PRIVACY POLICY.

Who We Are and Scope

XPhi Robotics ("XPhi", "we", "us", "our") builds physical-world data and infrastructure for AI, including wearable capture devices and egocentric (first-person) datasets used to train and evaluate robots and AI models. We are headquartered at 221 West 9th Street, Wilmington, Delaware 19801, USA.

This policy applies to personal data about:

• Website visitors to xphirobotics.com;
• Customers and partners who use our platform, devices, datasets or services;
• Data contributors who wear XPhi devices to record activities; and
• Bystanders who may appear incidentally in recordings.

Data contributors also receive a separate Contributor Consent Notice describing their specific project. If the Consent Notice and this policy differ, the Consent Notice applies to that project.

Summary

• We record first-person video, audio and motion data only from adults who have given informed, specific consent. They can stop recording or withdraw at any time.
• We blur the faces of people who have not consented, along with licence plates, screens and documents, before data is used for annotation or shared with customers.
• We license de-identified datasets to AI and robotics companies for model training and evaluation, under contracts that prohibit re-identification.
• We do not sell website visitors' personal information, and we never use capture data for advertising or to identify individuals.
• You can access, correct or delete your data at any time by emailing raushan@xphirobotics.com.

Information We Collect from Website Visitors and Customers

Information you provide:

• Name, email address, phone number and contact details when you register, request access or contact us
• Organisation name, job title and industry when creating an account
• Payment and billing information, processed by our payment partners (we do not store full card numbers)
• Data, files and instructions you upload or submit through our platform
• Communications you send us, including sales and support requests

Information collected automatically:

• Log data, including IP address, browser type, pages visited, referring URL and timestamps
• Device identifiers and operating system information
• Usage patterns and feature interaction data
• Cookies and similar technologies (see Section 13)

Device telemetry: if you or your organisation use XPhi capture devices, we collect device identifiers, firmware version, battery status, synchronisation and error logs to operate, secure and support the hardware.

Egocentric Capture Data

When a data contributor wears an XPhi device — such as the XPhi Capture multi-camera rig, wrist camera and IMU, stereo depth camera or tactile gloves — we may collect:

Some capture data may be sensitive or biometric in nature, such as images of faces, voice, hand geometry or movement patterns. We do not use capture data to identify individuals, and we do not create face or voice templates for recognition. We treat all capture data as sensitive and protect it with the safeguards described in Section 7.

Data Contributors

Eligibility. Contributors must be at least 18 years old. They are engaged directly by XPhi or through vetted data-collection partners bound by our standards.

Consent. Before any recording, each contributor receives a Contributor Consent Notice, in a language they understand, explaining what will be recorded, where and for how long, who will receive the data, that it will be used to train and evaluate AI and robotic systems, how they will be paid, and how to withdraw. Consent is given by the contributor personally — never by an employer or site manager on their behalf — and is recorded with a timestamp. Where biometric privacy laws apply, we obtain a written release.

Compensation. Contributors are paid for their participation at the rate disclosed in their Consent Notice.

Control during capture. Contributors can pause or stop recording at any time. Devices display a visible indicator while recording.

Review and withdrawal. Contributors may ask us to delete any recording segment before it enters a dataset. Contributors may withdraw consent at any time; we will then stop further use, delete their raw recordings, and remove their data from datasets not yet delivered, within 30 days. Customers who have already received data are contractually required to delete it on our notice where feasible. Please note that AI models already trained on data cannot be "untrained"; this is explained to contributors before recording begins.

Bystanders and Incidental Capture

People who are not contributors may sometimes appear in recordings. To protect them, we:

• train contributors to record only in approved locations, and to obtain permission from household members or site owners before recording in homes or private premises;
• prohibit recording in restrooms, changing rooms, places of worship, medical facilities, schools and during confidential meetings;
• require a visible indicator whenever a device is recording;
• automatically blur the faces of non-contributors, licence plates, screens and documents before data is used for annotation or shared with customers; and
• delete or redact any segment on request.

If you believe you appear in an XPhi recording, email raushan@xphirobotics.com with the approximate date, time and location. We will locate the recording and delete or redact it.

De-identification and Privacy Safeguards

All capture data passes through our privacy pipeline before it is used. This includes automated detection and blurring of faces, licence plates, screens and documents; removal of precise location metadata; and human review against a written redaction standard. We keep a record of the redaction applied to each file. Raw, un-redacted data is encrypted, accessible only to a small authorised team for quality control, and deleted on the schedule in Section 10.

How We Use Information

We never use capture data for advertising, profiling individuals, surveillance or identifying people.

How We Share and License Data

We do not sell website visitors' personal information. We share information only with:

• Dataset customers — AI and robotics companies that license de-identified capture data. Our contracts limit use to model research, training and evaluation; prohibit re-identification, facial recognition and surveillance; restrict onward transfer; and require deletion on request or at the end of the contract.
• Service providers and data partners — cloud hosting, annotation, payment and field-collection partners who act under confidentiality and data-processing agreements. See our Subprocessors page.
• Legal and safety — when required by law, court order or government authority, or to protect the rights and safety of any person.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy.
• With your consent — for any other purpose you explicitly approve.

Under some US state laws, licensing datasets may be considered a "sale" of personal information. Where this applies, we rely on contributors' explicit consent, and residents of those states may use the rights described in Section 16.

Data Retention

We may keep data longer where required by law or to resolve disputes.

Security

We implement industry-standard technical and organisational measures to protect your information, including encryption in transit (TLS) and at rest, role-based access controls, logging of dataset access and downloads, time-limited customer credentials, vendor security reviews and regular security testing. See our Security page for details. No system is completely secure and we cannot guarantee absolute security. If a data breach affects your personal data, we will notify you and the relevant authorities as required by law.

Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your personal data
• Object to or restrict certain processing
• Request a portable copy of your data
• Withdraw consent at any time, as easily as you gave it
• Opt out of marketing communications
• Nominate another person to exercise your rights in the event of death or incapacity (India)
• Lodge a complaint with a data protection authority

To exercise any of these rights, email raushan@xphirobotics.com. We will verify your identity and respond within 30 days, or sooner where the law requires. We will not discriminate against you for exercising your rights.

Cookies and Similar Technologies

We use cookies and similar technologies for:

• Strictly necessary purposes — login, security and core platform functionality;
• Analytics — understanding how our website and platform are used so we can improve them; and
• Preferences — remembering your settings.

Where required by law, we use non-essential cookies only with your consent. You can change your choices at any time through Cookie Settings in the website footer or through your browser settings, though disabling some cookies may affect platform functionality.

Children’s Privacy

Our platform and services are not directed at anyone under 18, and all data contributors must be 18 or older. We do not knowingly collect personal information from minors. Minors who appear incidentally in recordings are blurred. If we become aware that we have collected a minor’s personal data, we will delete it promptly.

International Transfers

XPhi is headquartered in the USA. Your data may be transferred to and processed in the USA, India and other countries where we or our service providers operate. When we transfer personal data from the EU, EEA or UK, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses. Transfers of personal data from India comply with the Digital Personal Data Protection Act, 2023. See our Subprocessors page for the third parties involved.

Region-Specific Disclosures

India. Under the Digital Personal Data Protection Act, 2023 and the rules made under it, XPhi acts as a Data Fiduciary. You may request a summary of your personal data and how it is processed, request correction or erasure, withdraw consent, nominate another person to exercise your rights, and raise a grievance with our Grievance Officer (Section 17). If your grievance is not resolved, you may complain to the Data Protection Board of India.

European Union, EEA and United Kingdom. The legal bases for our processing are listed in Section 8. Capture data that may contain sensitive information is processed only with your explicit consent. You have the right to lodge a complaint with your local supervisory authority.

California and other US states. In the past 12 months we have collected the following categories of personal information: identifiers, commercial information, internet or network activity, audio and visual information, biometric information, professional information, and inferences, for the purposes described in Section 8. You may request to know, access, correct or delete your personal information; opt out of the sale or sharing of personal information; and limit the use of sensitive personal information. We honour Global Privacy Control signals.

Illinois, Texas, Washington and other states with biometric privacy laws. We obtain written consent before collecting biometric data, do not sell or otherwise profit from biometric identifiers, and follow the retention schedule in Section 10.

Changes to This Policy and Contact Us

We may update this policy from time to time. We will post any changes on this page with a new "Last updated" date and, for material changes, notify contributors and customers by email before the changes take effect.

If you have questions, requests or complaints about this policy or our data practices, please contact: