords, OTPs, card or account numbers or ID documents, and never remembers sensitive data automatically (health, religion, politics, ethnicity, sex life, biometrics, criminal records, location, private life); you can only add that kind yourself in Settings after confirming. Memories are yours alone: nobody else, including team administrators and XomiW administrators, can read them; team administrators can only turn the feature on or off for the team. Extraction uses the AI model through OpenRouter (section 5). Vector search over memories (a new processor) is not enabled; enabling it will update this policy and ask for consent again.

3. Credits and abuse prevention: measuring usage, preventing unauthorised access, investigating incidents. Fixing errors: the error reports in section 2 are used only to find and fix technical faults.

4. Support and service notices: sign-in codes, "your task is done" and "needs your approval" notices.

5. Improving the product: aggregate figures only (for example tasks completed, common errors). XomiW does not use your content to train AI models.

6. Ads in the app (Free plan only): Free plan users of the mobile app may see one small banner labelled "Advertisement" on the Today and Account screens, served by Google AdMob, a limited number of times per day; new accounts see no ads for their first days. Ads are non-personalised: they are not based on your past behaviour, XomiW does not ask for tracking permission on iPhone (ATT), and XomiW sends Google none of your account data (email, name, chats, files, memories, occupation). Google still uses the technical data in section 2 to serve ads, cap how often they show, prevent fraud and measure them. There are no ads in chats, approval cards, the vault, file viewers, consent screens, the first-run guide or support screens shown when you are in difficulty; no ads on the web, on paid plans, or for people who may be under 16. In the EEA, UK and Switzerland, Google asks for consent before showing ads; you can change your choice under Account → "Ad privacy choices". You can reset or delete your advertising ID in your phone's settings.

7. Usage measurement (a separate purpose with its own, optional consent): counting where people come from, who presses "Try it", who gets through sign-in → consent → getting started → first question, which screens are used most and where people stop, so we can fix the product. It uses Google Analytics (xomiw.com and xomiw.app) and Google Analytics for Firebase (the phone app). It stays off until you press "Allow measurement"; if you decline or do not answer, nothing is loaded or sent and you can still use all of XomiW. It is not used for advertising: XomiW turns off Google signals and ad personalisation, does not share this data with other Google products, and attaches no account id. You can withdraw at any time (section 10).

We do not sell personal data, never use or share your content (chats, files, memories, account details) for advertising, and do not send marketing email without a separate consent. XomiW makes no automated decisions with legal effect on you; every action with an effect (sending email, changing data…) needs your approval.

4. Legal basis

We process data on the basis of your consent, recorded verifiably (document, version, time). Processing outside Vietnam has its own separate consent (section 5 and the end of this page). Usage measurement (section 3.7) also has its own, optional consent, separate from those above. You can withdraw consent at any time (section 7).

5. Recipients and transfers outside Vietnam

Provider	Role	Location	Data received
OpenRouter	Gateway to AI models	United States	Request content, related files, tool results
Anthropic (Claude models)	AI model that understands and carries out requests	United States	As above, through OpenRouter
Railway	Application servers (website, API) and the Postgres database	Singapore	All data while it is processed; account, content, logs
Cloudflare R2	File storage	[Storage region — to be confirmed]	Uploaded and generated files
Vercel Sandbox	Isolated environment that runs file-building code (only this; the website does not run on Vercel)	Singapore (region sin1)	Files being processed in a session
Resend	Email delivery (sign-in codes, notices)	United States	Email address, notice content
Brave Search	Web search when needed	United States	Search queries (without your identity)
Google (AdMob, User Messaging Platform)	Non-personalised ads in the app for the Free plan; ad consent in the EEA, UK and Switzerland	United States and wherever Google processes data	The technical data in the "Advertising" row of section 2; none of your content or account details
Google (Google Analytics, Google Analytics for Firebase) — only if you allow measurement	Counting how the website and the app are used (section 3.7)	United States and where Google processes	The data in the "Usage measurement" row of section 2; no content, email or account id; not used for ads
Sentry	Recording technical errors and crashes of the phone app, the website and the servers	United States	The error reports in section 2, with personal data filtered out (no chat content, files, email addresses or tokens; no user id)
Langfuse Cloud (only when enabled)	Monitoring the assistant's quality and errors	[Chosen region — to be confirmed]	Excerpts of one turn's request and answer, the turn id; no user id
Push notification services (browsers: Google, Mozilla, Apple, Microsoft; app: Firebase Cloud Messaging, Apple Push Notification service)	Delivering notifications to your browser or phone when you turn them on	United States and wherever the provider processes data	The device's push address, the notice title and short text (web notices are encrypted before sending)

Your data is therefore transferred outside Vietnam (Singapore and the United States). We choose provider settings that do not use API data for model training, encrypt data in transit (TLS), and keep the cross-border transfer dossier required by law.

We disclose data to authorities only on a valid request under Vietnamese law.

6. Retention

Data	Retention
Account and content	While you use your account
After you request account deletion	Sign-in is blocked at once; after 30 days (default; we set this period between 7 and 90 days) chats, files, workflows and projects are erased for good. Database backups expire after at most 35 days; we also always keep one copy of the most recent good backup (replaced by the new one every day), so that not all data is lost if the backup system fails and stops making new copies
Data export (.zip)	Download link valid for 48 hours, then the file is deleted
Credit ledger, usage figures	Kept without your identity after deletion, for the period required by accounting law [to be confirmed]
Audit log	The "what happened, when" line is kept; target and content are erased on account deletion
Proof of consent	Kept to show consent was valid; contains hashes only, never the original IP
Usage measurement	Google Analytics keeps events for 14 months, then deletes them; the _ga, _ga_<id> cookies expire after 13 months (or when you withdraw); your choice (cookie xomi_analytics) is kept 12 months, then asked again. Withdrawing in the app deletes the installation's measurement id on the phone at once
Memory	Until you delete it. Memories the assistant "forgets" at your request stay in "Recently deleted" for 7 days, then are erased; your own delete is immediate. Change history keeps text for 30 days, then only "what happened, when". Deleting a chat can delete the memories taken from it (ticked by default). Leaving a team deletes your memories there. Account deletion erases everything

7. Your rights

Under the Personal Data Protection Law you have the right to:

• Be informed about processing (this policy).
• Consent or refuse, and withdraw consent. Withdrawal does not affect processing done before it.
• Access and correct your data: Settings → Profile; memories in Settings → Memory (source, edit, delete, pause, export .json/.md, delete all, withdraw consent).
• Get a copy: Settings → My data → "Create a data export".
• Erase: Settings → My data → "Delete account".
• Restrict or object to processing.
• Complain, report, sue and claim damages as provided by law.

Use these rights in the app or by emailing privacy@xomiw.com. We respond within the legal time limits: 15 days for withdrawal, 10 days for access or correction, 20 days for erasure.

8. Security

• TLS in transit. Connected-app tokens are encrypted (AES-256-GCM) with a separate key per token.
• Each account's data is isolated at the database level (row level security).
• AI-written code runs in an isolated environment without network access beyond an allow list.
• Every action with an external effect needs your approval each time and is logged.
• If a personal data breach happens, we notify the authority within 72 hours and inform you as required.

9. Age

XomiW is for people aged 16 and over. We do not knowingly collect children's data.

10. Cookies

Necessary cookies (always set, no consent needed): sign-in session, language, theme, and xomi_analytics, which stores your measurement choice (granted/denied, 12 months). The sign-in cookie is set only on xomiw.app (the web app); the xomiw.com website never sees it; each domain keeps its own measurement choice. Content made in XomiW and shared pages are shown from a separate domain, xomiwusercontent.com, which sets no cookies and has no measurement.

Measurement cookies (only with your consent): the first time you visit xomiw.com or xomiw.app, a small bar at the bottom asks you, with two equal buttons, "Allow measurement" and "Decline". Until you press "Allow measurement", the page does not load the Google Analytics code and sets no measurement cookie. After you agree, Google Analytics sets the _ga and _ga_<id> cookies (13 months) to count use as in section 3.7; the advertising consent types always stay denied. When you go from xomiw.com to xomiw.app, the link may carry an extra _gl parameter so the two sites count one visit (only if you agreed on the first site). In the phone app, Google Analytics for Firebase is switched on only after you press "Allow measurement" on the screen shown after getting started; the app collects no advertising id for measurement and does not ask for tracking permission (ATT).

Withdrawing is as easy as agreeing: on xomiw.com press "Cookie settings" at the bottom of the page; on xomiw.app go to Settings → My data → "Usage measurement"; in the app go to Settings → Privacy. After withdrawing, the site no longer loads the measurement code and removes that domain's _ga* cookies; the app turns measurement off and deletes the measurement data and id on the phone. Data sent earlier is deleted by Google after the period in section 6.

The website has no ads and no advertising or tracking cookies. In the mobile app on the Free plan, the Google AdMob SDK uses the device's advertising identifiers as described in sections 2 and 3.

Blog posts and help articles on xomiw.com may contain YouTube or Vimeo videos. The page shows an image and a ▶ button; the video loads only when you press play (YouTube through youtube-nocookie.com, Vimeo with do-not-track). Before you press play, nothing is loaded from YouTube or Vimeo. Once you do, YouTube (Google) or Vimeo receives your IP address and browser details and may set cookies under their own privacy policies. When you answer "Was this article helpful?", we only count the 👍/👎 for the article; to stop repeat votes, your IP address is hashed one way together with the date (a different code every day) and the IP itself is not stored.

11. Changes

When this policy changes in a meaningful way, we publish the new version here with its date and ask for your consent again when you next open XomiW. Changes apply only after you consent.

12. Contact

Questions or requests about personal data: privacy@xomiw.com.