1. Introduction
Xyris (“Xyris,” “we,” “us,” or “our”) is built around a simple principle: your data is not our product.
We design Xyris to collect as little personal information as reasonably necessary to operate, secure, and provide our services.
This Privacy Policy explains how information is handled when you use Xyris, including our artificial intelligence services, APIs, text generation, image generation, multimodal tools, developer services, websites, applications, and related products (collectively, the “Services”).
By using Xyris, you acknowledge the practices described in this Privacy Policy.
2. 1. Privacy by Design
Xyris is designed around data minimisation.
We do not intentionally collect information merely because it may have commercial value.
We do not sell personal information.
We do not rent personal information.
We do not operate a data-brokerage business.
We do not sell user prompts, generated outputs, uploaded files, conversations, images, account information, or private usage data.
We do not provide private user information to advertisers for targeted or behavioural advertising.
We do not require users to explain why they are using Xyris for an otherwise lawful purpose.
Where technically and legally possible, Xyris seeks to minimise logging, retention, human access, tracking, and unnecessary disclosure of user information.
3. 2. Information We May Process
Depending on how you use the Services, Xyris may process limited categories of information.
Account Information
If an account is required, this may include:
- email address;
- username;
- account identifier;
- authentication information;
- subscription status;
- account status;
- billing status.
Passwords are intended to be protected using secure cryptographic hashing and should never be stored as readable plaintext.
User Content
“User Content” includes information voluntarily submitted to Xyris, including:
- prompts;
- conversations;
- uploaded files;
- images;
- generated images;
- generated text;
- generated code;
- audio;
- documents;
- API requests;
- API responses;
- instructions;
- model inputs;
- model outputs.
Xyris processes User Content primarily to perform the request initiated by you and operate the Services.
Technical Information
Limited technical information may be automatically generated where necessary to operate, secure, troubleshoot, and protect the Services.
This may include:
- IP address;
- timestamps;
- browser type;
- application type;
- operating-system information;
- device information;
- request identifiers;
- API usage information;
- rate-limit information;
- security events;
- error logs;
- authentication events.
Xyris seeks to limit technical information to what is reasonably necessary for security, reliability, abuse prevention, billing, troubleshooting, and operation of the Services.
4. 3. Prompts, Conversations, Images and Generated Content
Xyris considers prompts, conversations, uploaded content, generated images, generated text, files, and generated outputs to be private user data.
We do not sell this content.
We do not rent this content.
We do not use private User Content for targeted advertising.
We do not build advertising profiles from private prompts or conversations.
We do not voluntarily disclose User Content merely because an outside person, company, organisation, government agency, or law-enforcement agency asks us to do so.
Where Xyris provides temporary, private, ephemeral, or non-retained sessions, content from those sessions will be handled according to the retention settings associated with that feature.
5. 4. Encryption and Limited Knowledge
Xyris is designed so that, where technically possible, we know as little as reasonably necessary about the contents of your private data.
Where a Xyris feature uses client-side encryption, end-to-end encryption, or another form of encryption that prevents Xyris from accessing plaintext content, Xyris cannot read, inspect, recover, or disclose that plaintext content because Xyris does not possess the information necessary to decrypt it.
In those circumstances, encrypted User Content remains unintelligible to Xyris while protected by that encryption.
Where Xyris cannot access the plaintext contents of encrypted User Content, we do not know the substance of that content.
Xyris cannot provide another person, company, government agency, law-enforcement agency, regulator, investigator, or other requester with plaintext content that Xyris does not possess and cannot technically access.
Encryption does not necessarily mean that Xyris possesses no information whatsoever about an account or its use.
Xyris may still process limited technical or operational information where necessary to operate the Services, including:
- account identifiers;
- authentication information;
- timestamps;
- request identifiers;
- routing information;
- security events;
- billing information;
- service usage information;
- rate-limit information;
- infrastructure and reliability information.
Where content is protected using encryption that prevents Xyris from accessing the plaintext, the substance of that encrypted content is not known to Xyris.
Xyris does not claim to possess or understand plaintext content that its systems are technically incapable of decrypting.
6. 5. AI Training
Xyris does not use private prompts, conversations, uploaded files, images, generated outputs, or other private User Content to train shared or public AI models unless the user affirmatively opts in.
Opting in to model improvement, if offered, must be voluntary.
Declining model-training participation will not by itself prevent a user from accessing ordinary functionality unless a specific feature necessarily depends on such participation.
Aggregated or genuinely de-identified information that cannot reasonably be linked back to an individual may be used to understand reliability, performance, capacity, and service quality.
7. 6. Human Access to Content
Xyris does not routinely read private conversations or User Content.
Human access may occur only where reasonably necessary for purposes including:
- responding to a support request initiated by you;
- investigating a serious security incident;
- troubleshooting a technical failure;
- investigating credible infrastructure abuse;
- responding to a credible legal complaint;
- protecting Xyris infrastructure;
- protecting other users;
- complying with an enforceable legal obligation.
Access should be limited to authorised personnel with a legitimate need for access.
Where technically feasible, Xyris uses or seeks to use access controls, authentication, logging, and internal safeguards to prevent unnecessary employee access to private User Content.
If particular content is encrypted in a manner that prevents Xyris from accessing its plaintext, authorised personnel may likewise be unable to access the substance of that content.
8. 7. Third Parties
Xyris does not sell, rent, or commercially trade personal information to third parties.
Xyris may use selected service providers where reasonably necessary to operate the Services.
Examples may include:
- hosting providers;
- cloud infrastructure providers;
- networking providers;
- content-delivery networks;
- payment processors;
- email providers;
- database providers;
- security providers;
- storage providers;
- fraud-prevention services.
Such providers should receive only the information reasonably necessary to provide the relevant service and should be restricted from using Xyris user information for unrelated purposes.
Where Xyris operates AI inference entirely on infrastructure controlled by Xyris, prompts and outputs will not be sent to an external AI-model provider.
If an external model provider, API, infrastructure provider, or other third party receives User Content, Xyris will not falsely represent that the processing is entirely first-party.
Payment processors may independently process payment-card or financial information under their own privacy obligations.
Where practical, Xyris seeks to avoid directly storing full payment-card information.
9. 8. We Do Not Sell Your Data
Xyris does not sell:
- personal information;
- prompts;
- conversations;
- generated text;
- generated images;
- uploaded files;
- API content;
- browsing profiles;
- user identities;
- behavioural profiles derived from private User Content.
Xyris does not participate in cross-context behavioural advertising using private User Content.
If Xyris's business practices materially change, this Privacy Policy will be updated where required before a materially different processing practice is implemented.
10. 9. Government and Law-Enforcement Requests
Xyris does not voluntarily provide private user information to governments, law-enforcement agencies, regulators, investigators, or other authorities merely because an informal request has been made.
Where legally permitted, Xyris will require requests for private user information to be supported by valid, binding, properly issued, and appropriately scoped legal process applicable to Xyris.
Where reasonably possible and legally permissible, Xyris may:
- reject legally defective requests;
- object to invalid requests;
- seek clarification of vague requests;
- challenge excessively broad requests;
- seek to narrow requests;
- require appropriate legal authority;
- disclose only information specifically required;
- notify affected users before disclosure;
- publish transparency information regarding requests.
Xyris will not voluntarily provide information beyond what is legally required unless disclosure is otherwise necessary to protect against an immediate and serious threat or is otherwise permitted under applicable law.
Xyris cannot disclose information that it does not possess or plaintext content that it cannot technically access.
Where User Content is encrypted in a manner that prevents Xyris from decrypting it, Xyris cannot provide readable plaintext merely because a third party requests it.
Xyris may be legally prohibited from notifying a user about certain requests.
Nothing in this Privacy Policy requires Xyris to violate applicable law, obstruct lawful legal process, destroy evidence subject to a valid preservation obligation, conceal information that Xyris is legally required to preserve, or make false or misleading statements to authorities.
11. 10. Data Retention
Xyris seeks to retain personal information only for as long as reasonably necessary for the purpose for which it was collected.
Different categories of information may have different retention periods.
User Content should be deleted when a user deletes it or closes an account, subject to limited exceptions including:
- temporary backup retention;
- security requirements;
- fraud investigations;
- active disputes;
- billing requirements;
- tax requirements;
- mandatory legal retention;
- valid legal-preservation obligations.
Security and technical logs are retained only for as long as reasonably necessary for security, reliability, abuse prevention, troubleshooting, fraud prevention, dispute resolution, or compliance with applicable legal obligations.
Where information is no longer reasonably necessary for these purposes, Xyris seeks to delete, anonymise, aggregate, or otherwise dispose of it in accordance with applicable law and operational requirements.
Backups may temporarily retain deleted information until normal backup rotation permanently removes it.
12. 11. Account Deletion
Users may request deletion of their Xyris account and associated personal information by contacting:
xyris@xyris.in
Where required by applicable law, Xyris will delete or anonymise applicable personal information after reasonably verifying the request, subject to information that must legitimately be retained.
Account deletion may be permanent.
Once data has been permanently deleted, Xyris may not be able to recover it.
Where encryption keys or other cryptographic material necessary to recover encrypted content are permanently deleted, the associated encrypted content may become permanently unreadable.
13. 12. Your Privacy Rights
Depending on where you live, applicable law may provide rights to:
- obtain information regarding processing of your personal information;
- access personal information;
- correct inaccurate information;
- request deletion;
- withdraw consent where processing relies on consent;
- object to certain processing;
- restrict certain processing;
- obtain a portable copy of certain information;
- nominate another person to exercise rights where applicable;
- lodge a complaint with an appropriate data-protection authority.
Xyris will honour legally applicable privacy rights.
Requests may be submitted to:
xyris@xyris.in
Xyris may request reasonable identity verification before fulfilling a privacy request to protect accounts against unauthorised access.
A right of access does not require Xyris to provide plaintext content that Xyris does not possess or is technically incapable of decrypting.
14. 13. Security
Xyris uses reasonable technical and organisational safeguards appropriate to the nature of the Services.
These may include:
- encryption in transit;
- encryption at rest where appropriate;
- client-side encryption where supported;
- end-to-end encryption where supported;
- secure password hashing;
- restricted administrative access;
- secure authentication;
- infrastructure isolation;
- network security;
- access logging;
- credential protection;
- software patching;
- vulnerability management;
- security monitoring;
- backup protections.
Xyris seeks to design systems so that access to sensitive User Content is limited to what is technically and operationally necessary.
Where technically supported, encryption may be used to prevent Xyris itself from obtaining readable access to certain User Content.
No internet-connected service can guarantee absolute security.
Xyris therefore does not guarantee that unauthorised access, security vulnerabilities, data loss, outages, cryptographic failures, or other security incidents can never occur.
Where applicable law requires notification of a qualifying data breach, Xyris will provide legally required notifications.
16. 15. International Users
Xyris may provide Services internationally.
Information may therefore be processed in countries other than the country in which a user resides.
Where applicable law requires specific safeguards for international transfers of personal information, Xyris will implement legally appropriate safeguards.
17. 16. Children
Unless Xyris expressly introduces a separate service designed for younger users, the Services are intended only for individuals who are at least 18 years old or otherwise legally permitted to enter into this agreement in their jurisdiction.
Xyris does not knowingly operate the general Services for children where parental authorisation or additional child-specific compliance would legally be required and has not been implemented.
If Xyris learns that personal information from a child was collected unlawfully, Xyris may delete it.
18. 17. Changes to this Privacy Policy
Xyris may update this Privacy Policy when the Services, technology, business practices, security architecture, encryption systems, or applicable legal requirements change.
Material changes will be communicated in a manner reasonably appropriate to the significance of the change and where required by applicable law.
Changes apply prospectively from their stated effective date unless applicable law requires otherwise.
19. 18. Contact
Questions, requests, complaints, account-deletion requests, or privacy inquiries may be sent to:
Xyris
Email: xyris@xyris.in
Xyris does not believe that providing artificial intelligence requires turning its users into the product. We collect what we need to operate the service, protect what we receive, minimise what we retain, and do not sell your private data. Where encryption prevents us from accessing the substance of your content, we cannot read, understand, or disclose what we do not possess in readable form.