EXXISTA PRIVACY POLICY

Effective Date: August 28, 2026
Last Updated: August 28, 2026

1. INTRODUCTION

Exxista (“Exxista,” “we,” “us,” or “our”) provides artificial intelligence, business automation, AI agent, workflow, communication, integration, and related technology services designed to help organizations automate work, improve customer engagement, streamline operations, and integrate artificial intelligence into their businesses.

We recognize that businesses entrust technology providers with important information. Protecting that information and using it responsibly are fundamental to how we design and operate our services.

This Privacy Policy explains how Exxista collects, uses, processes, stores, shares, and protects personal information when individuals or organizations access or use our websites, applications, AI agents, software, APIs, integrations, communications, and related products and services collectively referred to as the “Services.”

This Privacy Policy also explains the choices and rights that may be available to you regarding your personal information.

By accessing or using the Services, you acknowledge the practices described in this Privacy Policy.

2. OUR APPROACH TO AI AND DATA

Exxista is designed around a simple principle:

AI should work for your business without unnecessarily exposing your business.

Our Services may enable organizations to deploy AI-powered agents and automations that communicate, analyze information, execute authorized workflows, interact with connected systems, and assist with business processes.

We seek to apply the following principles when handling information:

Purpose-Driven Processing

We process information for legitimate and defined purposes connected with providing, securing, maintaining, supporting, and improving the Services.

Data Minimization

We seek to collect and process only information reasonably necessary for the Services and functionality being provided.

Customer Control

Where technically and contractually applicable, customers control the information they provide to Exxista and determine which systems, applications, data sources, tools, and workflows they authorize Exxista to access.

Security by Design

We seek to incorporate appropriate administrative, technical, and organizational safeguards into the architecture and operation of our Services.

Responsible AI

We believe AI systems should augment legitimate business operations while maintaining appropriate human oversight, permissions, security controls, and accountability.

3. INFORMATION WE COLLECT

The information we collect depends on how you interact with Exxista and which Services you use.

3.1 Account and Registration Information

When you establish an account, request information, purchase Services, or otherwise interact with Exxista, we may collect information such as:

Name
Business name
Job title or role
Email address
Telephone number
Billing information
Business address
Account credentials
Subscription information
Account preferences
Customer support communications

3.2 Business and Organizational Information

Customers may provide information relating to their organization, including:

Company information
Products and services
Business processes
Internal procedures
Customer service information
Sales and marketing information
Operational documentation
Knowledge bases
Frequently asked questions
Policies and procedures
Workflow instructions
Business rules
CRM information
Scheduling information
Inventory or product information
Other information required to configure AI agents or automations

The specific information processed depends upon the Services selected and configured by the customer.

4. CUSTOMER CONTENT

“Customer Content” means information, data, documents, files, prompts, instructions, communications, images, audio, records, databases, inputs, outputs, and other materials submitted to or processed through the Services by or on behalf of a customer.

Depending upon the configuration of an AI agent or automation, Customer Content may include information originating from the customer's:

CRM
Email systems
Calendars
Customer support systems
Websites
Forms
Databases
Cloud storage
Documents
Communication platforms
Marketing platforms
E-commerce systems
Scheduling systems
Business applications
Third-party APIs

Customers determine which information and systems they choose to connect to Exxista.

Customers are responsible for ensuring they possess the rights, permissions, notices, and lawful bases necessary to provide Customer Content to Exxista and authorize its processing.

5. AI AGENT AND AUTOMATION DATA

A distinguishing feature of Exxista is the ability to configure artificial intelligence systems to perform or assist with business activities.

Depending upon customer configuration, an Exxista-powered AI agent may be authorized to:

Answer customer questions
Respond to inquiries
Qualify leads
Schedule appointments
Prepare communications
Send authorized communications
Retrieve information
Summarize information
Analyze business information
Update records
Generate reports
Route requests
Assist employees
Execute defined workflows
Interact with authorized third-party software
Perform other customer-configured business functions

To perform these functions, the AI agent may process information provided by the customer, an authorized user, an end customer, or a connected third-party system.

AI agents are intended to operate within the permissions, integrations, instructions, and limitations established for them.

Customers remain responsible for determining the appropriate uses, permissions, supervision, and deployment of AI agents within their organizations.

6. AI INPUTS AND OUTPUTS

When you interact with an AI-enabled feature, we may process information you submit to that feature, including prompts, questions, files, instructions, audio, images, or other inputs.

The Services may generate responses, recommendations, classifications, summaries, actions, or other outputs based upon those inputs.

AI-generated outputs may contain errors or inaccuracies. Customers and users should independently review outputs where appropriate, particularly before relying upon AI-generated information for consequential business, legal, financial, medical, employment, safety, or other high-impact decisions.

7. CONNECTED APPLICATIONS AND INTEGRATIONS

Exxista may allow customers to connect third-party applications and services.

Examples may include:

Customer relationship management systems
Email platforms
Calendars
Cloud storage
Communication platforms
Marketing applications
E-commerce platforms
Accounting applications
Customer support platforms
Telephony systems
Scheduling applications
Databases
Automation platforms
Social media platforms
Other business applications and APIs

When a customer authorizes an integration, Exxista may receive, transmit, retrieve, or process information through that integration as necessary to perform the requested function.

The amount of information accessible to Exxista depends upon the permissions granted by the customer and the functionality of the third-party service.

Customers should review the permissions requested before connecting an application.

Customers may generally revoke an integration through the applicable Exxista or third-party account settings where such functionality is available.

Third-party applications are governed by their own terms and privacy practices.

8. COMMUNICATION DATA

When customers use Exxista to automate or assist with communications, the Services may process information associated with those communications.

Depending upon the Services used, this may include:

Email messages
SMS or text messages
Chat conversations
Customer support interactions
Appointment communications
Voice interactions
Call information
Transcripts
Contact information
Communication timestamps
Delivery information
Responses
Conversation context

Customers are responsible for complying with applicable laws governing communications, marketing, recording, consent, telemarketing, email, and messaging.

Where call recording, transcription, or similar functionality is enabled, customers are responsible for providing any legally required notices and obtaining any legally required consent.

9. INFORMATION COLLECTED AUTOMATICALLY

When you access Exxista, we may automatically collect certain technical and usage information, including:

Internet Protocol address
Browser type
Device type
Operating system
Approximate geographic region derived from IP address
Login timestamps
Pages viewed
Features used
Referring pages
Session information
Error logs
Performance information
Security events
API activity
Interaction and usage statistics

We may use this information to operate, secure, troubleshoot, analyze, and improve the Services.

10. COOKIES AND SIMILAR TECHNOLOGIES

Exxista may use cookies and similar technologies for purposes including:

Authentication
Session management
Security
User preferences
Analytics
Performance measurement
Website functionality
Marketing attribution

Where required by applicable law, we will provide appropriate choices regarding non-essential cookies.

Users may also control cookies through their browser settings, although disabling certain cookies may affect functionality.

11. HOW WE USE INFORMATION

We may process information for purposes including:

Providing the Services
Creating and maintaining accounts
Authenticating users
Configuring AI agents
Executing authorized automations
Processing AI requests
Operating integrations
Providing customer support
Processing transactions
Managing subscriptions
Communicating service information
Detecting fraud or abuse
Maintaining platform security
Troubleshooting technical problems
Monitoring system performance
Improving functionality
Developing new features
Enforcing agreements
Complying with applicable laws
Protecting the rights, safety, and security of Exxista, our customers, users, and others

We may also use aggregated or appropriately de-identified information for analytics, product development, service improvement, capacity planning, and other legitimate business purposes where permitted by law.

12. AI MODEL AND TECHNOLOGY PROVIDERS

Exxista may use third-party artificial intelligence models, infrastructure providers, APIs, and related technology to provide certain Services.

Depending upon the Service selected, information necessary to process an AI request may be transmitted to an applicable AI provider.

Such providers may include commercial AI model, speech, transcription, communication, infrastructure, automation, or data-processing providers.

The specific provider used may vary based upon:

Customer configuration
Selected AI model
Requested functionality
Performance requirements
Availability
Security requirements
Geographic considerations
Product development

Where appropriate, Exxista seeks to use business or API services offering commercial data-protection terms suitable for the intended processing.

Customers should understand that data-processing practices may vary among third-party providers and Services.

13. MODEL TRAINING AND CUSTOMER DATA

Exxista recognizes that businesses may provide confidential, proprietary, or commercially sensitive information when using AI-powered Services.

Our goal is to configure commercial AI services and providers in a manner that protects Customer Content consistent with applicable agreements, provider capabilities, and customer-selected settings.

Exxista does not sell Customer Content for the purpose of training third-party general-purpose AI models.

Where Exxista uses third-party AI providers, the provider's processing, retention, and model-training practices are governed by the applicable commercial agreements, API terms, configuration, and data controls associated with that provider.

Exxista may use appropriately aggregated, statistical, or de-identified information to understand platform performance, improve functionality, detect problems, develop features, and improve our Services where permitted by applicable law and contractual obligations.

14. WE DO NOT SELL YOUR BUSINESS DATA

Exxista's business model is based upon providing technology and services to customers.

We do not sell Customer Content as a business model.

We do not intend to operate a data-broker business in which confidential customer business information is sold to unrelated third parties for their independent marketing purposes.

Where applicable privacy laws define terms such as “sell” or “share” more broadly, including certain advertising technology activities, additional disclosures or opt-out mechanisms may be provided as legally required.

15. SERVICE PROVIDERS AND SUBPROCESSORS

We may use trusted third parties to help operate Exxista.

These providers may perform functions such as:

Cloud hosting
Database infrastructure
Artificial intelligence processing
Email delivery
SMS delivery
Voice communications
Payment processing
Analytics
Cybersecurity
Error monitoring
Customer support
Authentication
Data storage
Software infrastructure

We provide these parties access to information only as reasonably necessary for them to perform their designated services, subject to applicable contractual and legal requirements.

As Exxista's infrastructure evolves, our service-provider ecosystem may also change.

16. PAYMENT INFORMATION

Payments may be processed through third-party payment processors.

Exxista may receive transaction-related information such as payment status, billing name, subscription level, transaction identifier, and limited payment details.

Full payment card information may be collected and processed directly by our payment processor rather than stored by Exxista, depending upon the payment implementation.

Payment processors maintain their own privacy and security practices.

17. DATA OWNERSHIP

As between Exxista and its business customers, customers retain their rights in the Customer Content they provide to the Services, subject to the applicable Terms of Service or customer agreement.

Customers grant Exxista the rights reasonably necessary to host, transmit, process, reproduce, and otherwise handle Customer Content solely as required to provide, secure, support, and maintain the Services and fulfill applicable contractual and legal obligations.

Nothing in this Privacy Policy is intended to transfer ownership of a customer's underlying business information to Exxista.

18. CUSTOMER AS DATA CONTROLLER

In many business deployments, the Exxista customer determines why and how personal information concerning its employees, customers, prospects, vendors, or other individuals is processed.

In those circumstances, the customer may act as the data controller, business, or equivalent responsible entity under applicable privacy law, while Exxista may act as a processor, service provider, or similar entity on the customer's behalf.

If your personal information has been processed by Exxista on behalf of an Exxista business customer, you may need to direct certain privacy requests to that customer.

We may assist our customers in responding to legally valid requests as required by applicable law and contractual obligations.

19. DATA SECURITY

We use administrative, organizational, and technical safeguards designed to protect information against unauthorized access, disclosure, alteration, destruction, loss, or misuse.

Depending upon the applicable system and Service, safeguards may include:

Encryption technologies
Secure transmission protocols
Authentication controls
Access controls
Role-based permissions
Credential protection
Network protections
Logging and monitoring
Backup procedures
Software security practices
Vendor risk controls
Incident-response procedures

No internet-based service or information system can guarantee absolute security.

Users are responsible for maintaining the confidentiality of their credentials and for promptly notifying Exxista if they suspect unauthorized access to their account.

20. DATA RETENTION

We retain personal information for only as long as reasonably necessary for purposes including:

Providing the Services
Maintaining customer accounts
Fulfilling contractual obligations
Supporting authorized AI agents and automations
Maintaining security
Preventing fraud and abuse
Resolving disputes
Maintaining required business records
Complying with legal obligations

Retention periods may differ depending upon the type of information, Service configuration, contractual requirements, legal obligations, and third-party provider settings.

Information may remain temporarily within backups or disaster-recovery systems following deletion until those systems are overwritten according to applicable retention cycles.

21. DATA DELETION

Subject to contractual, technical, and legal limitations, customers may request deletion of eligible account information and Customer Content.

Certain information may be retained where necessary to:

Comply with law
Maintain financial or transaction records
Detect or prevent fraud
Protect security
Establish or defend legal claims
Enforce agreements
Maintain appropriate audit records

Where Exxista processes personal information solely on behalf of a business customer, deletion requests may need to be directed to that customer.

22. PRIVACY RIGHTS

Depending upon where you live, applicable privacy laws may provide rights concerning your personal information.

These may include the right to:

Request access to personal information
Request correction of inaccurate information
Request deletion
Request information concerning processing
Obtain a portable copy of certain information
Restrict certain processing
Object to certain processing
Withdraw consent where processing relies upon consent
Opt out of certain forms of sale, sharing, targeted advertising, or profiling where applicable
Appeal certain decisions regarding privacy requests
Lodge a complaint with an appropriate privacy or data-protection authority

These rights are not absolute and may be subject to legal exceptions.

We may take reasonable steps to verify your identity before fulfilling a request.

23. CALIFORNIA PRIVACY RIGHTS

California residents may have additional rights under applicable California privacy laws.

Depending upon applicability and statutory definitions, these rights may include:

The right to know what categories and specific pieces of personal information are collected
The right to know the purposes for which information is used
The right to know categories of sources
The right to know categories of third parties receiving information
The right to request deletion
The right to correct inaccurate information
The right to opt out of certain sales or sharing of personal information
The right to limit certain uses of sensitive personal information where applicable
The right not to receive discriminatory treatment for exercising applicable privacy rights

Exxista will provide additional California-specific notices and mechanisms where legally required.

24. INTERNATIONAL USERS

Exxista may provide Services to organizations or users located outside the United States.

Personal information may be processed in the United States or other countries in which Exxista or its service providers maintain operations.

Privacy and data-protection laws may differ among jurisdictions.

Where required, we will seek to implement appropriate mechanisms governing international transfers of personal information.

25. EUROPEAN ECONOMIC AREA, UNITED KINGDOM, AND SIMILAR JURISDICTIONS

Where applicable law requires a lawful basis for processing personal information, Exxista may rely upon one or more bases including:

Performance of a contract
Legitimate interests
Consent
Compliance with legal obligations
Protection of legal rights

Where Exxista acts as a processor on behalf of a customer, the customer generally determines the applicable legal basis for processing.

Individuals may possess additional rights under applicable data-protection legislation, including rights relating to access, correction, deletion, restriction, objection, portability, and complaints to supervisory authorities.

26. SENSITIVE PERSONAL INFORMATION

Customers should avoid providing sensitive personal information to Exxista unless it is reasonably necessary for an authorized Service and the customer has determined that such processing is lawful and appropriate.

Sensitive information may include information relating to health, biometrics, government identification, financial accounts, racial or ethnic origin, religious beliefs, sexual orientation, precise geolocation, or other categories receiving heightened protection under applicable law.

Certain Exxista Services may not be designed or authorized for regulated categories of sensitive information.

Customers are responsible for ensuring that their intended use complies with applicable laws and any Exxista contractual restrictions.

27. CHILDREN'S PRIVACY

Exxista is primarily designed for businesses and professional users and is not intended for children.

We do not knowingly solicit personal information directly from children under the age required to consent to processing under applicable law.

If we become aware that personal information from a child has been collected in circumstances inconsistent with applicable law, we will take appropriate steps to address the information.

28. AUTOMATED DECISION-MAKING

AI agents and automated workflows may analyze information and generate recommendations or execute customer-configured actions.

Customers should evaluate whether human review is appropriate before allowing automated systems to make decisions that could produce legal or similarly significant effects concerning individuals.

Customers are responsible for configuring their use of Exxista in accordance with applicable laws governing automated decision-making, profiling, discrimination, employment, credit, housing, healthcare, insurance, or other regulated activities.

Exxista may restrict particular applications of its technology where necessary for legal, security, safety, or policy reasons.

29. HUMAN OVERSIGHT

AI automation can significantly improve business efficiency, but appropriate human judgment remains important.

Exxista encourages customers to establish appropriate human review for consequential workflows.

AI-generated recommendations and actions should not automatically be considered professional, legal, medical, financial, accounting, or other regulated advice unless specifically provided through a Service designed and authorized for that purpose.

30. SECURITY INCIDENTS

If Exxista becomes aware of a security incident affecting personal information, we will investigate and respond in accordance with applicable law and our contractual obligations.

Where legally required, affected customers, individuals, regulators, or other appropriate parties will be notified.

31. BUSINESS TRANSFERS

If Exxista is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar corporate transaction, information may be disclosed or transferred as part of that transaction subject to applicable law.

Any successor organization will be required to handle personal information in accordance with applicable legal obligations.

32. LEGAL DISCLOSURES

We may disclose information where we reasonably believe disclosure is necessary to:

Comply with applicable law
Respond to valid legal process
Comply with court orders
Respond to lawful governmental requests
Protect the security of the Services
Investigate fraud or abuse
Enforce our agreements
Protect the rights, property, or safety of Exxista, our customers, users, or others

Where legally permissible and appropriate, we may seek to limit requests that we believe are overly broad or otherwise legally deficient.

33. THIRD-PARTY WEBSITES AND SERVICES

The Services may contain links to or integrations with third-party websites, software, applications, and services.

Exxista is not responsible for the privacy practices of independent third parties.

We encourage users to review the privacy policies and terms governing third-party services before providing information to them or authorizing integrations.

34. MARKETING COMMUNICATIONS

We may send customers and prospective customers information concerning Exxista products, services, features, events, or other business-related matters where permitted by law.

Recipients may unsubscribe from promotional email communications using the unsubscribe mechanism provided in those communications.

We may continue sending non-promotional communications necessary for an account or Service, such as security alerts, transaction confirmations, billing notices, and material service notifications.

35. CHANGES TO THIS PRIVACY POLICY

Artificial intelligence technologies, privacy laws, and Exxista's Services will continue to evolve.

We may update this Privacy Policy periodically to reflect changes in:

Our Services
AI technologies
Data-processing practices
Security practices
Legal requirements
Third-party integrations
Business operations

When changes are made, we will update the “Last Updated” date displayed at the beginning of this Privacy Policy.

Where required by applicable law, we will provide additional notice regarding material changes.

36. CONTACTING EXXISTA

Questions, concerns, or requests concerning this Privacy Policy or Exxista's privacy practices may be directed to:

Exxista
Privacy Department

Email: [privacy@exxista.com]
Website: [Exxista website URL]
Mailing Address: [Exxista legal business address]

For privacy-rights requests, please include sufficient information for us to understand and appropriately respond to your request.

We may need to verify your identity before processing certain requests.

37. OUR COMMITMENT

Businesses should not have to choose between innovation and responsible data practices.

Exxista's goal is to make advanced AI automation practical, useful, and trustworthy for organizations of all sizes.

As AI becomes increasingly integrated into everyday business operations, we intend to continue developing our privacy, security, governance, and transparency practices alongside the technology itself.

Your business. Your data. AI working for you.