Privacy Policy

This policy explains what personal data XpertOS collects, how we use it, how long we keep it, and the choices you have. It covers the XpertOS web application and its integrations with third-party services such as Google and Slack.

1. Who we are

XpertOS is provided by Xtremepush Limited, 34-37 Clarendon Street, Dublin, D02 DE61, Ireland ("we", "us"). We are the data controller for the account data described below. Where your organisation uses XpertOS to process its own customers' or employees' data, your organisation is the controller and we process that data on its behalf under our agreement with it.

For any question about privacy or your data, contact our Data Protection Officer at dpo@xtremepush.com, or write to: Data Protection Officer, Xtremepush Limited, 34-37 Clarendon Street, Dublin, D02 DE61, Ireland.

2. Who can use XpertOS

XpertOS is a business product for Xtremepush customers. Accounts are created by an administrator in your organisation; there is no public sign-up. It is not intended for children.

3. Data we collect

• Account data — your name, email address, role and the organisation you belong to.
• Content you provide — chat messages, briefs, instructions, files you upload, and the reports, plans and other outputs generated for you.
• Data from services you connect — when you or your administrator connect a service (for example Xtremepush, Google Drive, Slack, Atlassian, Asana, HubSpot, Airtable, Zendesk or Braze), we read the data needed to perform the task you asked for. The sections below describe Google and Slack in detail.
• Integration credentials — the access tokens that let XpertOS act on a connected service. These are stored encrypted.
• Usage and audit data — which features are used, when, and by whom; security and audit logs of actions taken in the product; and usage counts used for billing.
• Technical data — IP address, browser type and similar information in server logs. The cookies and browser storage XpertOS uses are listed in our Cookies Policy.

4. How we use it

We use personal data only to:

• provide the features you and your organisation ask for;
• keep the service secure, investigate misuse and maintain audit records;
• measure usage for billing under your organisation's agreement;
• provide support when you contact us.

We do not sell personal data and we do not use it for advertising.

5. AI processing

XpertOS uses large language models to answer questions, draft content and run automated tasks. To do this, your prompts and the content needed to answer them — including data from connected services — are sent to Amazon Bedrock, operated by Amazon Web Services, within the same geography as your XpertOS environment (EU, US or Asia Pacific).

• The models run inside AWS. Amazon Bedrock hosts copies of the models it offers, including Anthropic's Claude models, in accounts that AWS owns and operates. The companies that make the models have no access to those accounts, so they do not receive your prompts or the responses.
• Not used for training. Your content is not used to train AI models — by AWS, by the model providers, or by us.
• AI-generated output can be incomplete or inaccurate. Review it before relying on it.

6. Google user data

When you connect a Google account, XpertOS requests only these permissions:

How we use Google user data. We use it only to provide features you request in XpertOS: opening the files you select, and creating or updating the files XpertOS makes for you. The content of those files may be sent to Amazon Bedrock (section 5) to answer your request.

What we do not do. We do not use Google user data to develop, improve or train generalised AI or machine-learning models. We do not sell it, use it for advertising, or transfer it to others except as needed to provide the feature you asked for, to comply with law, or as part of a merger or acquisition with appropriate notice. People at Xtremepush Limited do not read it unless you ask us to (for example for support), it is needed for security, or the law requires it.

Storage. Google access and refresh tokens are stored encrypted. File content is held only as long as needed to complete your request, or as part of the chat or output you saved.

Revoking access. Disconnect Google in XpertOS under Settings → Data Sources, or remove XpertOS at myaccount.google.com/permissions. Either stops further access.

XpertOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Slack data

When an administrator connects a Slack workspace, XpertOS requests only these permissions:

XpertOS posts only to the channels your organisation chooses. It reads channel and member lists only so that you can pick destinations and mention people. It does not read the message history of your channels. Slack tokens are stored encrypted. An administrator can disconnect Slack in XpertOS under Settings → Slack, or remove the app in Slack's workspace app management.

8. Who we share data with

• Amazon Web Services hosts XpertOS and runs the AI models through Amazon Bedrock (section 5). The companies that make those models, such as Anthropic, do not receive your data.
• Services you connect receive the requests needed to perform your task, under their own terms and privacy policies.
• Authorities, where the law requires it.

We do not share personal data with anyone else.

9. How long we keep it

• Chats, briefs and generated outputs — for as long as your organisation's subscription runs, unless deleted sooner.
• Integration tokens — deleted when the service is disconnected.
• Cached lists from connected services (for example Slack channel names) — deleted when the service is disconnected.
• Content sent for AI processing — processed by Amazon Bedrock to produce a response and never passed to the model provider.

When your organisation's agreement ends, we delete or return its data as that agreement sets out.

10. Security

Data is encrypted in transit and at rest. Integration credentials are encrypted separately. Access to production systems is restricted and logged, and your organisation's administrators can review an audit log of actions in the product.

11. International transfers

XpertOS environments are hosted in specific geographies, and AI processing stays within the same geography (section 5). Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict how it is used. See Data requests for how to make a request. You may also complain to a data protection authority. Our lead supervisory authority is the Irish Data Protection Commission (dataprotection.ie).

13. Changes to this policy

We will update this page when our practices change, including when XpertOS adds an integration or asks for new permissions, and we will change the date below. Significant changes will be communicated to your organisation's administrators.

14. Contact

dpo@xtremepush.com — our Data Protection Officer, for questions about this policy or your data. By post: Data Protection Officer, Xtremepush Limited, 34-37 Clarendon Street, Dublin, D02 DE61, Ireland. info@xtremepush.com — for help using XpertOS.