1. Introduction & Scope
1.1 Purpose
At X-ion, we build artificial intelligence models, machine learning APIs, and digital tools. We respect your privacy and are committed to protecting personal data submitted to us or collected through:
- Our primary websites (including x-ion.com, scrutium.com, and affiliated subdomains).
- The X-ion web platform, developer dashboard, and API endpoints.
- SDKs, CLIs, and product interfaces (including Scrutium AI where applicable).
- Research programs, subscriptions, and enterprise consulting portals.
1.2 Controller vs. Processor Status
- Data controller: X-ion acts as a Data Controller for account data, billing details, website telemetry, and direct communications.
- Data processor: When enterprise clients submit inputs, prompts, and datasets to our APIs for processing, X-ion acts as a Data Processor on behalf of the client under a separate Data Processing Addendum (DPA).
2. Data We Collect
We categorize data we may collect into four main buckets:
1. Account & billing
Name, email, password hashes, MFA/SSO metadata, billing address, tax IDs, payment details (via PCI-DSS gateways).
2. System & telemetry
IP address, approximate location, device/OS, API usage, latency, token rates, cookies, session tokens, analytics metadata.
3. Model inputs & outputs
Prompts, code, media, embeddings, datasets, configuration; generative responses and structured outputs from X-ion models.
4. Feedback & support
Ratings, corrections, red-team flags, helpdesk tickets, chat transcripts, and email with support or legal teams.
2.1 Account & Contact Data
Full name, corporate email, user handle, job title; password hashes, MFA tokens, and SSO metadata; billing addresses, tax identifiers (VAT/PIN), and payment details processed via PCI-DSS compliant third-party payment gateways.
2.2 System & Usage Telemetry
IP address, approximate geographic location, device identifiers, and operating system; API key activity, performance metrics, error logs, latency, and token consumption; web cookies, local storage session tokens, and analytics metadata.
2.3 Model Inputs & Outputs (Service Content)
- Inputs: Text prompts, source code, images, audio, vector embeddings, fine-tuning datasets, and configuration parameters uploaded to X-ion platforms.
- Outputs: Generative responses, predictions, code output, synthetic data, or structured JSON returned by X-ion models.
2.4 User Feedback & Support Data
Human feedback on model outputs (ratings, corrections, red-teaming flags); helpdesk tickets, live-chat transcripts, and email with X-ion engineering or legal support.
3. How We Use Your Data
| Purpose | Data types | Primary objective |
|---|---|---|
| Service provisioning | Account data, inputs, API keys | Authenticate access, route inference, execute queries |
| Billing & operations | Account data, telemetry, payment info | Usage calculation, invoices, quota enforcement |
| Safety & anti-abuse | Inputs, telemetry, system logs | Detect abuse, prevent scraping, stop attacks |
| Research & model alignment | Inputs, outputs, feedback | Safety evaluation, alignment, performance improvement |
| Legal & regulatory | Account data, audit logs | Statutory audits, lawful requests, tax rules |
4. AI Model Training & Opt-Out Rules
4.1 Enterprise Tiers (Zero Data Retention / No Training)
- Default rule: Inputs, outputs, and fine-tuning datasets submitted by Enterprise API customers, Enterprise Service Agreement (ESA) signees, and dedicated instance users are never used to train, fine-tune, or align X-ion base models.
- Data retention: Transient input/output payloads exist in memory for inference and are deleted from active cache within 30 days (or retained per agreed enterprise log schedules for safety auditing).
4.2 Standard Public & Free Tiers
Inputs and outputs submitted via public, developer, or free tiers may be processed, reviewed, and analyzed to train, align, and improve future X-ion foundation models.
4.3 Opt-Out Mechanisms
Users on standard paid or free tiers can opt out of model training by:
- Account Settings → Privacy & Data Controls → toggle “Opt-Out of Model Training” (when available).
- Emailing privacy@scrutium.com with subject “Model Training Opt-Out Request”.
- Including the
X-ion-Opt-Out: Trueheader in API requests (developer users).
5. Legal Bases for Processing (GDPR & Kenya DPA)
If you reside in the European Economic Area (EEA), United Kingdom, or Kenya, we process personal data under:
- Contractual necessity: Processing required to enter into or perform our contract with you (e.g., inference requests, billing).
- Legitimate interests: Interests that do not override your privacy rights (e.g., API security, fraud prevention, model safety).
- Legal obligation: Processing required by law, legal process, or tax authorities.
- Consent: Where you have explicitly granted permission (e.g., newsletters or specific research data).
6. Data Sharing, Disclosure & Third-Party Transfers
We do not sell your personal data or trade your prompts to advertisers. We disclose data only under these conditions:
- Infrastructure vendors & sub-processors: Trusted cloud providers (GPU compute, databases), payment gateways, and logging services under strict DPAs.
- Legal & safety obligations: Court authorities or law enforcement when required by valid legal process or emergency involving imminent danger to life.
- Corporate reorganization: In a merger, acquisition, asset sale, or bankruptcy, personal data may transfer to the acquiring entity subject to this Policy.
7. Data Security, Storage & Retention
7.1 Security Safeguards
- Encryption: TLS 1.3 for data in transit; AES-256 for data at rest.
- Access controls: Zero-trust policies, role-based access (RBAC), and MFA for internal staff.
- Isolation: Logical and hardware isolation for enterprise tenant databases and private stores.
7.2 Data Retention Windows
- Account & billing: While the account is active, plus up to 7 years for tax and accounting obligations.
- API ingestion logs: Stored up to 30 days for security, debugging, and anti-abuse, then permanently deleted or anonymized.
- Training datasets: As long as necessary to support current model checkpoints, unless a valid deletion request is exercised.
8. International Data Transfers
X-ion operates with cloud infrastructure across multiple regions (including North America, Europe, and Africa). Office and servers are based in Nairobi, Kenya.
When transferring personal data outside its region of origin:
- Standard Contractual Clauses (SCCs): EU-approved SCCs and the UK Transfer Addendum for transfers from the EEA/UK.
- Kenya Data Protection Act: Cross-border transfers originating from Kenya comply with Section 48 of the Kenya Data Protection Act, ensuring adequate protection guarantees.
9. Your Privacy Rights & Choices
Depending on your jurisdiction, you may have:
- Access & portability: A copy of personal data we hold about you in a structured, machine-readable format.
- Rectification: Correction of inaccurate or incomplete information.
- Erasure (“right to be forgotten”): Deletion of personal data or account records, subject to statutory retention.
- Restrict or object: Object to or restrict processing, including opting out of direct marketing.
- Withdraw consent: Withdraw previously granted consent without affecting prior lawful processing.
How to exercise rights: Email privacy@scrutium.com. We will verify your identity and respond within 30 days (or within statutory local timelines).
10. Automated Decision-Making & Profiling
X-ion models process inputs dynamically to generate inference results and probabilistic outputs. X-ion does not use personal data submitted by users to conduct fully automated legal profiling, financial credit scoring, or binding legal decisions without human oversight.
11. Children’s Privacy
Our Services are intended for adults, businesses, and developers. X-ion does not knowingly collect personal data from children under 13 (or under 18 where required by regional law). If we discover that a minor has submitted personal data without verified parental consent, we will take steps to delete that information.
12. Region-Specific Disclosures
12.1 California Privacy Notice (CCPA/CPRA)
- No sale / no sharing for cross-context behavioral advertising: X-ion does not sell your personal data or share it for cross-context behavioral advertising.
- Shine the Light: You may request information about disclosures of personal data to third parties for direct marketing purposes.
12.2 Kenya Data Protection Notice
Data subjects in Kenya have the right to lodge complaints with the Office of the Data Protection Commissioner (ODPC) if they believe their privacy rights under the Kenya Data Protection Act 2019 have been infringed.
13. Changes to This Privacy Policy
We may update this Privacy Policy to reflect evolving research capabilities, platform features, or international regulatory updates. Material changes will be communicated by posting an updated policy online, email notification, or a notice in the developer dashboard at least 30 days prior to taking effect where practicable.
14. Data Protection Officer & Contact Information
For questions, privacy concerns, or to exercise data subject rights, contact:
- Data Protection Officer (DPO): dpo@scrutium.com
- General privacy inquiries: privacy@scrutium.com
- Security & misuse reports: security@scrutium.com
- Support: support@scrutium.com
- Postal / office: X-ion Privacy Office, Nairobi Town, Nairobi, Kenya
- General contact: Contact form
Note: This is an enterprise-grade framework (v3.1). Have counsel licensed in Kenya (and other jurisdictions where you operate) review it before relying on it for regulatory filings, DPAs, or ODPC registration.