Privacy Policy
The short version
- We collect what we need to run Xybernetex: your email and name, the decisions you work on, and basic technical logs.
- We don't sell your information, show ads, use analytics or tracking tools, or build profiles of you.
- To produce results, what you write and attach is processed by our AI provider (Cloudflare Workers AI). Web research queries go to Tavily. We don't use your content to train AI models.
- The app uses one cookie, to keep you signed in. The product site uses none.
- You can ask us to access, export, correct or delete your information at chris@xybernetex.com.
- Who we are
- What we collect
- How we use it
- AI processing
- Who we share it with
- Cookies and browser storage
- How long we keep it
- Security
- Where it's processed
- Your rights
- EU and UK users
- US state privacy rights
- Children
- Changes
- Contact
1. Who we are
Xybernetex is operated by Xybernetex Systems LLC, a Utah limited liability company with its address at 2427 Jefferson Ave, Apt C104, Ogden, UT 84401, USA ("Xybernetex", "we", "us"). We are the controller of the personal information described here. This policy covers our product site at xybernetex.com and our application at app.xybernetex.com (together, the "Service").
If your organisation invited you to work on a decision, your organisation decides what goes into that decision. For questions about that content, start with whoever invited you. For anything about your account or this policy, contact us.
2. What we collect
When you visit xybernetex.com
- Technical logs: your IP address, browser type, the page requested and the time. Our servers record these automatically to keep the Service running and secure.
- Access requests: if you use the request-access form, we get your name, email, company and anything you write in the message.
When you have an account
- Account details: your email address, your name, your role, when you joined and when you last signed in, whether you've confirmed your email address, and, if you choose to set one, a password (stored only as a salted one-way hash, never in readable form). If you start or join a team: its name, who is on it, and each person's role.
- Sign-in records: the browser (user agent) of each signed-in session, when it began, whether by password or email link, and when it was last used (you can see and end these on your account page). Sign-in links, session cookies and passwords are stored only as one-way hashes, never in readable form.
- Invitations: who invited whom, and when the invitation was accepted.
Your content
- Decisions: what you write, the options, criteria, limits and numbers, and the results and analysis we compute.
- Files you attach: their text, a fingerprint (SHA-256), who they're from, and when they were added.
- People named on a decision: names, email addresses and job titles that a decision's owner adds for sign-off.
- Declarations of interests: interests people declare in the parties to a decision. These can include financial interests, past employment, personal relationships, and gifts or hospitality. Rulings on them (recused, managed, immaterial) are kept too.
- Sign-offs and the audit trail: proposals, approvals and objections with notes and times, and a record of each step that shaped the decision, attributed to the signed-in person.
Usage information
- For each decision: which AI features ran, how many tokens they used and what they cost, and when key steps first happened (for example, when a model was first built). We use this to run the Service, to understand its cost, and to make it faster.
We don't ask for special categories of personal data. Please don't put health, biometric or similar sensitive information about anyone into a decision unless you need to and have the right to.
3. How we use it
- To provide the Service: running your decisions, computing results, producing documents and evidence packs.
- To send sign-in links, invitations, and messages about your account or a decision you're named on.
- To keep the Service secure: rate-limiting sign-in requests, refusing requests from other websites, investigating abuse.
- To respond to access requests and support questions.
- To understand cost and performance and improve the Service. We use counts and timings for this, not the contents of your decisions.
- To meet legal obligations.
We do not sell personal information. We don't share it for targeted advertising, use it to profile you, or make decisions about you that have legal or similarly significant effects.
4. AI processing
Xybernetex uses large language models to draft the structure and numbers of a decision. When you use those features, we send the relevant text (what you've written, extracts of files you've attached, and the question being asked) to Cloudflare Workers AI, which runs the model and returns the result. All calculations happen on our own servers in plain code.
When you or the Wizard run web research, search queries based on your decision are sent to Tavily, and the pages it returns are read to find supporting quotes. Queries can include names of options, vendors or figures from your decision. In the Wizard, you can turn research off or have it ask you first.
We do not use your content to train AI models. We send only what's needed to produce the result you asked for.
5. Who we share it with
People you work with
A decision is visible to its owner and to the people the owner names on it by email. Those people can read the decision and see the declarations and sign-offs on it. Their declarations and signatures are visible to the owner and the other people named. Evidence packs you download contain the decision, its sources and its audit trail, and you control who you share them with.
Service providers
We use these providers to run the Service. They process personal information on our behalf and only for that purpose.
| Provider | What for | What they receive |
|---|---|---|
| OVHcloud (US East, Virginia) | Server hosting | Everything stored by the Service |
| Cloudflare | Domain name service (DNS); AI model inference (Workers AI) | DNS lookups; the text sent for AI processing (section 4) |
| Resend | Sending email | Email addresses, names, and the content of sign-in and invitation emails |
| Tavily | Web search for research | Search queries (section 4) |
| Google Fonts | Typefaces for our pages | Your IP address and browser details when a page loads its fonts |
| jsDelivr and cdnjs | Delivering open-source code our pages use, such as the text editor | Your IP address and browser details when a page loads that code |
We'll update this list before we start using a new provider that handles personal information.
Other cases
We may disclose information where the law requires it, to protect the rights, property or safety of our users, the public or us, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply. We'll tell you when we can.
6. Cookies and browser storage
The app sets a single cookie, xde_session, which keeps you signed in. It is strictly necessary, so it doesn't need consent.
The product site sets no cookies. The app also saves a few preferences and drafts in your browser's local storage; these never leave your device.
The Cookie Notice has the full list.
7. How long we keep it
| Information | Kept for |
|---|---|
| Account details | While your account is open; deleted within 30 days of a deletion request or of closing your account |
| Decisions and their content | Until the decision's owner deletes it, or the owner's account is deleted |
| Passwords | While your account is open, or until you change it (only a hash is kept) |
| Sign-in links | 15 minutes (they expire, and work only once) |
| Signed-in sessions | 30 days, or until you sign out |
| Access requests | Until we respond, then up to 12 months |
| Server logs | Up to 30 days |
| Backups | 14 days on a rolling basis, so deleted information leaves our backups within 14 days |
A note on the audit trail. While a decision exists, its audit trail can only be added to: entries can't be edited or removed. That's what makes a sealed decision trustworthy. Deleting the decision deletes its trail as well. If you're named on a decision you don't own and want your information removed from it, contact us and the decision's owner, and we'll work out what can be done while keeping the record honest.
8. Security
All traffic to the Service is encrypted with HTTPS. You can sign in with a one-time email link or with a password, and links, session cookies and passwords are stored only as one-way hashes (passwords with a salt, using scrypt). Password guessing is rate-limited. Cookies are HttpOnly and Secure. The server accepts web traffic only through HTTPS, and only the people who run Xybernetex can reach it otherwise. No system is perfectly secure. If we learn of a breach that affects your personal information, we'll notify you and the authorities as the law requires.
9. Where it's processed
Our servers are in the United States. Some of our providers may process information in other countries. If you're outside the US, your information is transferred to the US. Where the law requires a safeguard for that transfer, we rely on appropriate mechanisms such as the European Commission's Standard Contractual Clauses.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you, and get a copy in a portable format;
- correct information that's wrong;
- delete your information;
- object to or restrict how we use it;
- withdraw consent, where we rely on consent.
Email chris@xybernetex.com to use any of these rights. We'll confirm who you are, usually by replying to the email address on your account, and respond within 30 days (45 days where US state law allows). You won't be treated differently for using your rights. You can also let an authorised agent make a request for you; we'll ask for proof that they're allowed to.
11. EU and UK users
We rely on these legal bases under the GDPR and UK GDPR:
- Contract: to provide the Service to you and your organisation, including sign-in and processing your decisions.
- Legitimate interests: security, preventing abuse, handling access requests, and understanding cost and performance. We've weighed these against your rights, and you can object.
- Legal obligation: where the law requires us to keep or disclose information.
For declarations of interests, the decision's owner chooses what's collected, for their own compliance purposes, such as procurement and governance rules. You may also complain to your local data protection authority.
12. US state privacy rights
Residents of California and other states with privacy laws have the rights in section 10. In the past 12 months we've collected the categories of information in section 2: identifiers, professional information, internet activity (server logs), and the content you provide. We use them for the business purposes in section 3 and disclose them only to the providers in section 5. We don't sell or "share" personal information as those laws define it, so there's nothing to opt out of. We treat Global Privacy Control signals as an opt-out anyway. We don't use or disclose sensitive personal information for purposes that would give you a right to limit it.
13. Children
Xybernetex is a business tool for adults. It isn't directed to anyone under 18, and we don't knowingly collect information from them. If you think a child has given us information, contact us and we'll delete it.
14. Changes
If we change this policy, we'll post the new version here with a new date. For significant changes, we'll also email account holders before they take effect.
15. Contact
Xybernetex Systems LLC
2427 Jefferson Ave, Apt C104
Ogden, UT 84401, USA
chris@xybernetex.com