01 Overview & Scope
XfinAI ("XfinAI," "we," "us," or "our") is a boutique AI consulting and automation agency that designs and operates human-in-the-loop AI workflow architectures for enterprise clients. This Privacy Policy applies to our website at xfinai.com, our marketing and contact channels, and the automation integrations and services we build and operate on behalf of our clients.
This policy does not apply to third-party websites or services that we do not control, even where we link to them or integrate with them. When we process data on behalf of a client under a written services agreement, that client is the data controller and their own privacy policy governs how that data is handled; in those cases we act as a data processor and handle the data only on the client's documented instructions.
By using this website or submitting information to us, you acknowledge that you have read and understood this Privacy Policy.
02 Information We Collect
Information you provide directly
- Contact form submissions. When you request a consultation, we collect your name, email address, and the contents of your message.
- Project intake responses. When you complete our intake questionnaire, we collect the options you select and any free-text context you provide, such as project scope, team size, budget range, target timeline, and described constraints.
- Correspondence. If you email or otherwise contact us, we retain that communication and the contact details you use.
Information collected automatically
- Usage data. Pages viewed, time spent on pages, referring URLs, and interactions with site features.
- Device and technical data. Browser type and version, operating system, device type, screen size, and language settings.
- Approximate location. A coarse geographic region inferred from your IP address. We do not collect precise geolocation.
- Cookies and similar identifiers. Pseudonymous identifiers used to recognize repeat visits and measure site usage. Analytics cookies are set only after you grant consent, as described in Section 05.
Information we process on behalf of clients
In the course of delivering consulting and automation services, we may access or process data that belongs to a client or to a client's own end users — for example, records, documents, or communications that flow through a workflow we operate. We process that data strictly as a service provider on the client's instructions and under the terms of our agreement with them.
Information we do not collect
- We do not collect payment card numbers or full financial account details through this website.
- We do not knowingly collect biometric data, precise geolocation, or health information through this website.
- We do not collect information from children under 16. See Section 12.
03 How We Use Information
We use the information we collect for the following purposes:
- Responding to you. To answer inquiries, schedule and conduct consultations, and provide the information you request.
- Delivering our services. To scope, design, build, operate, and support the AI workflows and integrations we provide to clients.
- Improving our website and offerings. To understand how visitors use the site, diagnose problems, and improve content and usability.
- Communicating with you. To send service-related notices, follow-ups on your request, and — only where permitted — occasional updates about our services. You can opt out of marketing communications at any time.
- Security and integrity. To detect, prevent, and address fraud, abuse, spam, and technical or security issues.
- Legal compliance. To comply with applicable law, respond to lawful requests, and enforce our agreements.
Legal bases for processing
Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases: your consent (for analytics cookies and marketing communications, which you may withdraw at any time); performance of a contract (to deliver services you or your organization have engaged us for); our legitimate interests (to operate, secure, and improve our business, balanced against your rights); and compliance with legal obligations.
What we do not do
We do not sell your personal information. We do not rent, trade, or otherwise disclose it to third parties for their own advertising or marketing purposes. We do not use your personal information to train third-party machine learning models.
04 Google User Data
Some of our integrations and automations connect to Google services — for example Gmail, Google Drive, Google Calendar, Google Sheets, or Google Analytics — through Google Cloud APIs and our workflow automation platform. This section describes how we handle data obtained from those services.
What we access and why
We request access only to the specific Google services and scopes required to perform the task you or your organization has explicitly authorized. For example, a workflow that files email attachments requires read access to the relevant mailbox; a workflow that logs results requires write access to a specific spreadsheet. We do not request broad or unrelated scopes.
How we use Google user data
- We use Google user data solely to provide or improve the specific feature or workflow that you or your organization authorized — for example, reading a message to route it, creating a calendar event, appending a row to a sheet, or generating a report.
- We do not use Google user data for advertising, ad targeting, retargeting, profiling, creditworthiness, or lending purposes.
- We do not sell Google user data, and we do not transfer it to third parties except as necessary to provide the authorized feature, to comply with applicable law, or with your explicit consent.
- We do not use Google user data to develop, train, or improve generalized or foundation machine learning models.
Human access to Google user data
No human reads your Google user data, except in the following limited circumstances: (a) you have given us explicit permission and requested support for a specific issue; (b) access is necessary for security purposes, such as investigating abuse or a technical fault; (c) access is required to comply with applicable law; or (d) the data has been aggregated and anonymized so that it no longer identifies you.
Storage, retention, and deletion of Google user data
- OAuth access and refresh tokens and any data cached from Google services are stored encrypted and retained only for as long as needed to operate the authorized workflow.
- When you revoke our access, or when a workflow is retired, we delete the associated tokens and cached Google data from our systems within 30 days, except where a longer retention period is required by law.
- You can revoke our access to your Google account at any time at myaccount.google.com/permissions. You may also request deletion of data we hold by contacting us using the details in Section 15.
XfinAI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used for any purpose that is not disclosed in this Privacy Policy.
07 Service Providers
We rely on a small number of established providers to operate this website and deliver our services. Each processes data under its own terms and privacy commitments.
- Supabase Hosted database and serverless functions that store and process contact form and intake submissions.
- Resend Transactional email delivery, used to notify our team of your inquiry and to send you a response.
- Google Analytics Website usage measurement, loaded only after you grant consent via the cookie banner.
- Google Cloud Cloud infrastructure and Google API access used to operate client-authorized integrations and automations.
- n8n Workflow automation platform used to connect and orchestrate the systems within client-authorized workflows.
08 Data Retention
We keep personal information only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.
- Inquiries and intake submissions. Retained for up to 24 months after our last contact with you, so we can maintain continuity if you return, after which they are deleted or anonymized.
- Client engagement records. Retained for the duration of the engagement and for the period required by our agreement and applicable law, then deleted.
- Analytics data. Retained according to our Google Analytics configuration, and in any case no longer than 14 months.
- Google user data. Retained only as long as needed to operate the authorized workflow, and deleted within 30 days of revocation or workflow retirement, as described in Section 04.
- Consent records. Your cookie preference is stored in your own browser and can be cleared by you at any time.
09 Data Security
We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption of data in transit, access controls limiting data to personnel who need it, credential and token storage protections, and vendor review of the providers we rely on.
No method of transmission over the internet and no method of electronic storage is completely secure. We cannot guarantee absolute security, but we work to protect your information and to notify affected parties as required by law if a breach occurs.
10 International Data Transfers
XfinAI is based in the United States, and the service providers we use may store and process data in the United States and other countries. If you access our website from outside the United States, your information may be transferred to, stored, and processed in a country that may not provide the same level of data protection as your home jurisdiction.
Where required, we rely on appropriate safeguards for such transfers, including standard contractual clauses approved by the European Commission or the UK Information Commissioner, or another lawful transfer mechanism.
11 Your Rights & Choices
Depending on where you live, you may have some or all of the following rights regarding your personal information. We honor these requests regardless of where you are located, to the extent we are able.
- Access. Request a copy of the personal information we hold about you.
- Correction. Ask us to correct information that is inaccurate or incomplete.
- Deletion. Ask us to delete personal information we hold about you, subject to legal retention requirements.
- Portability. Request that we provide your information in a structured, commonly used, machine-readable format.
- Objection and restriction. Object to or request that we restrict certain processing, including processing based on our legitimate interests.
- Withdraw consent. Withdraw consent at any time where processing is based on consent — including analytics cookies. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
- Opt out of marketing. Unsubscribe from marketing communications at any time using the link in those messages or by contacting us.
- Non-discrimination. We will not discriminate against you for exercising your privacy rights.
California residents
If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to know what personal information we collect, use, and disclose; the right to delete; the right to correct; the right to limit the use of sensitive personal information; and the right to opt out of the sale or sharing of personal information. As stated above, we do not sell or share personal information as those terms are defined under California law. You may exercise your rights using the contact details in Section 15, and an authorized agent may submit a request on your behalf with written permission.
How to exercise your rights
Contact us using the details in Section 15. We will verify your identity before fulfilling a request, and we will respond within the timeframe required by applicable law — generally within 30 to 45 days. If you are located in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local supervisory authority.
12 Children's Privacy
Our website and services are intended for businesses and professional audiences. They are not directed to children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe we have inadvertently collected information from a child under 16, please contact us using the details in Section 15 and we will delete it promptly.
13 Do Not Track
Some browsers offer a "Do Not Track" (DNT) signal. There is currently no industry consensus on how websites should interpret DNT, so this site does not respond to DNT signals. However, we do honor Global Privacy Control (GPC) signals where required by applicable law, and analytics cookies are not set on this site unless you affirmatively accept them through our cookie banner.
14 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or the services we offer. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, provide additional notice on our website. We encourage you to review this page periodically.
Your continued use of our website or services after an updated policy takes effect constitutes acceptance of the revised policy.
15 Contact Us
If you have questions about this Privacy Policy, want to exercise your privacy rights, or have a concern about how we handle your information, please contact us:
- Email: ron.antosko@xfinai.com
- Website: xfinai.com
- Data protection inquiries: please include "Privacy Request" in your subject line so we can route your message promptly.
We take privacy concerns seriously and will work with you to resolve any issue.