XEROFOCUS Privacy Policy

Introduction

This Privacy Policy describes how XEROFOCUS INC, a California corporation ("XEROFOCUS," "we," "us," or "our"), processes information about you through www.xerofocus.com and its subdomains and affiliated sites, our AI video generation platform, Agent Mode, Cloud Workstations, API, mobile and desktop applications, social media pages, marketing activities, and other activities described in this Privacy Policy (collectively, the "Services").

XEROFOCUS provides tools and services for creating, editing, and generating video and related media using artificial intelligence. Capitalized terms not defined here have the meanings given in our Terms of Use Agreement.

We may provide additional or supplemental privacy notices for specific products or features at the time we collect information from you. Where a supplemental notice conflicts with this Privacy Policy, the supplemental notice controls for that product or feature.

Section 01Scope and Our Role

1.1 Where we are the controller. For individual users who register directly with us on STARTER, PRO, or MAX plans, and for visitors to our Site, XEROFOCUS decides the purposes and means of processing. We are the "controller" (GDPR/UK GDPR), the "business" (CCPA/CPRA), and the "personal information handler" (PIPL) with respect to that information.

1.2 Where we are a processor. In some cases we process information on behalf of business customers under an ENTERPRISE plan or a Data Processing Agreement ("Customers"). In those cases we process at the Customer's direction and subject to our agreement with them, and we act as a "processor," "service provider," or "entrusted party." This Privacy Policy does not govern that processing. If you are an end user of a Customer's workspace, please direct your questions and rights requests to that Customer.

1.3 What this policy does not cover. This Privacy Policy does not apply to information processed by third-party sites, applications, payment providers, or model providers under their own privacy policies, or to information you choose to make public through the Services.

Section 02Information We Collect

2.1 Information you provide to us

• Identifiers and contact data, such as your name, email address, billing and mailing address, and phone number.
• Account and profile data, such as username, password (stored in hashed form), profile photograph, language and interface preferences, and any other information you add to your profile.
• Demographic data, such as city, state or province, country of residence, postal code, and age or age bracket.
• Professional data, such as job title, company name, and industry, where you provide it.
• Commercial and transactional data, such as plan selected, order numbers, transaction history, Credit balances and consumption records, invoices, and tax identifiers. We do not collect or store full payment card numbers — see Section 6.3.
• Communications data, such as the content of support tickets, emails, chat messages, survey responses, bug reports, and feedback.
• Input, meaning the content you submit for generation — text prompts and negative prompts, reference images, reference video, audio and music files, voice samples, 3D assets, caption text, parameter and style settings, fine-tuning datasets, and any file you upload to a Cloud Workstation, together with associated metadata (including how, when, and by whom content was created, and any embedded EXIF, geolocation, or keyword data).
• Output, meaning the video, image, audio, caption, script, storyboard, and metadata generated for you, together with generation logs and parameters.
• Biometric information, such as facial geometry derived from images you upload and voiceprint data derived from audio you upload, where you use features that depend on face or voice characteristics. See Section 4 for the specific notice, consent, and retention rules that apply.
• Identity and compliance data, such as documents or attestations you provide to demonstrate authorization to use a third party's likeness or voice under Section 8.3 of the Terms of Use, or to satisfy sanctions and export control screening.

2.2 Information collected automatically

We, our service providers, and our analytics partners may automatically log:

• Device data, such as operating system type and version, device manufacturer and model, browser type and version, screen resolution, memory and disk capacity, device type, IP address, unique device and advertising identifiers, language settings, mobile carrier, network type, and coarse location inferred from IP address (city, state, or region level).
• Usage and network activity data, such as pages and screens viewed, time spent, referring URL, navigation paths, feature interactions, access times, and session duration.
• Compute and generation telemetry, such as which models you invoke, job submission and completion times, queue position and wait time, render duration, resolution and length settings, Credit consumption per job, error and failure codes, GPU and instance utilization, storage consumed, and Cloud Workstation session start, suspend, and release events.
• Content safety signals, such as classifier scores, policy-trigger events, refusal records, and moderation review outcomes associated with your Input and Output.
• Communication interaction data, such as whether you opened or clicked within our emails, collected using pixel tags.

2.3 Cookies and similar technologies

Some automatic collection is facilitated by:

• Cookies — small text files stored on your device. We use session cookies (deleted at the end of a session), persistent cookies, first-party cookies that we set, and third-party cookies set by our vendors.
• Local storage technologies, such as HTML5 local storage and IndexedDB, which store larger amounts of data outside the browser cookie store.
• Web beacons (pixel tags or clear GIFs), used to determine whether a page or email was opened or content was viewed.
• SDKs embedded in our mobile and desktop applications.

We use these for: strictly necessary technical operation (authentication, session state, load balancing, security); functionality and preferences; analytics; and, where applicable, marketing. Where required by law, we obtain consent through a cookie banner before setting non-essential cookies, and we honor withdrawal of that consent.

2.4 Information we collect from others

• Third-party sign-in. If you register or log in through Google, WeChat, Telegram, or another identity provider, we receive the profile data that provider makes available and that you authorize — typically name, profile picture, and email address or platform identifier. Those providers handle your information under their own privacy policies.
• Payment providers, who confirm to us that a payment succeeded and provide limited data such as the last four digits of a card, card brand, expiry, billing country, and a payment token.
• Referrals and invitations. If you invite a colleague, we collect the contact details you provide to deliver the invitation. Please do not share someone's contact details with us without their permission.
• Enterprise administrators, who may provide us with information about their authorized users.
• Public and commercial sources, such as sanctions and denied-party screening lists, fraud prevention services, and business information providers.

We may combine information collected through the Services with information obtained from these sources.

Section 03How We Use Information

3.1 Service delivery and operations

• Create and administer your account and authenticate you.
• Execute your generation tasks, including transmitting your Input to the model or models required to fulfill the request.
• Provision, run, suspend, and release Cloud Workstation instances and store your assets and Output.
• Personalize the interface, remember your preferences, and remember devices you have previously used.
• Communicate with you about the Services, including service announcements, updates, security alerts, renewal reminders, and administrative messages.
• Provide support and respond to your requests, questions, and feedback.

Legal basis (EEA/UK): performance of a contract; legitimate interests.

3.2 Content safety, moderation, and platform integrity

We use automated tools and, where escalation is warranted, human review to detect and act on content that violates our Terms of Use — in particular content involving minors, non-consensual intimate imagery, unauthorized likeness or voice use, and deceptive synthetic media. This involves processing your Input and Output, classifier scores, and associated account signals. We also use this information to train and improve safety classifiers, which are used only for safety purposes and never to improve generative capability.

Legal basis (EEA/UK): legal obligation; legitimate interests in platform safety and the protection of third parties; and, for special category data, substantial public interest and the establishment or defense of legal claims.

3.3 Metering, billing, and fraud prevention

To calculate Credit consumption, generate invoices, process payments and refunds, detect payment fraud and chargeback abuse, and enforce quota, rate-limit, and single-account rules.

Legal basis (EEA/UK): performance of a contract; legal obligation; legitimate interests.

3.4 Product improvement, research, and analytics

To analyze how the Services are used, measure performance, diagnose faults, conduct research, and develop new features. Where we create aggregated, de-identified, or anonymized datasets from personal information, we take steps to remove identifying elements, we do not attempt to re-identify, and we require the same of recipients.

Legal basis (EEA/UK): legitimate interests.

3.5 AI model training

Whether we use your Input and Output to train and improve our own artificial intelligence models depends on your account tier and your settings. See Section 5, which governs this use.

Legal basis (EEA/UK): consent.

3.6 Marketing and communications

To send you newsletters, product announcements, and promotional messages, and to measure engagement with them. You may opt out at any time — see Section 11.2. We do not engage in cross-context behavioral advertising directed at individuals under eighteen (18), and we do not knowingly use biometric information, Input, or Output for advertising purposes.

Legal basis (EEA/UK): consent, where required; otherwise legitimate interests.

3.7 Legal compliance and protection

To comply with applicable law, lawful requests, and legal process; to conduct sanctions, export control, and denied-party screening; to respond to rights complaints under Section 20 of the Terms of Use; to establish, exercise, or defend legal claims; to audit internal compliance; to enforce our agreements; and to prevent, investigate, and deter fraudulent, harmful, unauthorized, or illegal activity.

Legal basis (EEA/UK): legal obligation; legitimate interests; establishment or defense of legal claims.

3.8 With your consent

Where required by law, we ask for your consent before a specific use — for example, biometric processing (Section 4), model training for certain tiers (Section 5), non-essential cookies, and cross-border transfer for users in mainland China (Section 8.3). You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal, and without affecting processing that rests on another legal basis.

Section 04Biometric Information — Special Notice

4.1 What we collect and when. Certain features — including face swap, digital persona creation, lip synchronization, voice cloning, and voice-driven narration — require us to derive facial geometry from images or video you upload and voiceprint data from audio you upload. These may constitute "biometric identifiers" or "biometric information" under applicable law. We collect them only when you affirmatively choose to use one of these features, and only from material you upload for that purpose.

4.2 Notice and consent. Before you first use a feature that processes biometric information, we present this notice and request your separate, express written consent (including electronic consent) covering the collection, storage, and use described here. We do not process biometric information without that consent.

4.3 Purpose — strictly limited. We use biometric information solely to execute the specific generation task you request. We do not:

• use biometric information to train, fine-tune, or evaluate general-purpose face generation, face swap, or voice cloning models;
• use biometric information for identification, verification, surveillance, or matching you against any database;
• use biometric information for advertising, marketing, or profiling;
• sell, lease, trade, or otherwise profit from your biometric information; or
• disclose biometric information except as set out in Section 4.5.

4.4 Retention and destruction schedule. We retain biometric information only as long as needed for the purpose for which it was collected, and in any event we permanently destroy it at the earliest of:

Destruction means deletion from production systems, with copies on backup media purged in the ordinary backup rotation. Where you have deliberately saved a derived voice or persona model to your asset library, we retain it until you delete it or your account is closed — subject in all cases to the outer limit in the final row of the table above. You can delete a saved voice or persona asset at any time from Assets, which triggers destruction on the schedule above.

4.5 Disclosure. We disclose biometric information only: (a) to the infrastructure and model providers strictly necessary to execute your requested task, under contract terms restricting their use to that purpose; (b) where you direct us to; (c) where required by law, court order, or valid legal process; or (d) as necessary to protect against imminent harm. Voice and persona models derived for you are available only to your account and are never made available to other users.

4.6 Withdrawing consent. You may withdraw biometric consent at any time under Account Settings → Privacy → Biometric Features, or by contacting us. Withdrawal disables the affected features and triggers the destruction schedule above. Withdrawal does not affect Output already generated.

4.7 Your responsibility for others' biometrics. If you upload the face or voice of any person other than yourself, you must have obtained that person's express written authorization, as required by Section 8.3 of the Terms of Use. You are the controller of that person's biometric information for the purposes of obtaining consent, and you must be able to produce evidence of it on request.

Section 05AI Model Training and Your Choices

5.1 Defaults by tier. Consistent with Section 6 of the Terms of Use:

5.2 What "training" excludes. Regardless of your setting, we always process Input and Output as necessary to run the Services, moderate content, meter and bill, prevent fraud, produce anonymized aggregate statistics, comply with law, and resolve issues you report. These uses are described in Section 3 and are not "training."

5.3 Biometric carve-out. Facial geometry and voiceprint data are never used for training a general-purpose model, at any tier, regardless of your settings. See Section 4.3.

5.4 Effect of opting out. Opting out operates prospectively. From the date you opt out we will not add newly created Input or Output to training datasets, and we will remove from pending training pools any of your data collected earlier that has not yet been used. We cannot remove the influence of data already incorporated into trained model weights. Please take this into account before granting or relying on consent.

5.5 Third-party model providers. Where a generation task is executed by a third-party model provider, that provider's own training practices apply to the data we transmit. See Section 7.

Section 06When We Disclose Information

We disclose information to the categories of recipients below. We do not disclose your Input, Output, or biometric information to advertising or analytics partners.

6.1 Infrastructure and hosting vendors. Amazon Web Services and comparable providers that host the platform, store your assets, and run Cloud Workstation instances; content delivery networks; and email, messaging, and customer support platforms.

6.2 Third-party model providers. Providers whose models we invoke to execute your generation tasks. See Section 7 for the specific notice that applies.

6.3 Payment processors. We use third-party payment processors, which may include Stripe, Alipay, WeChat Pay, and Apple and Google in-app purchase systems, depending on how you pay. Full payment card numbers are collected and processed directly by these processors and are not stored on our systems. These processors handle your payment data under their own privacy policies.

6.4 Analytics and marketing partners. Vendors that help us understand aggregate usage of the Services and administer our email and marketing programs. These partners receive account, device, and usage data — not Input, Output, or biometric information.

6.5 Account administrators. If you join an ENTERPRISE or team workspace, the administrator of that workspace may access and control your account and the content in it. If you registered using an email address belonging to an organization, we may disclose your email address to that organization's administrators.

6.6 Recipients you direct. Platforms and services to which you choose to export, publish, or connect your content.

6.7 Professional advisors. Lawyers, auditors, accountants, bankers, and insurers, where necessary for the services they provide to us.

6.8 Authorities and rights claimants. Law enforcement, regulators, courts, and private parties where we believe in good faith that disclosure is necessary or appropriate to comply with law or legal process, to enforce our agreements, to respond to a rights complaint, or to protect the rights, property, or safety of any person. Content involving the sexual exploitation of minors is reported to the U.S. National Center for Missing & Exploited Children (NCMEC) and to competent law enforcement authorities, together with associated account information, as required by law.

6.9 Affiliates. Our current and future affiliates, for the purposes described in this Privacy Policy.

6.10 Business transfers. In connection with an actual or prospective financing, investment, merger, acquisition, sale of assets, reorganization, insolvency, or similar transaction, including disclosure to prospective counterparties and their advisors.

6.11 Other users and the public. Your username, profile, and any content you publish to public areas of the Services may be visible to other users and to the public, and may be cached, copied, or stored by others including search engines. Content you keep private is not disclosed in this way.

Section 07Third-Party Model Providers — Special Notice

7.1 Why this matters. XEROFOCUS uses a multi-model orchestration architecture. To fulfill a generation request, we may route your Input to one or more artificial intelligence models operated by third parties. This means your prompts, reference images, reference video, and audio may leave our infrastructure and be processed on servers operated by those providers, which may be located in the United States, mainland China, Singapore, the European Union, or other regions.

7.2 What we do to protect you. We use commercially reasonable efforts to: (a) contract with providers on terms that restrict their use of transmitted data to executing the request; (b) prefer providers that offer zero-retention or short-retention processing modes and enable those modes where available; (c) require deletion of transmitted data within a defined period; and (d) restrict, to the maximum extent the provider permits, the use of transmitted data for that provider's own model training.

7.3 What we cannot guarantee. We do not control third-party model providers' systems, retention practices, or training policies, and their handling of data is governed by their own terms and privacy policies. Where a provider does not offer a no-training mode, we will label this in the model selection interface so that you can choose a different model.

7.4 Your controls. You can see the data-handling characteristics of each available model in the model selection interface before you submit a job. If you do not wish your Input to be transmitted to a particular provider, do not select models operated by that provider. ENTERPRISE customers may request an allow-list restricting generation to approved providers or regions.

7.5 Current providers. We maintain a current list of the categories of third-party model providers and infrastructure sub-processors, available on request at contact@xerofocus.com (subject line "Privacy Request"). Because the model catalog changes frequently, we do not fix the list in this Privacy Policy.

Section 08International Data Transfers

8.1 General. We are headquartered in the United States and operate globally. Information we collect may be transferred to, stored in, and processed in the United States, mainland China, Singapore, the European Union, and other countries where we, our affiliates, our service providers, or our model providers operate. Data protection laws in these countries may differ from those in your country of residence.

8.2 Transfers from the EEA, the United Kingdom, and Switzerland. Where we transfer personal data out of the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the Swiss addendum, together with supplementary technical and organizational measures where our transfer impact assessment indicates they are needed. You may request a copy of the relevant safeguards by contacting us.

8.3 Users in mainland China — Cross-Border Transfer Notice. If you are located in mainland China, providing information to the Services necessarily involves transferring your personal information outside mainland China. In accordance with Articles 39 and 55 of the Personal Information Protection Law, we disclose the following, and we request your separate consent to this transfer through a distinct consent mechanism presented at registration and before you first submit content for generation:

We have conducted a personal information protection impact assessment for this transfer and retain the records as required by law. You may withdraw this separate consent at any time by contacting us. Because the Services cannot be provided without transferring your content abroad for processing, withdrawal will mean that we can no longer provide the generation features to you, and we will close your account and delete your data in accordance with Section 9.

8.4 Minimization. We transmit only the information necessary to fulfill your request. We do not transfer your payment card details across borders; payment data is handled by the payment processor within its own compliance perimeter.

Section 09Data Retention

9.1 General principle. We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

9.2 Specific periods.

9.3 Legal holds. We may retain information beyond these periods where necessary to comply with a legal obligation, respond to a lawful request, or establish, exercise, or defend legal claims.

9.4 Backups. Copies on backup media are purged in the ordinary backup rotation after deletion from production systems.

Section 10Security

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit (TLS) and at rest, network isolation between Cloud Workstation tenants, role-based access control and least-privilege access for personnel, logging and monitoring, vulnerability management, and vendor security assessment.

No system is completely secure. We cannot guarantee the security of information transmitted to or from the Services, and you provide information at your own risk. You are responsible for maintaining the confidentiality of your credentials and API keys and for the configuration security of your Cloud Workstation above the guest operating system layer, as described in Section 10.5 of the Terms of Use.

If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities where and within the timeframes required by applicable law.

Section 11Your Rights and Choices

11.1 Access, correct, or update. You may review and update account and profile information by logging in and visiting Account Settings.

11.2 Marketing opt-out. You may unsubscribe from marketing emails using the link in any such email, or by contacting us. You will continue to receive service-related and transactional messages, which are not marketing.

11.3 Cookies. You can manage cookies through our cookie banner and preference center where presented, and through your browser settings. Disabling cookies may prevent parts of the Services from working. You can also configure your device to block images, which prevents web beacons from functioning.

11.4 Privacy settings. You can mark assets, projects, and Output as private or public, and you can opt out of the platform showcase license under Account Settings → Privacy & Showcase.

11.5 Training settings. You can review and change your model training authorization under Account Settings → Data & Training, as described in Section 5.

11.6 Biometric consent. You can withdraw biometric consent under Account Settings → Privacy → Biometric Features, as described in Section 4.6.

11.7 Third-party sign-in. If you connect through Google, WeChat, or Telegram, you can limit or revoke our access through that platform's settings. Revocation does not apply to information already received.

11.8 Delete your account. You may request account deletion under Account Settings → Account. Deletion is subject to the retention rules in Section 9 and to any legal hold.

11.9 How to make a request. Submit rights requests to contact@xerofocus.com with the subject line "Privacy Request." To protect your privacy, we take reasonable steps to verify your identity before acting, typically by confirming control of the account email address. If we cannot verify you, we may be unable to respond. Certain information may be exempt from a request under applicable law, and some information is necessary to provide the Services — if you ask us to delete it, you may no longer be able to use the Services.

We respond within the period required by applicable law — generally forty-five (45) days under U.S. state laws (extendable by a further forty-five days), one (1) month under the GDPR and UK GDPR (extendable by two months), and fifteen (15) working days under the PIPL.

Section 12United States State Privacy Rights

12.1 Who this applies to. Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and residents of other states as comparable laws take effect.

12.2 Your rights. Subject to your state's law and to verification, you may have the right to:

• know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of recipients;
• obtain a portable copy of your personal information;
• correct inaccurate personal information;
• delete personal information;
• opt out of the "sale" or "sharing" of personal information and of targeted advertising;
• opt out of profiling that produces legal or similarly significant effects;
• limit the use and disclosure of sensitive personal information;
• withdraw consent;
• be free from discrimination for exercising your rights; and
• appeal a denial of your request.

12.3 Sale, sharing, and targeted advertising. We do not sell your personal information for money. We do not sell or share Input, Output, or biometric information for any purpose, and we do not use them for cross-context behavioral advertising. Our disclosure of certain account, device, and usage identifiers to analytics and marketing partners may nonetheless be treated as a "sale" or "share" under some state laws. You may opt out through the "Your Privacy Choices" link in our website footer, or by contacting us. We recognize the Global Privacy Control and other legally recognized browser-based opt-out preference signals as a valid opt-out for the browser on which they are enabled. You must exercise the choice on each browser and device, and clearing cookies may reset it.

12.4 Sensitive personal information. Under the CPRA and comparable laws, biometric information processed for the purpose of uniquely identifying an individual is "sensitive personal information." We do not process biometric information for identification purposes, and we use sensitive personal information only for the purposes permitted under Cal. Civ. Code § 1798.121(a) — namely, to perform the services you request, to prevent and investigate security incidents and fraud, and to comply with law. You may nonetheless submit a request to limit its use and disclosure using the process in Section 11.9.

12.5 Authorized agents. California and certain other state residents may designate an authorized agent to make requests. An agent must provide signed written permission from you or a valid power of attorney, and we may contact you directly to confirm the authorization.

12.6 Appeals. If we deny your request, you may appeal by emailing contact@xerofocus.com with the subject line "Privacy Appeal." We will respond within the period your state's law requires and, if we deny the appeal, will tell you how to contact your state attorney general.

12.7 California "Shine the Light." California residents may request information about disclosures of personal information to third parties for those parties' direct marketing purposes. We do not make such disclosures.

12.8 Notice at collection. The categories of personal information we collect, the purposes, the sources, and the categories of recipients are set out in Appendix A.

Section 13European Economic Area, United Kingdom, and Switzerland

13.1 Controller. XEROFOCUS INC is the controller of the personal data described in this Privacy Policy, except where Section 1.2 applies.

13.2 Legal bases. Our legal bases for each purpose are identified in Section 3. Where we rely on legitimate interests, we have carried out a balancing assessment; you may request a summary.

13.3 Special category data. Biometric data processed for the purpose of uniquely identifying a natural person is special category data under Article 9. We do not process biometric data for identification purposes. Where our processing of face or voice data nonetheless falls within Article 9, we rely on your explicit consent under Article 9(2)(a), obtained as described in Section 4.2, and — for content safety processing — on substantial public interest and the establishment or defense of legal claims under Articles 9(2)(g) and 9(2)(f).

13.4 Your rights. You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection (including to processing based on legitimate interests and to direct marketing), and the right not to be subject to a decision based solely on automated processing producing legal or similarly significant effects. Automated content moderation may restrict or suspend your access to the Services; you may request human review of any such decision by contacting us.

13.5 Withdrawing consent. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

13.6 Complaints. You may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office if you are in the UK. We would appreciate the chance to address your concerns first.

13.7 Contacting us about EEA and UK matters. If you are in the EEA, the United Kingdom, or Switzerland, you may raise any question about this Privacy Policy and exercise any of the rights in Section 13.4 by contacting us at contact@xerofocus.com with the subject line "GDPR Inquiry." We respond within one (1) month of receipt as required by Article 12(3), and will tell you if we need to extend that period.

13.8 Article 27 representative. Where Article 27 of the GDPR or of the UK GDPR requires us to designate a representative established in the Union or the United Kingdom, the name and contact details of the designated representative will be published in this Section. Designation of a representative does not limit your ability to contact us directly using the details above, or to lodge a complaint with your supervisory authority under Section 13.6.

Section 14Mainland China

14.1 Application. This Section applies if you are located in mainland China. XEROFOCUS INC is the personal information handler.

14.2 Your rights under the PIPL. You have the right to know and decide about the processing of your personal information, and to access, copy, port, correct, supplement, and delete it; to request an explanation of our processing rules; to withdraw consent; and to refuse automated decision-making that has a significant effect on your rights. Close relatives of a deceased user may exercise these rights in respect of that user's personal information for their own lawful and legitimate interests, unless the user arranged otherwise.

14.3 Separate consent. We obtain separate consent, presented distinctly rather than bundled into general terms, for: (a) cross-border transfer of your personal information (Section 8.3); (b) processing of biometric information as sensitive personal information (Section 4); and (c) use of your Input and Output for model training where that applies to your tier (Section 5).

14.4 Sensitive personal information. We process biometric information only where it is necessary for a specific purpose you have requested, with sufficient necessity, with strict protective measures, and after informing you of the necessity and the effect on your rights.

14.5 Minors. We do not knowingly collect personal information from anyone under fourteen (14). Personal information of minors under fourteen is sensitive personal information under the PIPL and requires guardian consent and a dedicated processing rule; because our Services are not directed to that age group, we do not process it.

14.6 How to exercise your rights. Contact contact@xerofocus.com with the subject line "Privacy Request." We respond within fifteen (15) working days. If you believe we have not handled your request properly, you may complain to the competent cyberspace administration or other regulatory authority.

14.7 Service availability. Certain models and features may be unavailable in mainland China for compliance reasons. Availability decisions are described in Section 22.3 of the Terms of Use.

Section 15Children

The Services are not directed to children under thirteen (13), and we do not knowingly collect personal information from them. Users aged thirteen (13) to seventeen (17) may use the Services only with the consent and supervision of a parent or legal guardian, for personal non-commercial purposes, and without making paid transactions. In mainland China the threshold is fourteen (14) — see Section 14.5. If we learn that we have collected personal information from a child below the applicable threshold, we will delete it and terminate the account. If you believe a child has provided us with personal information, contact us at contact@xerofocus.com.

We do not knowingly sell or share the personal information of consumers under sixteen (16), and we do not direct targeted advertising at minors.

Section 16Other Sites and Services

The Services may contain links to, or integrations with, third-party websites, applications, and services, including identity providers, payment processors, distribution platforms, and model providers. We are not responsible for their privacy practices. Please review their privacy policies before providing information to them.

16.1 Optional publishing integrations. Where you choose to connect a third-party account (such as YouTube, TikTok, or another distribution platform) in order to publish videos you created on XEROFOCUS, we process only what that connection requires: the account identifier or basic profile name returned by the platform, the OAuth access and refresh tokens, and a record of the publish actions you trigger. Connections are established only when you initiate them, and you may disconnect at any time in the app, which revokes the stored tokens.

16.2 YouTube API Services. XEROFOCUS uses YouTube API Services. By connecting your YouTube account you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. We request only the youtube.upload scope and your basic profile name; we do not read, store, or share any other YouTube account data, and we do not use it for advertising, model training, or any purpose other than performing the uploads you request. OAuth tokens are stored encrypted and are deleted when you disconnect or close your account. You may also revoke access from your Google account security settings at myaccount.google.com/permissions. XEROFOCUS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Section 17Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version with an updated effective date. For material changes — including any expansion of the purposes for which we use your information, any change to the model training defaults, or any change to biometric processing — we will provide at least thirty (30) days' advance notice by email or in-product notice, and, where the change requires consent, we will obtain fresh consent before it takes effect. We encourage you to review this Privacy Policy periodically.

Section 18How to Contact Us

Acknowledgment

BY USING THE SERVICES YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY. WHERE APPLICABLE LAW REQUIRES CONSENT — INCLUDING FOR BIOMETRIC PROCESSING, MODEL TRAINING, NON-ESSENTIAL COOKIES, AND CROSS-BORDER TRANSFER — WE OBTAIN THAT CONSENT SEPARATELY AND YOU MAY WITHDRAW IT AT ANY TIME.

Appendix ACategories of Personal Information (Notice at Collection)

Provided for the purposes of Cal. Civ. Code § 1798.100(a) and comparable state laws. Categories reference Cal. Civ. Code § 1798.140(v).

Sources: directly from you; automatically from your device and use of the Services; from identity providers, payment processors, and enterprise administrators; from public and commercial screening sources.

Retention: as set out in Section 9.

Sale or sharing: we do not sell personal information for money and do not sell or share Input, Output, or biometric information. See Section 12.3.

Appendix BCategories of Recipients

A current list of named sub-processors is available on request at contact@xerofocus.com (subject line "Privacy Request").

RecordVersion History

© 2026 XEROFOCUS INC. All rights reserved.

XEROFOCUS INC, 4225 Executive Square, Suite 600, La Jolla, CA 92037, USA　·　www.xerofocus.com　·　contact@xerofocus.com