Privacy Policy
Effective Date: September 9, 2026 Last Updated: September 9, 2026
The privacy of your data, and it is your data, not ours, is a big deal to us. In this policy we lay out what data we collect and why, how your data is handled, and your rights with respect to your data. We never sell your data: never have, never will. We never use the content of your prompts or responses to train a language model.
This policy is adapted from the 37signals privacy policy, published by 37signals LLC free to use under CC BY 4.0. The structure and much of the wording are theirs. The facts about Xantly are ours.
Who this policy covers
This policy applies to Xantly Inc. ("Xantly," "we," "us," or "our") and to everything we operate: the website at xantly.com, the API at api.xantly.com, the dashboard at app.xantly.com, and the documentation at docs.xantly.com (together, the "Service").
It covers our handling of information about site visitors, prospective customers, and customers and their authorized users. We refer to all of you as "you" throughout.
It does not cover information about a customer's own end users that Xantly receives from a customer, or otherwise processes on a customer's behalf, in connection with the Service. That includes the content of the prompts a customer sends us and the responses we return. Xantly processes that content under the instructions of the customer, which is the "data controller" or "business" as those terms are defined in applicable privacy laws. Our obligations as a "data processor" or "service provider" for that content are set out in the Data Processing Agreement and are not part of this policy.
If you are an end user of one of our customers and you have questions about how your information is collected and processed, please contact the organization that provided your information to us.
If you are a California resident, the section on your rights below includes the additional disclosures California law requires.
What we collect and why
Our guiding principle is to collect only what we need.
Identity and access
When you create a Xantly account we ask for your email address, a display name, and a name for your organization, and we store a hash of your password. If you sign in with Google or GitHub, we receive your name and email address from that provider instead. If you enrol a passkey, a multi-factor authenticator, or a recovery code, we store what is needed to verify it and nothing more.
We use this so you can sign in, so we can tell your organization apart from everyone else's, and so we can send you essential information about your account. We will never sell your personal information, and we will not use your name or your company in marketing without your permission.
Billing information
Xantly is prepaid. When you top up your credit balance, your payment details are submitted directly to our payment processor, Stripe, Inc., and never touch Xantly's servers. We keep a record of the transaction, including the last four digits of the card, for account history, invoicing, and billing support. We keep your billing address so we can calculate any tax due, issue invoices, and detect fraudulent transactions.
Prompt and response content
When you send a request to the API, we process its content in order to route it, serve it, and return the response. Whether we store that content, and for how long, is a setting you control:
| Setting | What happens to your content |
|---|---|
| Zero-Retention | Content is not persisted at rest. We keep metadata and a non-reversible hash, and no content-derived embedding is stored. |
| Default retention | Content is retained for a window you configure, 30 days by default, with presets of 7, 30, and 90 days, then automatically purged. Stored content is visible only to you, for your own debugging. |
To route each request we compute non-reversible derived signals: token counts, an inferred task class, latency, cost, whether the request succeeded, and a numeric embedding. Those signals train our internal routing models. They cannot be used to reconstruct your content.
We never use your prompts or responses to train, fine-tune, or improve any large language model, ours or a provider's. The only models we train are our own routing and selection models, on the non-content signals above. This is a contractual commitment, not just a policy statement: see the Changes to the Standard Terms in our Terms of Service.
When we route your request to a third-party model platform, the content needed to fulfil it is sent to that platform and is then subject to that platform's own data-usage terms. The platforms and providers that can receive it are listed in Annex III of the Data Processing Agreement, and you can restrict which of them your traffic may reach.
Request metadata
For every request we log the time, the model selected, token counts, latency, cost, the routing decision, and the outcome. This is what powers your usage analytics, your invoice, your budget caps, and our own reliability work. We keep it for 90 days on a rolling window.
General geolocation data
We log the IP address used to create an account, and we log account access by IP address, for security and fraud prevention. We keep this for as long as your account is active.
Website interactions
We collect information about your browsing activity on our website and dashboard for analytics: your browser and operating system versions, your IP address, which pages you visited, and which site referred you to us. If you are signed in, these analytics are tied to your account until your account is no longer active.
Analytics are off until you turn them on. Our analytics provider starts opted out, and only begins collecting if you choose "Accept All" on the cookie banner. That includes session replay, which records the shape of a session with every form input masked, so we can see that a page was hard to use without seeing what you typed into it. Choosing "Essential Only" means no analytics and no replay. See the Cookie Policy.
Voluntary correspondence
When you email us with a question or for help, we keep that correspondence, including your email address, so we have a history to refer to if you contact us again.
When we access or disclose your information
To provide the Service you asked for. We use the subprocessors listed in Annex III of the Data Processing Agreement to run the Service. We give at least 10 business days notice before we add or replace one.
No Xantly human reads your content except for limited purposes with your express permission, for example when an error stops an automated process and requires manual intervention to fix. These are rare, and when they happen we look for a root-cause fix so they do not recur. We may also access your data if required in order to respond to legal process, described below.
To help you troubleshoot, with your permission. If we need to look at your content to help you with a support case, we will ask you first.
To investigate, prevent, or act on a violation of our Acceptable Use Policy. Accessing a customer's account when investigating potential abuse is a measure of last resort. If we find the Service is being used for a restricted purpose, we will take action as necessary, including notifying the appropriate authorities where warranted.
Aggregated and de-identified data. We may aggregate or de-identify information collected through the Service, and use it for any purpose, including improving routing and publishing benchmark results. Aggregated data never identifies you or your organization.
When required under applicable law. Xantly is a U.S. company and its data infrastructure is located in the United States.
- Requests for user data. Our policy is not to respond to government requests for user data unless we are compelled by legal process, or in limited circumstances in the event of an emergency request. If U.S. law enforcement authorities have the necessary warrant, criminal subpoena, or court order requiring us to disclose data, we must comply. We will only respond to requests from government authorities outside the U.S. if compelled by the U.S. government through a mutual legal assistance treaty or agreement. It is our policy to notify affected users before we disclose data unless we are legally prohibited from doing so, and except in some emergency cases.
- Preservation requests. Our policy is to comply with requests to preserve data only if compelled by the U.S. Federal Stored Communications Act, 18 U.S.C. Section 2703(f), or by a properly served U.S. subpoena for civil matters. We do not disclose preserved data unless required by law or compelled by a court order that we choose not to appeal. Unless we receive a proper warrant, court order, or subpoena before the required preservation period expires, we will destroy any preserved copies at the end of that period.
- Tax audits. If we are audited by a tax authority we may be required to disclose billing-related information. If that happens we will disclose only the minimum needed, such as billing addresses and tax exemption information.
Finally, if Xantly is acquired by or merges with another company, we will notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.
Your rights with respect to your information
We apply the same data rights to every customer, regardless of location.
- Right to know. You have the right to know what personal information is collected, used, shared, or sold. Both the categories and the specific data we collect, and how each is used, are set out in this policy.
- Right of access. You have the right to access the personal information we hold about you, and to obtain information about the sharing, storage, security, and processing of it.
- Right to correction. You have the right to request correction of your personal information.
- Right to erasure. You have the right to request, subject to limitations under applicable law, that your personal information be erased from our possession and, by extension, from our subprocessors. Fulfilling some deletion requests will prevent you from using the Service, in which case the request results in closing your account.
- Right to complain. You have the right to make a complaint about our handling of your personal information to the appropriate supervisory authority.
- Right to restrict processing. You have the right to request restriction of how and why your personal information is used or processed, including opting out of any sale of your personal information. Again: we never have and never will sell your personal data.
- Right to object. You have the right, in certain situations, to object to how or why your personal information is processed.
- Right to portability. You have the right to receive the personal information we hold about you and to transmit it to another party. You can export your request history and usage data from the dashboard at any time.
- Right not to be subject to automated decision-making. You have the right to object to and prevent any decision that could have a legal or similarly significant effect on you being made solely by automated means. Xantly's routing decisions choose which model serves your request; they produce no legal or similarly significant effect on any individual.
- Right to non-discrimination. We do not and will not charge you a different amount, offer you different discounts, or give you a lower level of service because you exercised your data privacy rights.
Many of these rights can be exercised by signing in and updating your account. Some information may be exempt from such requests under applicable law; for example, we need to retain certain records in order to provide the Service and to meet tax obligations.
In some cases we need to take reasonable steps to verify your identity before responding, which may include verifying your name and email address. If we cannot verify you, we may be unable to respond. To exercise any of these rights, or if you need help, contact privacy@xantly.com. If an authorized agent is corresponding on your behalf, we will need written consent from the account holder before proceeding.
Depending on applicable law, you may have the right to appeal a decision to deny your request. We will explain how to exercise that right in any response denying a request. You also have the right to lodge a complaint with a supervisory authority; if you are in the EU or the UK you can contact your data protection authority.
How we secure your data
All data is encrypted with TLS 1.2 or higher when transmitted between your client and our servers. The database and the host volume are encrypted at rest with AES-256 under a customer-managed key, and backups are encrypted too.
Access to the Service is protected by role-based access control per organization, by password, passkey, multi-factor, or one-time-passcode authentication, and by requiring multi-factor authentication for administrative functions. API keys are stored only as a hash and are shown once, at creation. Browser sessions are cryptographically bound to the browser that created them.
The full description of our security posture is at xantly.com/security and in the security and compliance reference.
Data retention
We keep your information for as long as we need it for the purpose we collected it for, after which we delete it or irreversibly anonymize it. We may also retain and use information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. These clocks run independently of each other:
| Data | Retention |
|---|---|
| Prompt and response content | The window you configure. 30 days by default; presets of 7, 30, and 90 days; 0 for Zero-Retention. Deleted on request. |
| Request metadata | 90 days, rolling |
| Security and audit logs | 12 months |
| Billing and invoice records | 7 years, as required by tax law |
| Account records | For as long as the account is active. On account closure, purged within 60 days, except records we must keep for the periods above. |
Location of site and data
The Service is operated from the United States. If you are located in the European Union, the United Kingdom, or elsewhere outside the United States, please be aware that information you provide to us will be transferred to and stored in the United States.
When transferring personal data from the EU or UK
The European Data Protection Board has issued guidance that personal data transferred out of the EU must be treated with the same level of protection granted under EU privacy law, and UK law provides similar safeguards. Accordingly, Xantly has adopted a Data Processing Agreement incorporating the EU Standard Contractual Clauses and the UK Addendum. It is entered into automatically when you accept our Terms of Service; no signature is required.
Changes and questions
We may update this policy to comply with relevant regulations and to reflect new practices. Whenever we make a significant change we will refresh the date at the top of this page and take other appropriate steps to notify you.
Questions, comments, or concerns about this policy, your data, or your rights? Email privacy@xantly.com and we will do our best to answer. For data protection matters specifically you can also reach dpo@xantly.com. Xantly accepts correspondence by email only at this time.
Attribution
This policy is adapted from the 37signals privacy policy by 37signals LLC, used under CC BY 4.0. 37signals does not endorse Xantly. Changes were made: the facts, the retention table, the content-and-training sections, and the controller-processor split as they apply to an API product are Xantly's.