XFinLabsPrivacy Policy
October 12, 2026
This Privacy Policy describes the types of personal information that XFinLabs Inc (“we”, “us”, or XFinLabs) collects, uses, and discloses from individuals who use our website, including https://www.xfinlabs.com, and our services that link to this Privacy Policy (collectively, “Services”). By using our Services, you agree to the collection, use, disclosure, and procedures described in this Privacy Policy. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Use.
We distinguish account, billing, support, and website-usage information from the documents and other content customers upload to the Services. We generally determine the purposes of processing account and website information. When processing personal information contained in customer documents on a business customer's instructions, we act as a service provider or processor, as applicable.
The general marketing, advertising, product-development, and affiliate-use provisions in this Policy do not authorize us to use customer documents or generated outputs for those purposes. Those materials are handled under “Documents and Content You Upload” below, the applicable customer agreement, and any data-processing agreement.
Personal Information We Collect
We may collect a variety of personal information from or about you or your devices from various sources, as described below.
A. Personal Information You Provide to Us
Account Registration. When you create an account, we collect a username, your email address, your password (stored only in hashed form), the invitation code you used, and a record that you accepted our Terms of Use and this Privacy Policy. To protect sign-up from automated abuse, we use Cloudflare Turnstile, which receives technical information from your browser to tell people from bots.
Communications. If you contact us directly, we may receive personal information about you, such as your name, email address, phone number, city, the contents of a message or attachments that you may send to us, and other information you choose to provide. If you subscribe to our newsletter, then we will collect certain information from you, such as your email address. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services.
Prompts and Outputs. The Services allow you to submit text, documents, or other materials to the Services (“Prompts”), which generate responses based on your Prompts (“Outputs”). If you include personal information in your Prompts, we will collect that information and this information may be reproduced in the Outputs.
Careers. If you decide that you wish to apply for a job with us, you may submit your contact information and your resume online. We will collect the information you choose to provide on your resume, such as your education and employment experience. You may also apply through LinkedIn, Indeed, or other third-party services. If you do so, we will collect the information you make available to us on LinkedIn, Indeed, or other third-party services.
Payment Information. If you make a purchase through our Services, your payment-related information, such as credit card or other financial information, is collected by our third-party payment processor on our behalf.
B. Personal Information We Collect When You Use Our Services
Location Information. When you use our Services, we may receive your location information for example, your IP address may indicate your general geographic region.
Device Information. We receive information about the device and software you use to access our Services, including IP address, web browser type, and operating system version.
Usage Information. To help us understand how you use our Services and to help us improve it, we automatically receive information about your interactions with our Services, such as the pages or other content you view and the dates and times of your visits.
Information from Cookies and Similar Technologies. We use cookies and similar technologies that are needed to operate the Services, such as keeping you signed in and protecting your session. Cookies are small text files containing a string of alphanumeric characters. We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services.
Please review your web browser's “Help” file to learn how you may modify your cookie settings. Please note that if you delete or choose not to accept cookies from our Services, you may not be able to utilize the features of our Services to their fullest potential.
How We Use the Personal Information We Collect
We use the personal information we collect:
- To provide, maintain, improve, and enhance our Services;
- To understand and analyze how you use our Services and develop new products, services, features, and functionality;
- To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide support;
- For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;
- To generate anonymized or aggregated data for any lawful purposes;
- To find and prevent fraud and abuse, and respond to trust and safety issues that may arise;
- For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
- For other purposes for which we provide specific notice at the time the information is collected.
How We Disclose the Personal Information We Collect
Partners and Affiliates. We may disclose any information we receive to our current or future affiliates for any of the purposes described in this Privacy Policy.
Vendors and Service Providers. We may disclose any information we receive to vendors and service providers retained in connection with the operation of our Services.
As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to comply with law enforcement requests and legal process, such as a court order or subpoena, respond to your requests, or protect your, our, or others' rights, property, or safety.
Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets.
Consent. We may also disclose your information with your permission.
Documents and Content You Upload
When you upload documents to a data room, workspace, or other part of the Services, we store them so that you, and the people you choose to share them with, can use them. They may contain personal information about you, your colleagues, your clients, or your investors. We process it only to provide the Services to you.
When you share documents, the people you invite can view the documents you choose, and we record their activity, such as sign-ins, views, and downloads, and make it available to you and your account administrators.
When you use AI features, relevant extracts of your documents are sent to the artificial-intelligence providers we use to generate outputs. We do not use your documents, or the outputs generated from them, to train artificial-intelligence models, and under our agreements with those providers, they are contractually prohibited from using them to train their models.
Authorized XFinLabs personnel access your content only where needed to provide customer support or investigate a problem with your account or the Services, to protect the security of the Services, or to meet a legal obligation.
Besides the providers named in this Policy, we disclose information to our cloud hosting providers, to Stripe, Inc. for payment processing, to Cloudflare for sign-up bot protection, and to the artificial-intelligence providers that generate outputs, in each case only as needed to provide the Services.
Data Retention and Deletion
We retain personal information only for as long as reasonably necessary for the disclosed purposes, including providing the Services, maintaining account and transaction records, meeting legal obligations, resolving disputes, and protecting security.
Documents you upload are kept until you delete them in the Services or ask us to delete them at support@xfinlabs.com. Billing records, security logs, and activity records may have different retention periods based on accounting, legal, security, and operational needs, and may be kept after your documents are deleted. We require applicable service providers to implement deletion consistent with their obligations to us.
Your Choices
Marketing Communications. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional messages from us, you will continue to receive administrative messages from us.
Opt-Out Preference Signals. Where required by applicable law, we honor recognized opt-out preference signals, including Global Privacy Control, for processing subject to those requirements. Our response to ordinary Do Not Track signals does not limit those obligations.
Your U.S. State Privacy Rights
Depending on your state of residence, the nature of the information, and whether the applicable law covers our processing, you may have rights to access personal information; correct inaccuracies; request deletion; obtain a portable copy; obtain information about disclosures; and opt out of specified sales, targeted advertising, or profiling. Additional rights may apply to sensitive personal information.
To submit a request, contact support@xfinlabs.com. We will verify identity and authority where appropriate, respond within the period required by applicable law, and explain any lawful denial or extension. Where applicable, authorized agents may submit requests on your behalf.
If we deny a request and your state provides an appeal right, you may appeal by contacting support@xfinlabs.com with “Privacy Appeal” in the subject line. Our response will explain the outcome and any applicable route to contact the relevant state authority. We will not unlawfully discriminate against you for exercising privacy rights.
Where personal information is contained in documents uploaded by a business customer, we process it on that customer's behalf. We will direct requests about that information to the customer, or work with the customer to respond, as applicable law requires.
Third Parties
Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.
Security
We make reasonable efforts to protect your information by using security measures designed to safeguard the information we maintain. However, because no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information.
If we determine that a security incident requires notification under applicable law or our contractual obligations, we will provide the required notices within the applicable deadlines.
Children's Privacy
Our Services are intended for adult business users and are not directed to children. Individuals under 18 may not create an account. If we learn that we have collected personal information in violation of applicable children's privacy requirements, we will take appropriate steps to delete it. This concerns who may hold an account; information about individuals of any age that appears in documents a business customer uploads is handled as described in “Documents and Content You Upload.” If you believe a child has created an account, you may alert us at support@xfinlabs.com.
International Visitors
Our Services are hosted in the United States (“U.S.”) and intended for visitors located within the U.S. If you use our Services from outside the U.S., your information will be transferred to the U.S. for storage and processing, where data-protection laws may differ from those where you live. By providing any information, including personal information, on or through our Services, you consent to such transfer, storage, and processing.
Changes to this Privacy Policy
We will post any updates to this Privacy Policy on this page. We will provide notice of material changes as required by applicable law and obtain consent where required before implementing a materially different use of previously collected personal information.
Contact Information
If you have any questions, comments, or concerns about our processing activities, please email us at support@xfinlabs.com or write to us at:
XFinLabs Inc.
131 Continental Drive, Suite 305, Newark, Delaware 19713