Privacy Policy

This Privacy Policy describes how HWITSYS ("we", "us") collects, uses and protects personal data in connection with the XAIGuard platform and the xaiguard.com website.

Our full corporate details, registered address and the contracting entity for your region are set out in the order form and data processing agreement, and are provided on request.

We collect account and identity data you provide (name, work email, company, job title), contact-form submissions, and technical usage data needed to operate and secure the service.

Within the platform, we also process the data your own configuration sends through it: policy definitions, enforcement verdicts and evidence records, plus prompts and responses where you choose to enable logging. Logging scope is yours to set, per policy.

We use personal data to provide and secure the service, respond to enquiries, and meet legal obligations. We do not sell personal data and we do not use customer prompts or responses to train models.

Where processing relies on a lawful basis under GDPR, that basis is contract performance for service delivery, legitimate interests for security and service integrity, and consent for optional analytics.

We share personal data only with the infrastructure and communication providers required to run the service, under written data processing terms. We do not share customer data with advertisers or data brokers.

The current sub-processor list is provided on request, and we notify customers before any change that affects their data.

Retention is set per contract: account records are kept for the life of the relationship, and enforcement logs, verdicts and evidence records are kept for the period defined in your order form. Tenant data is deleted on contract termination.

The current retention schedule per data category is confirmed in your data processing agreement and provided on request.

Depending on your jurisdiction, you may have rights to access, correct, export or delete your personal data, to object to certain processing, and to withdraw consent for optional analytics. Under GDPR you may also lodge a complaint with your supervisory authority.

To exercise any of these rights, contact us at sales@xaiguard.com and we will respond within the statutory period that applies to you.

Our security controls are described on the trust center, which we keep current as controls and certifications change.

We update this policy as our practices evolve and note the last-updated date at the top of the page. For changes that materially affect how we handle personal data, we notify account owners by email before the change takes effect.

This policy is under legal review and will be extended with jurisdiction-specific detail as it is finalised. For the contractual position today, contact sales@xaiguard.com.