Policies & terms.

1. Introduction

Xevyo AI ("Xevyo", the "Company", "we", "our", or "us") provides artificial intelligence deployment services to enterprise and institutional customers (each, a "Customer"). We are committed to protecting the privacy, confidentiality, and security of the Personal Information entrusted to us. This Privacy Policy describes how Xevyo collects, uses, stores, discloses, transfers, and otherwise processes Personal Information in connection with:

• The Xevyo websites at xevyo.com and its subdomains, including chat.xevyo.com;
• The Xevyo conversational AI platform, including chat, voice, image, document, memory, and personalisation features;
• The Xevyo Developer Interface (APIs and developer keys);
• The Xevyo Trainer Platform (Train Your Own Xevyo);
• Xevyo-operated child platforms and sub-brands, including BioSports and Biongevity, unless a separate privacy notice is expressly provided for them;
• Telephone and SMS access channels; and
• All other products and services operated by Xevyo (collectively, the "Service").

This Privacy Policy also explains the rights available to individuals regarding their Personal Information and how those rights may be exercised. Please read it together with the Xevyo Terms of Use.

2. Deployment Model; Scope of This Policy

Xevyo's model runs exclusively on Xevyo-operated infrastructure; no third-party model processes your conversations in the core inference path. This Policy applies to Personal Information that Xevyo processes.

Enterprise, on-premises, sovereign-cloud, and air-gapped deployments

Where Xevyo software is deployed inside a customer's own environment, that software is engineered to transmit no usage telemetry, diagnostics, or customer content to Xevyo, and Xevyo does not collect or process content handled within such deployments. The deploying customer is responsible for that environment and for its own privacy notice; this Policy does not apply to processing occurring solely within a customer-operated deployment.

Organisational accounts

Where you use the Service through an account provisioned by your employer or another organisation (including via LDAP or SCIM), that organisation controls the account and may access, manage, or delete data associated with its tenant, and its own policies apply in addition to this Policy. In that case the customer is the controller, Xevyo acts as a processor or service provider, and the executed agreement governs in the event of conflict. Individuals should direct requests concerning such data to the relevant organisation.

3. Definitions

• Personal Information — any information relating to an identified or identifiable natural person, and includes "personal data" as defined under the GDPR and India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and "personal information" as defined under the CCPA/CPRA and PIPEDA.
• Processing — any operation performed upon Personal Information, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transmission, restriction, deletion, and destruction.
• Inputs — prompts, messages, voice recordings, images, documents, files, and other content you submit to the Services.
• Output — content the Service generates in response.
• Memory Records — durable facts, preferences, and profile information stored by the Services' memory features.
• Sensitive Personal Information — includes Health Information (such as conditions, medications, allergies, symptoms, and fitness data) and other categories designated as sensitive or special under applicable law.

4. Information We Collect

4.1 Information you provide

• Account and profile information: name; email address; username; passwords or SSO identifiers; invite or access code; language; units; time zone; and profile details you choose to add;
• Conversations and content: your Inputs and the Outputs generated for you, including chat messages, uploaded documents and images, knowledge-base content, and content you post in channels, direct messages, shared notes, and prompt libraries;
• Voice and audio: audio you submit through voice features or telephone/SMS channels, and the resulting transcripts;
• Memory Records and custom instructions: durable facts and preferences extracted from your conversations or entered by you, your custom instructions, and any custom system prompts;
• Health and wellness information (with your consent): conditions, medications, allergies, symptoms, workout and daily logs, and other health-related details you provide through health features, BioSports, or Biongevity, or that you authorise us to receive from connected services such as Google Health Connect or Google Fit (steps, heart rate, sleep);
• Trainer Platform content: trainer registration details, claimed expertise domains and verification information, uploaded documents, designated URLs, expert question-and-answer pairs, persona configuration, and corrections captured during training sessions;
• Feedback: thumbs ratings, scores, reason tags, and evaluation-arena votes, together with an immutable snapshot of the rated message, the preceding conversational context, and routing metadata;
• Payment and subscription information: plan selection, billing contact details, and transaction history. Payment card details are collected and processed directly by our payment processor (Stripe); Xevyo does not store full card numbers; and
• Communication: support requests, correspondence, survey responses, and event registrations.

4.2 Information collected automatically

• Device and technical data: IP address, device identifiers, browser type and version, operating system, and language preferences;
• Usage and log data: login and authentication events, session identifiers, pages and features used, API request metadata, tool invocations and their results, error reports, and performance metrics;
• Metering data: prompt and completion token counts, image-generation counts, per-key API usage, and quota consumption;
• Document and media access logs: upload, download, generation, and access events, including IP address and user agent, maintained for security and moderation; and
• Cookies and similar technologies: as explained in Section 9.

4.3 Information from third parties

• Single sign-on providers (such as Google or GitHub), which share profile information you authorise;
• Your organisation, where it provisions or manages your account (including via LDAP or SCIM);
• Connected services you authorise, such as Google Calendar, Google Drive, OneDrive, and Google Health Connect / Google Fit; and
• Payment processors and, where you use telephone or SMS channels, telephony providers (such as Twilio), which process call and message metadata.

5. Sensitive Personal Information; Health Data Consent

Health features are optional. Where you voluntarily submit health-related or other sensitive personal information through the Services, you acknowledge and expressly consent to its processing for the purpose of providing the requested Services, in accordance with this Privacy Policy and applicable law. Where applicable law requires consent to be collected through a specific mechanism, any such mechanism presented in-product governs. In particular:

• Sensitive health details (such as diagnoses and medications) are not written to long-term Memory Records without your consent, and health-related memory is subject to the same view, edit, and delete controls as all other memory;
• You may withdraw consent at any time by deleting the relevant Memory Records, disconnecting connected health services, disabling memory or health features, or requesting deletion of your account; withdrawal does not affect the lawfulness of processing before withdrawal;
• Protected health information is gated from long-term Memory Records at the point of writing, and may be minimised before logging where feasible; personalisation uses your stored profile to surface safety cautions (for example, interaction warnings based on known medications); and
• Xevyo does not use your health information for advertising and does not sell it.

Do not submit another person's health or other sensitive information unless you have lawful authority to do so.

6. How We Use Personal Information

The data Xevyo collects as described in Section 4 is used solely for the following purposes:

• Provide, operate, maintain, personalise, secure, and improve the applicable service, including generating Outputs, retrieving from your knowledge bases, applying your preferences and Memory Records, and operating collaboration features;
• Route requests across models and serve cached answers for repeated queries;
• Provide the voice, telephony, document, image, and integration features you use;
• Create and administer accounts, authenticate users, and manage organisational tenants;
• Meter usage, enforce quotas and entitlements, process subscriptions and payments, and prevent overuse and abuse;
• Screen content for safety and detect and prevent fraud, abuse, security incidents, and violations of our terms, including through automated moderation systems and prompt-injection defences;
• Detect potential emergencies in health-related conversations and surface region-appropriate crisis resources, on an informational, best-efforts basis;
• Provide customer support, respond to inquiries, and (with your permission or as described in Section 8) review specific conversations to resolve issues;
• Evaluate and improve model and product quality, strictly limited to the data categories described in Section 7 and subject to the exclusions stated there;
• Communicate service, security, and billing information and, subject to your choices, marketing communications;
• Comply with legal obligations, enforce agreements, and protect the rights, property, and safety of Xevyo, its users, and the public; and
• Comply with applicable law, regulation, or a valid legal process.

We will never contact you with advertisements, will never provide your data to any third party (unless requested by you), and will not use customer prompt or completion content for any purpose other than those outlined above.

7. AI Model Training and Improvement

Consistent with Xevyo's design commitments, your prompts, conversations, uploaded documents, retrieval corpora, fine-tuning data, and Memory Records are never used to train Xevyo models. Only the following limited categories — each involving content deliberately contributed for that purpose or explicitly submitted as feedback, rather than your ordinary use of the Services — may be used to develop, evaluate, and improve the Services and Xevyo models:

• Trainer Platform content: documents, question-and-answer pairs, persona configurations, and correction/preference pairs submitted by trainers are collected for the express purpose of training and fine-tuning, as disclosed in the Terms of Use;
• Feedback you explicitly submit: ratings, reason tags, evaluation-arena votes, and the associated context snapshots, used for quality evaluation and model improvement; and
• De-identified and aggregated data: data that no longer identifies you, such as aggregate routing performance and usage statistics.

If Xevyo introduces any broader training use of user content in the future, it will update this Policy and, where required by applicable law, seek consent or provide an opt-out before doing so.

8. Automated Processing; Human Access to Conversations

The Services rely on automated systems, including request classification and routing, response caching, safety and content moderation of text (and of images where such classifiers are deployed), protected-health-information redaction, and emergency-pattern detection. Requests that violate safety policies may be blocked automatically. Where image moderation or detection features are made available, such processing is carried out solely to provide and secure the Services, enforce our terms, and comply with applicable law, in accordance with this Privacy Policy. These automated systems do not make decisions producing legal or similarly significant effects about you without human involvement, and Section 12 describes the rights that may apply to automated processing in your jurisdiction.

Human access

Xevyo personnel do not routinely read your conversations. Limited, authorised personnel may access specific content where necessary to resolve a support issue at your request; investigate safety, security, fraud, or abuse signals; comply with legal obligations; or protect rights and safety. Administrative "break-glass" access to user chats is restricted, logged in an append-only audit trail, and notified to our data protection function. Organisational administrators of enterprise tenants may separately have access to content within their tenant under their organisation's policies.

9. Cookies and Similar Technologies

Xevyo uses cookies and similar technologies for:

• Essential purposes (session management, authentication, security, load balancing, quota enforcement);
• Functional purposes (language, preferences, interface settings), subject to consent where required; and
• Analytics (feature usage and performance measurement).

Xevyo does not use third-party advertising cookies. You can manage cookies through your browser settings and, where offered, our consent controls; disabling essential cookies may prevent parts of the Service from functioning.

10. Disclosure of Personal Information

Xevyo does not sell Personal Information and does not share it for cross-context behavioural advertising. Personal Information is disclosed as follows:

• Service providers and sub-processors: acting on our instructions, including hosting and infrastructure providers, payment processing (Stripe), telephony (Twilio), email delivery, and security and monitoring vendors, each bound by confidentiality and data-protection obligations;
• Search and retrieval providers: where the assistant performs a web search or fetches a page for you, your search query or the target URL (which may reveal information you included in it) is transmitted to the selected search or crawling provider (which may include engines such as Brave, Tavily, Serper, Google Programmable Search, Bing, DuckDuckGo, Kagi, Exa, or Perplexity, and content services such as Firecrawl) without your account identity — avoid including sensitive details in queries you would not submit to a search engine directly;
• Public data sources: queries to medication, nutrition, research, trends, and environmental databases (such as OpenFDA, PharmGKB, DSLD, Open Food Facts, USDA FoodData Central, Semantic Scholar, Google Trends, and OpenAQ) transmit the query content needed to answer you;
• Connected services you authorise: such as Google Calendar, Google Drive, OneDrive, and Google Health Connect / Fit, to which we send and from which we receive only the data needed for the feature you invoke;
• Your organisation: for accounts provisioned or managed by an enterprise tenant;
• Other users: where you post content to shared channels, notes, or libraries, or publish a Custom Instance;
• Professional advisers: legal, accounting, audit, and insurance advisers under confidentiality obligations;
• Authorities and other parties where required by law: including to comply with legal process, enforce agreements, investigate fraud or security incidents, or protect rights and safety; Xevyo reviews requests carefully, limits disclosures to what is reasonably required, and, where legally permitted, will notify affected users or customers; and
• Corporate transactions: in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate protections and, where required, notice.

Where required by law or contract, Xevyo maintains a list of material sub-processors and will provide notice of material changes.

11. Google API Services — Limited Use

Xevyo's use and transfer of information received from Google APIs (including Google Sign-In, Calendar, Drive, and Health Connect / Fit) adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google user data is used only to provide the features you invoke, is not used for advertising, is not sold, and is not used to train generalised machine-learning models.

12. Your Rights and Controls

12.1 Built-in controls

• Memory Manager: view, edit, and delete every stored Memory Record, and disable memory features;
• Data export: you may request an export of your data, including structured and semantic memory, through the contact details in Section 27 and any in-product export tools that may be made available;
• Erasure: you may delete Memory Records and conversations in-product, and may request deletion of your account and associated data through the contact details in Section 27;
• Conversation controls: delete conversations, manage folders and tags, and control tool and plugin activation;
• Communication: opt out of marketing at any time; service, security, and billing communications may still be sent.

12.2 Legal rights

Depending on your jurisdiction and applicable law, you may have rights to: know what Personal Information is processed, access it, and receive a portable copy; correct inaccurate information; delete it; restrict or object to processing; withdraw consent; not be subject to certain solely automated decisions; nominate another person to exercise your rights on your behalf where the law so provides; and lodge complaints with a supervisory authority or data protection board.

Xevyo will respond to verified requests within the timeframe applicable by law, may request information reasonably necessary to verify your identity, and, where permitted, may decline requests that are manifestly unfounded, excessive, or repetitive, or that would adversely affect the rights of others. Xevyo will not discriminate against you for exercising your rights.

13. European Economic Area, United Kingdom, and Switzerland

Where the GDPR, UK GDPR, or Swiss FADP applies, Xevyo processes Personal Information on the following bases:

• Performance of contract: providing the service you request, including generating Outputs and operating your account;
• Consent: health and other sensitive data, optional marketing, certain cookies, and connected health services — withdrawable at any time;
• Legitimate interest: securing the services, preventing fraud and abuse, improving quality within the limits of Section 7, and internal administration, balanced against your rights; and
• Legal obligation: tax, accounting, and responses to lawful requests.

Special category data (such as health information) is processed only with your explicit consent or another lawful condition. You have the rights described in Section 12.2, including the right to lodge a complaint with your supervisory authority. Where Xevyo acts as a processor for an enterprise customer, requests concerning that data may be redirected to the customer controller. Where the entity is established outside the EEA/UK and offers services to individuals there, an Article 27 EU/UK Representative is designated and identified here: [●].

14. India — Digital Personal Data Protection Act, 2023

Where the DPDP Act applies, Xevyo processes digital personal data either with your consent — requested in a clear manner, for specified purposes, and withdrawable as easily as it was given — or for legitimate uses recognised by the Act, including the voluntary provision of data for a specified purpose and compliance with law. You have the right to: access a summary of your personal data and processing activities; correction, completion, updating, and erasure; grievance redressal; and to nominate an individual to exercise your rights in the event of death or incapacity. Requests and grievances may be submitted through the in-product controls or by email to [email protected], and will be acknowledged and responded to within the timeframe applicable by law. Xevyo does not process the personal data of children as defined under the DPDP Act, and the Services are restricted to users aged eighteen (18) and above.

15. California and Other U.S. State Privacy Rights

If you are a resident of California or another U.S. state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, and others), you may have rights to: know, access, and receive a portable copy of personal information; correct inaccuracies; delete personal information; limit the use of sensitive personal information; and opt out of sales, sharing for cross-context behavioural advertising, and certain profiling. Xevyo does not sell personal information or share it for cross-context behavioural advertising, and processes sensitive personal information (including health information) only for the purpose of providing the features you requested and as permitted by applicable law. You may exercise rights through the contact details below or in-product controls, may use an authorised agent where the law provides, may appeal a refusal by contacting us, and will not be discriminated against for exercising your rights. The categories of personal information collected, the purposes, and the disclosures are as described in Sections 4, 6, and 10; Xevyo retains each category as described in Section 17.

16. Canada (PIPEDA)

Where PIPEDA or applicable provincial privacy legislation applies, Xevyo processes Personal Information with consent (express consent for sensitive information such as health data) or as otherwise permitted by law. You may request access to and correction of your Personal Information, withdraw consent subject to legal or contractual restrictions, obtain information about our privacy practices, and challenge compliance by contacting our privacy office below and, thereafter, the Office of the Privacy Commissioner of Canada or the relevant provincial commissioner.

17. Data Retention

Xevyo retains Personal Information only as long as reasonably necessary for the purposes described in this Policy, to comply with legal, tax, and accounting obligations, to resolve disputes, and to enforce agreements. In particular:

• Conversations, documents, and Memory Records are retained while your account is active and until you delete them or your account is deleted following your request, after which they are deleted or de-identified within a reasonable period, subject to backup rotation and legal holds;
• Feedback context snapshots are retained as quality-evaluation records for as long as needed for the purposes in Section 7;
• Trainer content is retained for the operation of the relevant Custom Instance and for the training purposes disclosed in Section 7 and the Terms of Use;
• Security, access, and audit logs (including document-access and break-glass audit records) are retained for security, compliance, and forensic purposes in accordance with our retention schedules; and
• Billing and transaction records are retained as required by tax and accounting law.

18. Information Security

Xevyo maintains an information security program with technical and organisational measures appropriate to the risk, which may include: encryption in transit and at rest; logical workspace isolation with per-resource access controls; role-based access control with granular roles; virus scanning of uploaded files; signed, time-limited media URLs and domain allow-listing; append-only audit logging of administrative and sensitive actions; secure key handling (API keys displayed once and stored hashed); infrastructure isolation of model-serving endpoints; observability and anomaly monitoring; and incident response procedures. No system is completely secure, and Xevyo cannot guarantee absolute security; please use strong, unique credentials and protect your API keys.

19. Security Incidents and Data Breach

Xevyo maintains documented procedures for identifying, investigating, containing, and mitigating security incidents. A "personal data breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, Personal Information.

Where a personal data breach occurs, Xevyo will assess its scope and impact, take corrective action, and notify affected individuals and the competent authorities without unreasonable delay and, in any event, within the timelines required by applicable law, including:

• EEA / UK / Switzerland: notification to the competent supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals; and notification to affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms; and
• India: intimation to each affected Data Principal and to the Data Protection Board of India upon becoming aware of the breach, followed by a detailed report to the Board within the timelines prescribed under the Digital Personal Data Protection Rules, 2025.

Breach notices will include, to the extent known and as required by applicable law, a description of: the nature of the breach, including the manner and, where known, the time or period of its occurrence; the categories of individuals and of Personal Information concerned; the approximate number of individuals and records affected; the likely consequences and potential impact on the affected individuals; the measures taken or proposed to address the breach and mitigate its effects, and the safety measures affected individuals may take to protect their interests; and the contact point from which further information can be obtained.

20. International Data Transfer

Xevyo operates on its own infrastructure and seeks to minimise unnecessary cross-border transfers. Where Personal Information is transferred internationally, including to the service providers listed in Section 10, Xevyo implements the safeguards required by applicable law, which may include standard contractual clauses, the UK International Data Transfer Addendum, adequacy decisions, contractual and organisational measures, and encryption, and complies with any applicable governmental restrictions on transfers.

21. Children's Data

Our services are contracted with enterprise and other institutional Customers as business-to-business services and are not directed to, marketed to, or designed for use by children, nor do we knowingly collect personal data directly from individuals under age 18. Where a Customer's use of the service involves the processing of personal data belonging to minors under age 18 (for example, where a regulated Customer's end users may include minors), that Customer remains responsible for ascertaining that the necessary legal basis, including any required parental or guardian consent, is in place before such data is provided to the Service. If you believe a child has provided Personal Information, contact us using the details below and we will take reasonable steps to delete it without undue delay.

22. Marketing Communications

Where permitted by law and subject to your choices, Xevyo may send product updates, newsletters, and event invitations. You may opt out at any time using the unsubscribe link, your account preferences, or the contact details below. Even after opting out, Xevyo may send non-promotional communications relating to security, service updates, billing, and legal matters. Proactive in-product nudges are opt-in and can be muted or disabled in your settings.

23. Third-Party Websites and Services

The Services may contain links to, retrieve content from, or interoperate with third-party websites and services that Xevyo does not control. This Policy does not apply to third parties, and Xevyo is not responsible for their privacy practices. Review the privacy policies of third-party services — including search engines, data sources, connected accounts, and payment and telephony providers — before use.

24. Data Protection Impact Assessments

Because the Services involve artificial-intelligence systems, Xevyo conducts data protection impact assessments and algorithmic impact evaluations for processing activities likely to result in a high risk to the rights and freedoms of individuals, and in any case where such assessments are required by applicable law (including Article 35 of the GDPR and UK GDPR and, where applicable, the DPDP Act and the rules made thereunder). These assessments consider the nature, scope, context, and purposes of the processing; the risk to individuals, including risks specific to automated and AI-assisted processing; and the measures adopted to mitigate those risks. Upon reasonable request and subject to appropriate confidentiality terms, Xevyo will provide enterprise customers with summaries of relevant assessments, together with reasonable cooperation and information, to support their own data protection impact assessments, algorithmic accountability obligations, and regulatory due-diligence requirements. Nothing in this Section requires Xevyo to disclose trade secrets, security-sensitive information, or the confidential information of other customers.

25. Changes to This Policy

Xevyo may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. Where changes are material, Xevyo will notify Customers via email to the designated administrative contact and update the "Last Updated" date above. We will send this notification at least thirty (30) days before the change takes effect for purposes of data collection or use. If you continue to use the Service after a non-material change takes effect, such use represents your acceptance of the change. For material changes that affect how we collect, use, or share your data, the change will apply only on a forward-going basis and will not apply to data collected under an earlier version of this Policy without separate notification and, where required, your consent.

26. Governing Law; Severability

To the extent permitted by applicable law, this Privacy Policy and any dispute arising out of or in connection with it shall be governed by and construed in accordance with the laws of the Province of Alberta and the federal laws of Canada applicable therein, without giving effect to its conflict-of-laws principles. Nothing in this Privacy Policy limits or waives any non-waivable rights or remedies available to individuals under applicable data protection laws, including the right to lodge a complaint with a competent supervisory authority or privacy regulator, or to bring proceedings before the courts of the jurisdiction in which the individual resides where such right is conferred by applicable law. If any provision of this Privacy Policy is held to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect.

27. Contact

Questions, concerns, requests, or complaints regarding this Privacy Policy or Xevyo's practices may be directed to our Privacy Office / Data Protection Officer, Viswateja Yetukuri, at XEVYO TECHNOLOGIES INC., 330 5 Ave SE #1010, Calgary, Alberta, Canada.

• Privacy: [email protected]
• Grievance Officer (India): [email protected]
• Legal: [email protected]
• Support: [email protected]

Where required by applicable law, you may also contact the supervisory authority, data protection board, or privacy regulator in your jurisdiction.

1. Acceptance of These Terms

These Terms of Use ("Terms") constitute a legally binding agreement between XEVYO TECHNOLOGIES INC. ("Xevyo", "Company", "we", "our", or "us"), a company organised under the laws of [●], and the individual or legal entity ("you" or "your") accessing or using:

• The Xevyo websites at xevyo.com and its subdomains, including chat.xevyo.com;
• The Xevyo conversational AI platform, including chat, voice, image, and document capabilities (the "User Interface");
• The Xevyo application programming interfaces, developer keys, software development kits, and developer tooling (the "Developer Interface");
• The Xevyo Trainer Platform (Train Your Own Xevyo);
• Xevyo-operated child platforms and sub-brands, including BioSports and Biongevity, unless separate terms are expressly provided for them;
• Enterprise, on-premises, sovereign-cloud, and air-gapped deployments of Xevyo software ("Enterprise Deployments");
• Collaboration features, mobile or telephony access channels, documentation, and support; and
• Any associated software, models, products, or services provided by Xevyo (collectively, the "Services").

By accessing, browsing, registering for, purchasing, subscribing to, downloading, installing, integrating with, or using any portion of the Services, you acknowledge that you have read, understood, and agree to be legally bound by these Terms and by the policies expressly incorporated by reference, including the Privacy Policy, the Responsible Use Policy, and any applicable Data Processing Addendum. If you do not agree, you must not access or use the Services.

If you are entering into these Terms on behalf of a corporation, government agency, healthcare organisation, financial institution, or other legal entity, you represent and warrant that you have full authority to bind that entity, and "Customer" refers to that entity. Where you use the Services as an individual, "Customer" refers to you.

2. The Xevyo Platform

Xevyo provides artificial intelligence services powered exclusively by Xevyo's own proprietary models, trained and served on Xevyo-operated infrastructure. Depending on your plan and deployment, the Services include:

• Conversational AI: streaming multi-model chat with history, search, folders, tags, and organisation features;
• Voice and audio: speech-to-text transcription, text-to-speech response, and telephone/SMS access channels;
• Web search and retrieval: live web-grounded answers with citations, page fetching, and retrieval-augmented generation over your knowledge bases and uploaded documents;
• Document intelligence: secure document upload, extraction, long-document analysis, and template-driven document generation;
• Image capabilities: image understanding and text-to-image generation;
• Memory and personalisation: long-term memory, custom instructions, and personalised responses, subject to the controls described in Clause 9;
• Developer access: programmatic access through per-user API keys with usage metering and budgets;
• Trainer Platform: creation of domain-specific custom assistant instances by verified trainers;
• Collaboration: channels, direct messages, shared notes, and prompt libraries; and
• Enterprise Deployments: self-hosted delivery of Xevyo software within a customer's own perimeter, governed additionally by Clause 21 and any executed Order Form or Master Services Agreement ("MSA").

The availability of particular features, models, quotas, and tools depends on the applicable plan, subscription, or Order Form. Xevyo may make features available through invitation, access codes, or staged rollout. Some features described in these Terms may not be available in all regions, plans, or release stages, and a reference to a feature does not guarantee its current availability; Xevyo provides features on a staged-rollout basis.

3. Modification to These Terms

Xevyo reserves the right to modify, amend, supplement, or replace these Terms at any time. Where changes are material, Xevyo will provide notice through one or more of the following methods: website or in-product notification, email communication, or other reasonable means, and, where required by applicable law, will obtain any required consent.

Continued use of the Services following the effective date of revised Terms constitutes acceptance of the updated Terms. Where a Customer has an executed MSA, Enterprise Subscription Agreement, or Order Form in effect, material changes to these Terms shall not apply to that Customer until the commencement of the next renewal term, except where such changes are required by applicable law. If you do not agree to the updated Terms, your sole remedy is to discontinue use of the Services and, where applicable, cancel your subscriptions in accordance with Clause 7.

4. Definitions

• Account — an account, access token, invite token, or API key used to access the Services.
• Authorized User — an individual authorised by a Customer to access the Services under the Customer's Account.
• Custom Instance — a domain-specific assistant instance created through the Trainer Platform, comprising its persona configuration, knowledge base, and training materials.
• Inputs — prompts, queries, messages, voice recordings, images, documents, files, code, knowledge-base content, and any other content submitted to the Services by or on behalf of you.
• Memory Records — durable facts, preferences, and profile information stored by the Services' memory features, as described in Clause 9.
• Model(s) — Xevyo's proprietary artificial-intelligence models, including all versions, checkpoints, adaptations, weights, and updates thereof.
• Order Form — an ordering document, statement of work, or deployment schedule executed by Xevyo and a Customer.
• Outputs — content generated by the Services in response to Inputs, including text, speech, images, and documents.
• Trainer Content — content submitted through the Trainer Platform, including uploaded documents, scraped URLs designated by the trainer, expert question-and-answer pairs, persona configurations, corrections, and preference (chosen/rejected) pairs.
• User Content — collectively, Inputs, Memory Records, Trainer Content, and content you post through collaboration features; User Content does not include Outputs.
• Subscription Term — the period of authorised access under the applicable plan or Order Form, including renewals.

5. Eligibility

You must be at least eighteen (18) years of age, or the age of majority in your jurisdiction if higher, to use the Services. The Services — including their health, wellness, and coaching features — are not directed to, and must not be used by, children, and Xevyo does not knowingly permit accounts for persons under eighteen (18). You represent and warrant that: all registration information you provide is accurate and complete and you will keep it current; you have the legal capacity to enter into binding agreements; you are not barred from using the Services under applicable law; and you are not located in, organised under the laws of, or ordinarily resident in a jurisdiction subject to comprehensive sanctions, and are not a sanctioned or denied party.

6. Account, Access Tokens, and API Keys

Registration may be invite-only or gated by access codes for particular cohorts or events. You agree to safeguard your credentials, access tokens, and API keys; not to share, sell, or transfer them; to implement reasonable measures to prevent unauthorised access; to promptly notify Xevyo of any suspected compromise; and to accept responsibility for all activity occurring under your Account or keys.

You may authenticate through single sign-on providers (such as Google or GitHub) or, for enterprise tenants, through LDAP or SCIM provisioning managed by your organisation. Where your Account is provisioned by an organisation, that organisation's administrators may control, suspend, or delete your Account and may have the access rights described in the Privacy Policy. Xevyo may suspend or revoke Accounts, tokens, or keys that contain false, misleading, incomplete, or fraudulent information, or that Xevyo reasonably believes are compromised or misused.

7. Plans, Subscriptions, Billing, and Quotas

7.1 Plans and entitlements

The Services are offered under plans (e.g., Free, Basic, and Premium) and enterprise agreements that gate token budgets, model access, image-generation quotas, features, and support levels. Plan entitlements are as described at the point of purchase or in the applicable Order Form. Xevyo may modify plan features and pricing prospectively; material adverse changes to a paid plan will take effect for you from your next renewal, and where required by law you will be notified in advance and may cancel before the change applies.

7.2 Metering and quotas

Usage is metered, including prompt and completion tokens and image generations. Quotas are enforced automatically; requests may be blocked, and in-progress responses may be terminated, once an applicable budget is exhausted. Metering records maintained by Xevyo's systems are determinative absent manifest error. Unused quota does not roll over and has no cash value unless expressly stated.

7.3 Payments; auto-renewal

• Paid subscriptions are billed in advance through Xevyo's payment processor on a recurring basis and renew automatically for successive periods equal to the then-current billing period unless cancelled before renewal;
• You may cancel at any time with effect from the end of the current billing period; except where required by applicable law or expressly stated otherwise, fees are non-refundable and no credits are given for partial periods, unused quota, or downgrades;
• Where required by applicable law, Xevyo will provide advance notice of automatic renewal and honour statutory cooling-off or refund rights;
• You are responsible for maintaining complete and accurate billing information; failure to pay may result in suspension or termination and, for enterprise invoicing, late payments may accrue interest at the lesser of 1.5% per month or the maximum lawful rate; and
• All fees are exclusive of taxes; you are responsible for applicable sales, use, value-added, goods-and-services, withholding, and similar taxes and duties (other than taxes on Xevyo's income).

7.4 Free tier and trials

Free tiers, trials, pilots, and evaluation environments are provided for internal evaluation, may be modified, limited, or discontinued at any time, carry no service-level commitments, and may be subject to additional restrictions. Export any important data before a trial ends.

8. AI Interactions; Inputs and Outputs

8.1 Your Inputs

As between you and Xevyo, you retain all rights, title, and interest in and to your Inputs. You represent and warrant that you have all rights, permissions, consents, and legal bases necessary to submit your Inputs and to authorise the processing described in these Terms and the Privacy Policy, and that your Inputs do not infringe or misappropriate the rights of any third party or violate applicable law. Do not submit content you have no right to use, and do not submit other people's personal or health information without lawful authority.

8.2 Outputs; assignment

Subject to your compliance with these Terms and payment of applicable fees, Xevyo hereby assigns to you all of Xevyo's right, title, and interest, if any, in and to the Outputs generated for you. This assignment does not extend to, and you acquire no rights in: (a) the Models, model weights, or the Services; (b) third-party content that may be reflected in Outputs; and (c) other customers' outputs. You are responsible for ensuring that your use of Outputs complies with applicable law and does not infringe third-party rights; Xevyo does not guarantee that Outputs are non-infringing or that they are protectable by intellectual-property rights in your jurisdiction.

8.3 Non-uniqueness of Outputs

Due to the nature of machine learning, Outputs may not be unique, and the Services may generate the same or similar outputs for other users in response to similar inputs. Nothing in these Terms restricts Xevyo from generating any output for any other user, and the assignment above does not apply to outputs generated for others.

8.4 Grounding, citations, and tool activity

The Services are designed to ground answers in retrieved sources where available, to present citations only from tools that actually returned results, and to indicate failed tools rather than fabricate results. These are design objectives, not guarantees, and Clause 11 applies to all Outputs, including cited ones.

8.5 Use of your content by Xevyo

Xevyo processes User Content to operate the Services as described in the Privacy Policy, including automated routing, caching, safety screening, and abuse prevention. Xevyo does not use your prompts, conversations, uploaded documents, retrieval corpora, fine-tuning data, or Memory Records to train Xevyo models. By way of narrow exception, the following categories — each involving content deliberately contributed for that purpose or explicitly submitted as feedback, rather than your ordinary use of the Services — may be used to develop, evaluate, and improve the Services and Models: (a) Trainer Content, as described in Clause 14; (b) feedback you explicitly submit (such as ratings, reason tags, and the associated context snapshots), as described in Clause 22; and (c) data that has been de-identified or aggregated such that it no longer identifies you. You grant Xevyo a worldwide, non-exclusive, royalty-free licence to host, store, reproduce, process, transmit, display, and create technical copies of User Content solely as necessary to provide, secure, and support the Services and as permitted by this Clause.

9. Memory, Personalisation, and Custom Instructions

• The Services may extract and store Memory Records (such as preferences, profile facts, and, with your consent, health-related facts such as conditions, medications, and allergies) to personalise responses across sessions;
• You can view, edit, and delete Memory Records at any time through the Memory Manager;
• Sensitive health information is not persisted to memory without your consent, and you may withdraw consent at any time by deleting the relevant records or disabling memory features;
• Custom instructions and user-supplied system prompts shape how the Services respond; you are responsible for the content of your custom instructions and prompts, which must comply with Clause 19, and outputs influenced by your customisations remain subject to Clauses 10 and 11; and
• Proactive nudges and reminders are optional, opt-in features that can be muted or disabled, and do not constitute medical or professional monitoring or alerting.

10. Health, Wellness, and Medical Disclaimer

The Services include health-oriented capabilities, including medical question answering, symptom-related information, medication and interaction lookups, document analysis, health coaching, and fitness planning (including through BioSports and Biongevity). You acknowledge and agree that:

• The Services are not a medical device, are not certified or approved by any medical regulator, and are provided for informational and educational purposes only;
• Outputs do not constitute medical advice, diagnosis, or treatment, and no doctor–patient, therapist–patient, or other professional relationship is created by your use of the Services;
• You must always seek the advice of a qualified healthcare professional with any questions regarding a medical condition, medication, or treatment, and never disregard or delay seeking professional advice because of an Output;
• The Services are not an emergency service. If you or another person may be in danger or experiencing a medical or mental-health emergency, contact your local emergency number or a crisis service immediately. Emergency-detection and crisis-resource features are provided on a best-efforts, informational basis only and may fail to detect, or may incorrectly detect, an emergency;
• Medication, interaction, nutrition, and dosage information may be drawn from third-party databases that may be incomplete, outdated, or inaccurate, and calculators are informational utilities only;
• Fitness and exercise suggestions are not a substitute for professional assessment; consult a physician before beginning an exercise program, and stop and seek medical attention if you experience warning signs; and
• You are responsible for the accuracy of the health information you provide, and for keeping your profile (including conditions, medications, and allergies) current if you choose to use personalisation features.

11. Accuracy of Outputs; Human Oversight

Artificial intelligence is probabilistic. Notwithstanding grounding, citation, routing, and safety features, you acknowledge and agree that:

• Outputs may be inaccurate, incomplete, outdated, biased, or fabricated, notwithstanding a confident tone or the presence of citations;
• Outputs do not constitute professional advice of any kind — including medical, legal, financial, investment, tax, accounting, engineering, or safety advice — and must not be relied upon as such;
• You must independently verify Outputs before relying or acting upon them in any context where inaccuracy could cause harm, loss, liability, or legal or regulatory consequences, and you must apply qualified human review to any consequential decision;
• You shall not use the Services to make decisions producing legal or similarly significant effects concerning individuals (including employment, credit, insurance, housing, healthcare access, education, or immigration) without meaningful human review;
• Financial services: Outputs do not constitute investment advice, research, or recommendations, and you are responsible for all trading, credit, underwriting, and other financial decisions, required human oversight, and compliance with applicable financial-services regulation;
• Government, defence, and national security: you are solely responsible for ensuring that your use complies with applicable law, including the law of armed conflict and international humanitarian law; the Services shall not be used to autonomously select or engage targets or to operate weapons systems without qualified human authorisation and meaningful human control;
• Critical infrastructure and energy: the Services shall not be used as the sole control mechanism for safety-critical operational technology, and fail-safe engineering controls and qualified human supervision must remain in place; and
• Xevyo makes no representation or warranty as to the accuracy, completeness, reliability, or fitness of any Output.

12. Voice, Telephony, and Audio Features

Where you use voice features, your audio is transcribed and processed to provide the Services as described in the Privacy Policy. Where telephone or SMS access is available and you access the Services by telephone or SMS, standard carrier rates may apply, telephony metadata is processed by our telephony providers, and you consent to receiving automated responses over those channels. Do not use voice channels to submit emergency communications. You are responsible for complying with any laws applicable to your recording or submission of audio containing other people's voices.

13. Developer Interface (API) Terms

13.1 API keys and metering

Developer access is authenticated through per-user API keys. Full key values are displayed once at creation; you are responsible for their secure storage and for all usage under your keys. Per-key token metering and monthly budgets are enforced automatically, including by aborting in-progress streams when a budget is exceeded. You may create, rename, and revoke keys through the interface, and Xevyo administrators may revoke keys for security or compliance reasons.

13.2 Use of the APIs

You may use the Developer Interface solely in accordance with these Terms, the documentation, and published rate limits and technical requirements. You shall not: exceed documented rate limits or circumvent metering or quota enforcement; share keys across organisations; use one-time session-launch tokens other than for their intended single use; or attempt unauthorised access through the APIs.

13.3 Your applications

You may build applications, integrations, and agents that call the Services ("Your Applications"). You are solely responsible for Your Applications, including their security, legal compliance, end-user terms, and all content and decisions produced through them. Where Your Application is made available to others, you shall: impose use restrictions no less protective of Xevyo than these Terms; not represent Outputs as human-generated, and disclose the use of AI where required by law; implement human oversight appropriate to the risk of the use case; and remain fully liable to Xevyo for all use occurring through Your Applications and your keys.

13.4 API changes

Xevyo may version, modify, deprecate, or discontinue APIs upon reasonable notice, except where otherwise provided in an executed agreement, and will use commercially reasonable efforts to provide migration paths for materially deprecated interfaces.

14. Trainer Platform ("Train Your Own Xevyo")

14.1 Trainer accounts and Custom Instances

Verified trainers may create Custom Instances with a persona, knowledge base, and training materials, progressing through draft, training, review, published, and archived stages. Xevyo may establish verification, quality, and review requirements and may decline, suspend, unpublish, or remove any Custom Instance at its discretion, including for violations of these Terms or quality concerns.

14.2 Licence to Trainer Content; training rights

You retain ownership of your Trainer Content. You grant Xevyo a worldwide, non-exclusive, royalty-free, sublicensable licence to host, reproduce, process, adapt, and use Trainer Content to: (a) operate, display, and provide the applicable Custom Instance; and (b) train, fine-tune, evaluate, and improve Xevyo models, including through correction and preference (chosen/rejected) pairs captured during training sessions. This training licence survives termination with respect to models trained before termination, provided that Xevyo will cease using raw Trainer Content for new training upon your verified request or account deletion, subject to legal retention requirements. If you do not agree to this licence, do not use the Trainer Platform.

14.3 Trainer representations

You represent and warrant that: you have all rights and permissions necessary to submit Trainer Content and to grant the licence above; Trainer Content does not infringe third-party rights, violate confidentiality obligations, or contain personal data submitted without lawful basis; any expertise you claim is accurately described; and Trainer Content complies with Clause 19. Where a Custom Instance addresses regulated domains (such as health), you are responsible for the professional accuracy of your contributed knowledge, and end-user-facing disclaimers required by these Terms must not be removed.

14.4 Ownership of Custom Instances

As between the parties, you own your Trainer Content, and Xevyo owns the Models, the platform, all fine-tuned model weights and adaptations (including those derived from Trainer Content), and the software embodiment of Custom Instances. Your rights in a Custom Instance consist of the licence to operate and share it through the platform during the term of your participation, together with any revenue or attribution arrangements separately agreed in writing.

15. Plugins, Custom Functions, Tools, and Webhooks

The Services may allow you to author or connect custom functions, external tool servers, Model Context Protocol (MCP) servers, pipelines, and webhooks ("Extensions"), and may allow the assistant to invoke enabled tools automatically. You acknowledge and agree that:

• You are solely responsible for Extensions you author, enable, or connect, including their code, security, data handling, and legal compliance, and for reviewing what tools ran through the tool-activity features;
• Extensions may cause actions to be executed in external systems (for example, creating or deleting calendar events); you authorise such actions when you enable the relevant tool, and Xevyo strongly recommends restricting high-consequence actions;
• Third-party tool servers and data sources are governed by their own terms and privacy policies, and Xevyo is not responsible for them;
• Xevyo may scan, sandbox, rate-limit, suspend, or remove Extensions that pose security, legal, or abuse risks; and
• Extensions must not be used to circumvent quotas, safety systems, or the restrictions in Clause 19.

16. Third-Party Services and Data Sources

The Services interoperate with third-party services, including web search engines and content-retrieval providers; public and scientific data sources (such as regulatory drug databases, nutrition databases, research indexes, and environmental data); identity providers; payment processors; telephony providers; and cloud-storage import sources (such as Google Drive and OneDrive). Your use of third-party services through Xevyo is subject to the applicable third-party terms. Xevyo does not control, and is not responsible for, third-party services, their availability, or the accuracy of data they return. Where you connect Google services, Xevyo's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

17. Collaboration Features and User-Posted Content

Where you use channels, direct messages, shared notes, prompt libraries, or similar features, you are responsible for the content you post. You grant Xevyo a worldwide, non-exclusive, royalty-free licence to host, store, reproduce, and display such content solely as necessary to provide these features to you and to the users you share it with. Content you post must comply with Clause 19. Xevyo may, but is not obligated to, moderate, restrict, or remove content, and organisational administrators may control content within their tenant. Do not post content you have no right to share, including confidential information of third parties.

18. Copyright and Content Complaints

Xevyo respects intellectual-property rights and responds to notices of alleged infringement. If you believe content available through the Services infringes your copyright, submit a written notice to Xevyo's designated agent at [email protected] containing: identification of the work claimed to be infringed; identification and location of the allegedly infringing material; your contact information; a good-faith statement that the use is not authorised by the rights owner, its agent, or the law; a statement, under penalty of perjury, that the notice is accurate and that you are the owner or authorised to act for the owner; and your physical or electronic signature. Xevyo will remove or disable access to material as required by applicable law, may notify the affected user (who may submit a counter-notice where the law provides), and maintains a policy of terminating repeat infringers in appropriate circumstances. Complaints regarding other unlawful content may be submitted to the same address and will be handled in accordance with applicable law.

19. Acceptable Use; Prohibited Uses

You shall use the Services only for lawful purposes. You shall not, and shall not permit any Authorized User, application, or third party to, use the Services to:

19.1 Illegal and harmful uses

• Violate any applicable law or regulation, or facilitate criminal conduct;
• Create, request, store, or disseminate child sexual abuse material or any content that sexualises minors, whether real or synthetic;
• Facilitate the design, development, production, or acquisition of chemical, biological, radiological, nuclear, or conventional weapons in violation of applicable law;
• Develop, distribute, or deploy malware, ransomware, or exploits, or conduct unauthorised intrusion or cyberattacks against any system;
• Engage in fraud, phishing, identity theft, money laundering, sanctions evasion, or terrorist financing;
• Generate or disseminate disinformation, coordinated inauthentic behaviour, or content intended to interfere with democratic or electoral processes;
• Create non-consensual intimate imagery; impersonate real persons without disclosure and lawful basis; or generate deceptive synthetic media of identifiable individuals without their consent;
• Conduct unlawful surveillance, profiling, or social scoring of individuals; perform real-time remote biometric identification in publicly accessible spaces; build facial-recognition databases without data-subject consent; infer the emotions of individuals in workplace or educational settings (except for medical or safety reasons); or predict the risk of an individual committing a criminal offence based solely on profiling or personal traits;
• Harass, threaten, defame, or incite violence or hatred against any person or group;
• Provide regulated professional services (including medical diagnosis or treatment, legal representation, or licensed financial advice) to third parties without the required licences and qualified human responsibility; and
• Infringe or misappropriate the intellectual-property, privacy, or other rights of any third party.

19.2 Platform integrity and security

• Attempt unauthorised access to any account, system, model, or infrastructure, or circumvent authentication, encryption, quota, metering, moderation, or safety mechanisms, including through prompt injection or jailbreak techniques directed at the Services;
• Probe, scan, or test the Services for vulnerabilities without Xevyo's prior written authorisation;
• Conduct denial-of-service attacks, send excessive automated requests, or otherwise degrade the Services;
• Scrape, harvest, or bulk-extract content, Outputs, or data from the Services except through the documented APIs and within documented limits; or
• Misuse signed media URLs, session tokens, or access codes, or resell or transfer access to the Services except as expressly authorised.

19.3 Model protection and competitive misuse

• Use the Services or Outputs to train, fine-tune, calibrate, distil, or otherwise develop or improve any artificial-intelligence or machine-learning model, other than through features Xevyo expressly provides for that purpose;
• Systematically extract Outputs, embeddings, logits, or token probabilities for model imitation, replication, or benchmarking of a competing system;
• Reverse engineer, decompile, or attempt to derive the architecture, weights, hyperparameters, or training data of the Models, except to the extent such restriction is prohibited by applicable law;
• Remove, alter, or forge attribution, watermarks, signatures, or provenance metadata associated with Outputs or media; or
• Publish benchmarks or evaluations of the Models to third parties without Xevyo's prior written consent, except where such restriction is prohibited by applicable law.

Xevyo may screen Inputs and generated media using automated safety systems and may block requests that violate safety policies, as such systems are deployed. Xevyo reserves the right to suspend or terminate access, remove content, and notify competent authorities where legally required or where reasonably necessary to prevent serious harm, protect the Services or other users, or comply with law.

20. Licence to the Services; Restrictions

Subject to your compliance with these Terms and payment of applicable fees, Xevyo grants you a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence during the Subscription Term to access and use the Services for your internal purposes (or, for individuals, your own personal or professional use) in accordance with these Terms and the documentation. The Services are licensed, not sold; no ownership rights are transferred; and all rights not expressly granted are reserved by Xevyo. Except as expressly authorised, you shall not copy, modify, distribute, sublicense, lease, rent, resell, or create derivative works of the Services, or remove proprietary notices.

21. Enterprise and Sovereign Deployments

Where a Customer purchases an Enterprise Deployment (on-premises, sovereign-cloud, or air-gapped), the following additional terms apply and prevail over conflicting provisions of these Terms with respect to that deployment:

• 21.1 Deployed software and model weights: Xevyo grants a limited, non-exclusive, non-transferable, non-sublicensable licence during the Subscription Term to install and execute the deployed software, including model weights in encrypted form, solely within the environment, instance counts, and scope specified in the applicable Order Form, and solely for the Customer's internal operations. The model weights are the core proprietary technology, Confidential Information, and trade secrets of Xevyo, are licensed and not sold, and are bound to the hardened runtime; the Customer shall not decrypt, extract, dump, quantize, convert, re-host, or attempt to access the weights outside the runtime, and shall protect the deployed software with no less than reasonable care and no less rigour than it protects its own most sensitive information;
• 21.2 Zero telemetry: Enterprise Deployments are engineered to transmit no usage telemetry, diagnostics, or customer content to Xevyo and require no outbound connectivity to operate; updates for air-gapped environments are delivered as signed offline bundles, and the Customer is responsible for timely installation;
• 21.3 Customer responsibility for environment: the Customer is solely responsible for the security, lawful operation, administration, governance configurations, and use of its deployment, including compliance with laws applicable to its sector, and Xevyo has no visibility into, and no responsibility for monitoring, the Customer's use;
• 21.4 Tenant governance and refusal configuration: refusal behaviour, sensitive-topic handling, and output policies are configurable per tenant so that the deployment reflects the Customer's governance. Default configurations are a baseline only; where the Customer modifies or relaxes safety behaviours, the Customer assumes sole responsibility for the consequences of its configurations, which must comply with applicable law and Clause 19, and Xevyo does not warrant that any configuration will prevent all undesirable or unlawful outputs;
• 21.5 Provenance and audit: output provenance and audit features, where enabled — including signed output lineage, retrieval-source citations, tool-call logs, and audit trails generated within the Customer's deployment — are Customer-owned and exportable; the underlying signing schemas, keys, and infrastructure remain Xevyo's property, and the Customer shall not remove, alter, forge, or misattribute provenance records or output signatures. The Customer is responsible for the retention, integrity, and evidentiary handling of such records for its own legal and regulatory purposes;
• 21.6 Usage verification: not more than once per twelve (12) months and on at least thirty (30) days' written notice, Xevyo may require written certification of deployment scope against the applicable Order Form; excess use shall be promptly paid for, material or wilful excess use is a material breach, and nothing in this provision requires the Customer to give Xevyo access to customer content or classified environments;
• 21.7 Termination: upon termination or expiration, the Customer shall cease all use and, within thirty (30) days, permanently destroy all copies of the deployed software, model weights, and adaptations, and shall certify destruction in writing upon request; and
• 21.8 Order of documents: an executed MSA and Order Form govern Enterprise Deployments and prevail over these Terms to the extent of any conflict.

22. Intellectual Property; Feedback and Ratings

The Services — including the Models, model weights, software, source and object code, routing and orchestration systems, user interfaces, designs, documentation, trademarks, and all improvements and derivatives — are and remain the exclusive property of Xevyo and its licensors. You may not use the Xevyo name, logos, or other brand identifiers without Xevyo's prior written consent or published brand guidelines, and you may not make any statement or design choice that could reasonably lead a third party to believe that your application, Custom Instance, or content is created, certified, or endorsed by Xevyo unless Xevyo has agreed in writing.

You may provide feedback, including thumbs ratings, scores, reason tags, bug reports, evaluation-arena votes, and suggestions ("Feedback"). You acknowledge that when you rate a response, an immutable snapshot of the rated message, the preceding conversational context, and routing metadata may be captured with the rating. You grant Xevyo a perpetual, irrevocable, worldwide, royalty-free, transferable, sublicensable licence to use Feedback — including such snapshots — to operate, evaluate, and improve the Services and Models, without restriction or compensation. Do not include third-party confidential information in Feedback.

23. Open Source Software

Certain components of the Services may incorporate open-source software subject to their respective licence terms, which govern with respect to such components to the extent of any conflict. Nothing in any open-source licence extends to the Models or model weights, which are proprietary. A list of applicable open-source components may be made available in the documentation, with the deployed software, or upon request.

24. Beta and Experimental Features

Xevyo may make pre-release, beta, preview, pilot, or experimental features or model versions available. These may not operate correctly, may produce degraded or unexpected Outputs, may be modified or discontinued at any time, may not be supported, are excluded from any service-level commitments, and, unless otherwise agreed in writing, are provided "as is" and "as available" without warranties of any kind. Do not use beta features in production or for consequential decisions.

25. Support; Updates; Service Availability

Support levels, response times, and availability commitments, if any, are as set forth in your plan or the applicable Order Form, MSA, or Service Level Agreement. Xevyo may deploy software updates, security patches, model version changes, and feature changes; model behaviour may change between versions. The Services may be temporarily unavailable due to maintenance, security incidents, capacity constraints, infrastructure events, third-party outages, or force majeure. Health indicators may show integrations as temporarily unavailable, in which case the corresponding capabilities are suspended rather than simulated.

26. Suspension

Xevyo may suspend access to all or part of the Services immediately where reasonably necessary to: protect system security or integrity; prevent fraud, abuse, or serious harm; investigate suspected material violations of these Terms; comply with applicable law or governmental orders; address non-payment after reasonable notice; or perform emergency maintenance. Where practicable, Xevyo will provide notice and work with you to resolve the underlying issue. If you believe your account has been suspended or restricted in error, you may appeal by contacting [email protected], and Xevyo will review the appeal within a reasonable period.

27. Termination; Effect of Termination

You may stop using the Services at any time and may request deletion of your Account by writing to [email protected] or, for organisation-managed accounts, to your organisation's administrator; verified deletion requests will be actioned within a reasonable period in accordance with the Privacy Policy. Either party may terminate these Terms immediately upon written notice if the other party materially breaches and fails to cure within thirty (30) days after notice (or immediately, in the case of breaches of Clauses 19, 21, or 22, or breaches incapable of cure), becomes insolvent, or ceases operations. Xevyo may terminate free-tier access upon reasonable notice. If Xevyo discontinues the Services entirely, Xevyo will provide advance notice and a pro-rata refund of prepaid fees for the unused portion of any paid subscription.

Upon termination or expiration: all licences granted to you terminate and you shall cease use of the Services; you may request an export of your data by writing to [email protected], or export it as otherwise described in the Privacy Policy, and, for paid enterprise arrangements, for at least thirty (30) days following termination (except where termination results from unlawful conduct or a governmental order requires otherwise); after the applicable window, Xevyo may delete your content in accordance with the Privacy Policy and its retention schedules, unless retention is required by law; accrued fees remain payable; and provisions intended by their nature to survive — including Clauses 8.2, 8.5, 10, 11, 14.2, 18 through 23, and 27 through 34 — survive termination.

28. Limited Warranty; Disclaimers

For paid enterprise subscriptions, Xevyo warrants that, during the applicable Subscription Term, the Services will materially conform to the documentation when used in accordance with these Terms; the exclusive remedy for breach of this warranty is, at Xevyo's option, correction of the non-conformity, a reasonable workaround, or termination of the affected Services and a refund of prepaid fees for the unused portion of the affected subscription.

Except as expressly provided in these Terms or an executed agreement, and to the maximum extent permitted by applicable law, the Services, the Models, and all Outputs are provided "as is" and "as available", and Xevyo disclaims all other warranties, whether express, implied, statutory, or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, uninterrupted operation, and error-free performance. Without limiting the foregoing, Xevyo does not warrant that: Outputs will be accurate, complete, reliable, current, lawful for your intended use, or free of bias or fabrication; the Services will meet your requirements or regulatory obligations; or that all security threats or adversarial attacks, including prompt-injection and jailbreak attempts, can be prevented. Nothing in these Terms excludes or limits any warranty or right that cannot lawfully be excluded or limited, including non-waivable rights under applicable consumer-protection law.

29. Limitation of Liability

To the maximum extent permitted by applicable law, in no event shall Xevyo or its affiliates, directors, officers, employees, agents, or licensors be liable for any indirect, incidental, consequential, special, exemplary, or punitive damages; loss of profits, revenue, business opportunities, or goodwill; loss of data or loss of use; business interruption; procurement of substitute services; or damages arising from your use of or reliance upon Outputs, from health or wellness decisions, or from actions executed through tools, Extensions, or Your Applications, arising out of or relating to the Services, even if advised of the possibility of such damages.

Except for liability that cannot be excluded or limited under applicable law, Xevyo's total aggregate liability arising out of or relating to these Terms shall not exceed the greater of: (a) the total fees paid or payable by you to Xevyo for the Services giving rise to the claim during the twelve (12) months immediately preceding the event giving rise to the claim; or (b) the fixed amount of USD 100, which applies in particular where no fees have been paid or are payable.

The foregoing limitations do not apply to liability arising from fraud or wilful misconduct, or to other liability that cannot lawfully be limited or excluded (including, where applicable, liability for death or personal injury caused by negligence). The limitations apply regardless of the theory of liability and notwithstanding the failure of any limited remedy of its essential purpose. The parties acknowledge that the fees (including free access) reflect this allocation of risk. Xevyo's affiliates, licensors, and service providers are intended third-party beneficiaries of the disclaimers in Clause 28 and the limitations in this Clause 29.

30. Indemnification

To the maximum extent permitted by applicable law, you shall defend, indemnify, and hold harmless Xevyo, its affiliates, and their respective officers, directors, employees, and agents from and against third-party claims, and resulting damages, liabilities, penalties, costs, and reasonable attorneys' fees, arising out of or relating to: (a) your Inputs, Trainer Content, posted content, or Extensions; (b) your use of the Services or Outputs in violation of these Terms or applicable law; (c) Your Applications and actions executed through tools you enabled; (d) decisions made or actions taken by you or your end users in reliance upon Outputs; and (e) your breach of these Terms. Xevyo will provide prompt notice of any such claim and reasonable cooperation, and reserves the right to participate in the defence at its own expense; you shall not settle any claim imposing non-monetary obligations on Xevyo without Xevyo's prior written consent. This Clause does not apply to consumers to the extent prohibited by applicable consumer-protection law.

31. Export Controls, Sanctions, and Anti-Corruption

The Services, deployed software, and model weights may be subject to export-control laws, including those governing advanced computing and artificial-intelligence items, and to economic sanctions programs. You shall not export, re-export, transfer, or provide access to the Services or deployed software in violation of such laws; permit access by sanctioned or denied parties or from embargoed jurisdictions; use the Services in connection with prohibited end uses, including weapons of mass destruction; or relocate an Enterprise Deployment to another jurisdiction without Xevyo's prior written consent and required authorisations. You represent that you are not a sanctioned or denied party and shall promptly notify Xevyo if that changes. Each party shall comply with applicable anti-bribery and anti-corruption laws, and neither party shall offer, promise, authorise, solicit, or accept any improper payment or advantage in connection with these Terms.

32. Compliance with Laws; AI Regulatory Allocation

You shall use the Services in compliance with all laws applicable to you, including those relating to data protection and privacy, artificial intelligence and automated decision-making, healthcare information, cybersecurity, intellectual property, export controls, consumer protection, and your industry-specific regulatory requirements. You are solely responsible for determining whether the Services satisfy your legal and regulatory obligations; nothing in these Terms or the documentation constitutes legal, regulatory, or compliance advice. Where AI-specific legislation (such as the EU Artificial Intelligence Act) applies to your deployment or use, you are responsible for the obligations attaching to your role as a deployer (or as a provider, where you place a system on the market under your own name or substantially modify it), including use-case classification, required assessments, human-oversight arrangements, and transparency obligations arising from your specific use; Xevyo provides model and system documentation, provenance features, and an identity-disclosure endpoint to support your compliance.

33. Governing Law; Dispute Resolution; Equitable Relief

These Terms, and all disputes arising out of or relating to them or the Services, shall be governed by and construed in accordance with the laws of the Province of Alberta and the federal laws of Canada applicable therein, without giving effect to conflict-of-laws principles. The parties shall first attempt in good faith to resolve any dispute through informal negotiation for at least thirty (30) days after written notice of the dispute. Thereafter, unless otherwise agreed in an executed agreement, the courts located in Calgary, Alberta, Canada shall have exclusive jurisdiction, and each party irrevocably submits to the personal jurisdiction of such courts and waives any objection based on inconvenient forum. Nothing in this Clause deprives a consumer of the protection of mandatory provisions, or of the right to bring proceedings in the courts, of the jurisdiction in which the consumer habitually resides where such right is conferred by law. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

You acknowledge that unauthorised use or disclosure of the Models, model weights, deployed software, or Xevyo's Confidential Information or intellectual property would cause irreparable harm for which monetary damages would be inadequate, and that Xevyo shall be entitled to seek temporary, preliminary, or permanent injunctive relief and specific performance, in addition to all other remedies.

34. General Provisions

34.1 Confidentiality

Each party shall protect the other party's non-public information received in connection with the Services with no less than reasonable care, use it solely to perform under these Terms, and restrict disclosure to those with a need to know who are bound by obligations at least as protective. The Models, model weights, and deployed software are deemed Xevyo's Confidential Information and trade secrets regardless of marking. These obligations survive termination for five (5) years and, for trade secrets, for so long as the information remains a trade secret under applicable law. A party may disclose Confidential Information to the extent required by law, with prompt notice to the other party where legally permitted.

34.2 Entire agreement; order of precedence

These Terms, together with the applicable Order Form, MSA, Data Processing Addendum, Privacy Policy, Responsible Use Policy, Service Level Agreement, and any other expressly incorporated documents, constitute the complete agreement between the parties regarding the subject matter and supersede all prior or contemporaneous proposals and understandings. In the event of conflict, the following order of precedence applies unless expressly stated otherwise: (1) the executed MSA; (2) the executed Order Form; (3) the Data Processing Addendum (for data-protection matters); (4) the Service Level Agreement (for availability commitments); (5) these Terms; (6) the Responsible Use Policy; (7) the Privacy Policy; and (8) other published policies.

34.3 Assignment; waiver; severability

You may not assign, transfer, delegate, or sublicense any rights or obligations under these Terms, in whole or in part, without Xevyo's prior written consent; any prohibited assignment is null and void. Xevyo may assign these Terms in connection with a merger, acquisition, restructuring, sale of substantially all assets, financing, or transfer to an affiliate. Failure to enforce any provision is not a waiver; waivers must be in writing and signed. If any provision is held invalid or unenforceable, the remaining provisions remain in full force, and the invalid provision shall be modified to the minimum extent necessary to be enforceable while achieving its intent.

34.4 Relationship; no third-party beneficiaries; force majeure

The parties are independent contractors; these Terms create no partnership, joint venture, agency, fiduciary, or employment relationship. Except as expressly provided in these Terms (including Clause 29), no third party has any right or remedy under these Terms. Neither party is liable for delay or failure to perform (other than payment obligations) caused by events beyond its reasonable control, including natural disasters, pandemics, war, terrorism, civil unrest, labour disputes, governmental actions, utility or telecommunications failures, and third-party cyberattacks that could not reasonably have been prevented; the affected party shall use commercially reasonable efforts to mitigate and resume performance.

34.5 Notices; electronic communications

Legal notices shall be in writing and delivered by nationally recognised courier, registered mail, or email to the designated legal contact. Notices to Xevyo: Legal Department, XEVYO TECHNOLOGIES INC., 330 5 Ave SE #1010, Calgary, Alberta, Canada, email [email protected]. You consent to receiving notices, disclosures, and records electronically, and, where permitted by law, electronic signatures have the same effect as handwritten signatures.

35. Grievances and Contact

Questions, complaints, or grievances regarding these Terms or the Services may be directed to the Legal Department, XEVYO TECHNOLOGIES INC., 330 5 Ave SE #1010, Calgary, Alberta, Canada.

• Legal: [email protected]
• General support: [email protected]
• Website: xevyo.com

Where applicable law requires the designation of a grievance or compliance officer, the current designation and contact details are set out in the Privacy Policy or published on the website. We will make reasonable efforts to acknowledge and respond to inquiries, complaints, or notices within the timeframes required by applicable law.

1. Purpose & Scope

This Acceptable Use Policy ("AUP") sets out the rules for using Xevyo's conversational AI platform, mobile and web applications, developer API, and the "Train Your Own Xevyo" Trainer platform (together, the "Services"). It applies to every person and organisation that accesses the Services — including free, paid, enterprise, developer (API key), administrator, and Trainer accounts — and it is incorporated by reference into our Terms of Use. Violating this AUP may result in warning, suspension, rate-limiting, or termination of access, as described in Section 8.

2. General Prohibited Conduct

You may not use the Services to:

• Violate any applicable law or regulation, or the rights of any third party (including intellectual-property, privacy, or publicity rights);
• Generate, upload, or distribute child sexual abuse material, or content that sexualises minors in any way;
• Threaten, harass, defame, stalk, or incite violence against any individual or group;
• Create or facilitate malware, ransomware, exploits, or other code intended to damage, disrupt, or gain unauthorised access to any system;
• Generate content designed to deceive — including impersonation of real people, non-consensual intimate imagery, or coordinated disinformation campaigns;
• Upload or transmit viruses, or attempt to disable, overburden, or impair the Services (e.g., denial-of-service activity); or
• Send unsolicited bulk messages or spam, or use the Services for automated outreach that violates applicable messaging or telemarketing laws (including via the Twilio voice/SMS channel).

3. AI- and Model-Specific Restrictions

Because Xevyo generates content and can take agent actions on your behalf, additional rules apply:

• No attempts to bypass, disable, or manipulate safety systems — including prompt injection, jailbreak techniques, or adversarial inputs directed at our routing, moderation (SHIELD), or PHI-redaction safeguards;
• No use of the assistant, voice channel, image generation, or document generation to produce content that would be prohibited if a human created it directly (e.g., weapons or CBRN guidance, malicious code, CSAM, extremist recruitment material);
• No reliance on Xevyo's medical, symptom-triage, or crisis-response features as a substitute for professional diagnosis, treatment, or emergency services; red-flag/crisis responses are informational and do not replace calling local emergency services;
• No attempts to extract, reverse-engineer, distil, or replicate the underlying model weights, training data, or system prompts of Xevyo's proprietary model fleet (e.g., NEXUS, VITAL, SPARK, SHIELD) through systematic querying or other means;
• No large-scale automated scraping of outputs for the purpose of training or fine-tuning a competing model, except as expressly permitted under a separate written agreement; and
• No misuse of agent tools (code execution, web search/page fetch, knowledge retrieval, calendar/health-data connectors, custom functions/plugins, MCP tool servers) to access systems, accounts, or data you are not authorised to access.

4. Developer API & Trainer Platform Use

If you hold a developer API key ("xk-…") or a Trainer account, you additionally agree to:

• Keep your API keys and Trainer credentials confidential; you are responsible for all activity under your keys and must revoke and rotate a key immediately if it is exposed;
• Stay within your per-key monthly token budget and applicable rate limits, and not attempt to circumvent quota enforcement or token metering;
• Not resell, sublicense, or provide standalone access to the API or a Trainer-created custom Xevyo instance to third parties without our prior written consent;
• Ensure any custom Xevyo instance, persona, or knowledge base you publish through the Trainer platform is accurate to the best of your knowledge, does not misrepresent affiliation with Xevyo or any third party, and complies with this AUP; and
• Not use the identity-disclosure endpoint or API access to misrepresent an automated agent as a human where such disclosure is legally required.

5. Security & Platform Integrity

You may not:

• Attempt to gain unauthorised access to another user's or tenant's account, chats, memory, knowledge base, or data, or to any non-public part of the Services;
• Probe, scan, or test the security of the Services (penetration testing, vulnerability scanning, fuzzing) except in accordance with our Responsible Disclosure Policy;
• Circumvent authentication, SSO, LDAP, or SCIM provisioning controls, or interfere with role-based access control (User / Admin / Reviewer / Trainer / Super-Admin) boundaries; or
• Use the Services to store or transmit protected health information (PHI) or other regulated data in a manner inconsistent with our Privacy Policy and applicable law, or attempt to force PHI into memory in violation of the PHI write-block safeguard.

6. Content Responsibility

You are responsible for the prompts, files, and other content you submit to the Services, and for how you use the Services' outputs. Xevyo applies automated safeguards (content-safety screening, false-premise correction, medication-safety prefixes), but these do not guarantee that every output is accurate, complete, or appropriate for your use case — you should independently verify important outputs, particularly medical, legal, or financial content, before relying on them.

7. Enterprise, Admin & Group Accounts

Administrators and Super-Admins are responsible for ensuring that users provisioned under their organisation (via invite, LDAP group mapping, or SCIM) comply with this AUP. Admin "break-glass" access to user chats is logged, audited, and DPO-notified, and must only be used for legitimate support, security, or compliance purposes consistent with our Privacy Policy — never to monitor users outside those purposes.

8. Enforcement

Depending on the severity and nature of a violation, we may, at our discretion:

• Issue a warning and request corrective action;
• Rate-limit, suspend, or revoke specific API keys, plugins, or tool access;
• Suspend or terminate the account or tenant, with or without notice;
• Remove or disable access to specific content, knowledge bases, or Trainer-published Xevyo instances; or
• Preserve and, where legally required, report content or account information to law enforcement (e.g., content involving CSAM or imminent harm).

We will generally aim to notify account owners of enforcement action and the reason for it, except where doing so would be unlawful, would compromise an investigation, or could enable further harm.

9. Reporting a Violation

If you become aware of a violation of this AUP — including misuse of the API, a Trainer-published Xevyo instance, or abusive content — please report it to [email protected] or by post to XEVYO TECHNOLOGIES INC., 330 5 Ave SE #1010, Calgary, Alberta, Canada.

10. Relationship to Other Policies

This AUP works together with our Terms of Use, Privacy Policy, Cookie Policy, and Responsible Disclosure Policy. In the event of a conflict specifically about permitted use of the Services, this AUP controls; in all other respects, the Terms of Use govern.

11. Changes to This Policy

We may update this AUP from time to time to address new features, risks, or legal requirements. We will update the "Last updated" date above and, for material changes, provide reasonable notice.

1. Our Commitment to Security

Xevyo runs a self-hosted conversational AI platform — including our own model-serving infrastructure, developer API, enterprise identity integrations (SSO, LDAP, SCIM), and the Trainer platform — and we take the security of that infrastructure and our users' data seriously. We welcome reports from independent security researchers who discover potential vulnerabilities and follow the guidelines in this Responsible Disclosure Policy ("Policy"). If you believe you have found a security vulnerability in any Xevyo-operated system, we ask that you report it to us privately, in good faith, and give us a reasonable opportunity to investigate and remediate before any public disclosure.

2. Scope

2.1 In scope

• qa.xevyo.com and other production Xevyo web/mobile applications;
• The Xevyo developer API (/v1 and /v2 endpoints), including authentication, API-key management, and token-metering systems;
• The Trainer platform (custom Xevyo creation, knowledge ingestion, correction/DPO capture);
• Identity and access management flows: SSO (Google/GitHub OAuth), local and LDAP authentication, SCIM provisioning, and role-based access control;
• Media, document, and knowledge-base upload/retrieval pipelines (signed media URLs, file ingestion, vector-store retrieval); and
• Billing and webhook endpoints (e.g., Stripe webhook handling), to the extent they are Xevyo-operated.

2.2 Out of scope

• Third-party services we integrate with but do not operate, including Stripe, Google (OAuth/Calendar/Health Connect/Fit/Drive), Microsoft OneDrive, GitHub, and Twilio — please report vulnerabilities in those platforms directly to the respective provider;
• Denial-of-service or resource-exhaustion testing, load testing, or spam/social-engineering attacks against Xevyo staff, users, or contractors;
• Automated vulnerability scanning that generates high volumes of traffic without prior coordination with us;
• Physical security testing of Xevyo or third-party (e.g., data-center/cloud-provider) facilities;
• Vulnerabilities that require physical access to a user's unlocked device, or that rely on already-compromised credentials;
• Findings solely related to missing security headers or best-practice hardening without a demonstrated, exploitable impact; and
• Attempts to extract model weights, training data, or proprietary system prompts from our model fleet (governed instead by our Acceptable Use Policy).

3. Guidelines for Researchers

To qualify for safe harbor under this Policy, you must:

• Act in good faith and avoid privacy violations, data destruction, and service interruption during your research;
• Only interact with test accounts you own or accounts you have explicit permission to test; never access, modify, or exfiltrate another user's data — including chats, memory, uploaded documents, or PHI. If you inadvertently access such data, stop immediately and report it to us without retaining or further reviewing it;
• Limit any proof-of-concept to the minimum necessary to demonstrate the vulnerability (e.g., one record, not a bulk export);
• Avoid automated scanning that could degrade service availability for other users; throttle your testing and stop if you notice service impact;
• Not exploit a vulnerability beyond what is necessary to confirm it (e.g., no lateral movement, persistence, or privilege escalation beyond proof-of-concept);
• Give us a reasonable time to investigate and remediate (see Section 5) before disclosing the issue publicly or to any third party; and
• Not use social engineering, phishing, or physical attacks against Xevyo personnel, contractors, or users.

4. How to Report a Vulnerability

Please send a report to our security team at [email protected] with as much of the following detail as possible:

• A clear description of the vulnerability and its potential impact;
• Step-by-step reproduction instructions, including affected URLs, API endpoints, request/response examples, and any tools used;
• Proof-of-concept code or screenshots, where applicable (redacted of any other user's personal data);
• Your assessment of severity, and any suggested remediation; and
• Whether the issue has been shared with, or discovered by, anyone else.

5. What to Expect From Us

• Acknowledgment of your report: within 3 business days;
• Initial triage / validity assessment: within 10 business days;
• Status updates while we remediate: approximately every 2 weeks, or on request; and
• Notification once resolved: upon deployment of a fix, with your permission to coordinate disclosure timing.

Timelines depend on the complexity and severity of the issue. Critical vulnerabilities with active exploitation risk will be prioritised and may be remediated faster; we will keep you informed throughout.

6. Safe Harbor

Xevyo will not pursue civil or criminal legal action, or report you to law enforcement, for good-faith security research that: is conducted in accordance with this Policy and stays within the defined scope; and does not involve intentional harm to Xevyo, its users, or its systems, and does not violate any other applicable law (e.g., laws protecting the privacy of third parties). If legal action is initiated by a third party against you for activities conducted in good-faith compliance with this Policy, we will take reasonable steps to make it known that your actions were authorised under this Policy.

7. Recognition

We are grateful to researchers who help keep Xevyo and its users safe. With your permission, we are happy to credit you on a security acknowledgments page once a validated issue has been remediated. Xevyo does not currently operate a paid bug-bounty program; monetary rewards, where offered, are made at our sole discretion.

8. Coordinated Disclosure

We ask that you keep any vulnerability details confidential until we have deployed a fix and confirmed with you that public disclosure is appropriate. We aim to resolve valid critical and high-severity issues within 90 days of a validated report; if remediation will take longer, we will work with you on a mutually agreed disclosure timeline.

9. Changes to This Policy

We may update this Responsible Disclosure Policy from time to time to reflect changes to our infrastructure, scope, or process. We will update the "Last updated" date above when we do.

10. Contact

• Security reports: [email protected]
• General inquiries: [email protected]
• Postal address: XEVYO TECHNOLOGIES INC., 330 5 Ave SE #1010, Calgary, Alberta, Canada