{"success":true,"data":{"slug":"privacy-policy","title":"Xelta Privacy Policy","updatedAt":"2026-05-22T06:03:57.550Z","metadata":{"platformName":"Xelta","version":"1.0","lastUpdated":"April 25, 2026","applicableRegions":["Global","EU/UK","USA","India","UAE"],"contact":"support@xelta.ai","website":"https://www.xelta.ai"},"notices":[{"type":"important","title":"IMPORTANT NOTICE","content":"This privacy notice describes how and why Xelta may collect, store, use, and share your information when you use our services. Our services include our website located at https://www.xelta.ai and any other website that links to this privacy notice, our mobile applications available on iOS via the Apple App Store and on Android via the Google Play Store, and any other related interactions including sales, marketing, events, and customer support communications.\n\nReading this privacy notice in its entirety will help you understand your privacy rights and choices. If you do not agree with our policies and practices as described in this notice, please do not use our services. If you have any questions or concerns after reading this notice, we encourage you to contact us at support@xelta.ai and we will be happy to assist you."},{"type":"summary","title":"SUMMARY OF KEY POINTS","content":"This summary is provided for convenience. It highlights the most important aspects of how we handle your personal information. We encourage you to read the full policy below for complete details.\n\nWhat personal information do we process? When you visit, use, or navigate our services, we may process personal information depending on how you interact with our platforms, the choices you make, and the features you use. This may include basic account information such as your name and email address, content you create or upload, and technical data such as your IP address and device information.\n\nDo we process sensitive personal information? Yes, but only in limited circumstances and with your explicit prior consent. We may process biometric and facial data when you choose to use face-based features such as face swap. This data is handled with the highest level of care and is subject to strict retention and usage limitations.\n\nDo we receive information from third parties? No. We do not receive personal information from third-party sources except in cases where you explicitly authorize it, such as when choosing to sign in using a social media account.\n\nHow do we process your information? We process your information solely to provide, improve, and administer our services, to communicate with you about your account and our offerings, for security and fraud prevention purposes, and to comply with applicable legal obligations. We may also process your information for other purposes with your explicit consent.\n\nHow do we keep your information safe? We use enterprise-grade security measures including TLS 1.2 and above encryption for data in transit and AES-256 encryption for data at rest. We also implement role-based access controls, audit logging, infrastructure isolation, and formal incident response procedures. However, no internet-based storage system can be guaranteed to be completely secure.\n\nWhat are your rights? Depending on where you are located, applicable privacy law may grant you certain rights including access to your data, the right to correct or delete it, and the right to withdraw your consent at any time. Please see the full rights section below for jurisdiction-specific details.\n\nHow can you exercise your rights? The easiest way to exercise any of your privacy rights is by contacting us directly at support@xelta.ai or by visiting https://xelta.ai/contact. We will consider and act upon any request in accordance with applicable data protection laws."}],"sections":[{"number":1,"title":"Legal Entity and Controller Information","content":"Support: support@xelta.ai\nPrivacy: support@xelta.ai\n\nLEGAL ENTITY AND CONTROLLER INFORMATION\nThis Privacy Policy is issued jointly by the following legal entities, which together constitute Xelta and act collectively as the Data Controller for all personal data processed under this policy.\n\nXelta LLC. (United States of America)\nXelta LLC. is incorporated in the State of Delaware, United States of America. As a Data Controller, Xelta LLC. is responsible for determining the purposes and means of processing personal data for users accessing our services from the United States and internationally where US law applies.\n\nXelta Private Limited (India)\nXelta Private Limited is a company incorporated under the laws of India. The Registered Office Address: H.NO. 906/15, Sonipat-131001, Haryana, India is inserted as per the incorporation documents filed with the Ministry of Corporate Affairs, Government of India. As a Data Controller operating in India, Xelta Pvt. Ltd. is responsible for compliance with the Digital Personal Data Protection Act, 2023 and other applicable Indian laws governing data protection.\n\nWhere this policy refers to Xelta, we, us, or our, it refers collectively to both legal entities above. For all privacy-related inquiries, users may contact us directly at support@xelta.ai. We are committed to transparency in how we handle your personal data and to upholding your rights under all applicable data protection frameworks.\n\nSCOPE OF THIS POLICY\nThis Privacy Policy applies to all platforms and channels through which Xelta delivers its services to users. This includes our iOS mobile application available for download on the Apple App Store, our Android mobile application available on the Google Play Store, and our web-based platform accessible at https://www.xelta.ai.\n\nThis policy has been drafted with the intent of full compliance with all major global data protection frameworks. We have designed our data practices to satisfy the requirements of the General Data Protection Regulation as applicable to users in the European Union and the United Kingdom. We comply with the California Consumer Privacy Act and the California Privacy Rights Act as applicable to California residents. We comply with the Digital Personal Data Protection Act of 2023 as applicable to users in India. We also comply with the UAE Personal Data Protection Law as applicable to users in the United Arab Emirates.\n\nBy using any of our platforms or services, you acknowledge that you have read and understood the terms of this Privacy Policy and consent to the collection and use of your information as described herein."},{"number":1.1,"title":"What Information Do We Collect?","content":"WHAT INFORMATION DO WE COLLECT?\n1.1   Account Data\nWe collect personal information that you voluntarily provide to us when you register for an account, when you use the features and tools on our platform, or when you reach out to us through our support channels. The types of information we collect through this process include your full name, your email address, the username you select, and your account password which we store in encrypted form.\n\nThe purpose of collecting this information is to enable account creation and authentication, to allow you to log in and maintain access to your account, and to communicate with you about your account status, our services, and any updates that may affect your use of our platform. We collect only the minimum information necessary for these purposes.\n\n1.2   User Content\nWhen you use the creative tools and features available on our platform, you may upload or generate various types of content. This includes images and photographs that you upload for editing or transformation purposes, video files that you submit for processing, and text prompts or instructions that you provide to our artificial intelligence systems in order to generate or modify content.\n\nThe purpose of collecting this content is strictly to execute the services you request, to store the generated outputs so you can access them across sessions, and to enable the cloud-based functionality of our platform. Your uploaded content is not used for any purpose beyond the specific feature you are actively using, and it is not shared with third parties for their independent use.\n\n1.3   Biometric and Face Data\nXelta offers certain advanced features that involve the processing of facial images and related attributes. These features are classified as sensitive by applicable data protection law, and we treat them with a correspondingly higher level of care and protection. Before we collect or process any biometric or facial data, we will present you with a clear and specific consent request. We will not process any such data without your explicit affirmative consent.\n\nThe types of biometric data we may collect in connection with face-based features include photographs or video frames containing your face, and derived attributes such as facial landmarks which are geometric points used to identify the position of facial features. These are processed strictly for the purpose of executing face-based creative features such as face swap. They are not used for identity recognition, profiling, behavioral analysis, or training any artificial intelligence model.\n\nWe guarantee that face data is not retained beyond a maximum period of Thirty days following its submission. After this period, all such data is automatically and permanently deleted from our systems. You may withdraw your consent to the processing of face data at any time, and we will cease processing and delete any stored data upon your request.\n\n1.4   Technical and Usage Data\nWhen you access and use our services, certain information is collected automatically by our servers and infrastructure. This data does not directly reveal your identity in the way that your name or contact information does, but it is necessary for the operation, security, and optimization of our services.\n\nThe automatically collected information includes your Internet Protocol address, which is a numerical label assigned to your device by your internet service provider. It also includes your browser type and version, the operating system installed on your device, your preferred language settings, the URL from which you arrived at our platform, the name and model of your device, your general country and region as inferred from your IP address, timestamps and records of how you interact with our platform including which pages you view and which features you use, and technical diagnostic data such as error reports and system activity logs.\n\nThis information is used primarily to maintain the security and proper functioning of our platform, to detect and prevent fraud and unauthorized access, to monitor system performance, and to support our internal analytics and reporting processes. Like many online services, we also collect some of this information through the use of cookies and similar technologies. Please see the cookies section of this policy for more details.\n\n1.5   Location Data\nWe collect approximate location information derived from your Internet Protocol address. This allows us to determine your general geographic region, typically at the country or city level. We use this information for security purposes, to detect unusual access patterns that may indicate unauthorized use, and to provide region-appropriate versions of our services where applicable.\n\nWe do not collect precise GPS coordinates from your device unless you explicitly enable this through your device settings and grant us permission to do so. You can opt out of location data collection at any time by disabling the Location setting on your device or by refusing our request for location access. Please be aware that opting out of location services may affect the availability or functionality of certain features of our platform.\n\n1.6   Social Media Integration Data\nXelta allows you to connect your third-party social media accounts to our platform for the purpose of sharing content you have created using our tools. When you choose to connect a social media account, you authorize Xelta to access limited information and permissions associated with that account. This access is restricted to what is strictly necessary to publish content on your behalf.\n\nThe information we may access from your connected social media account includes your account identifier, the name of your page or profile, and the specific publishing permissions required to post content. We do not access your private messages, your contacts or friends list, your follower lists, or any other personal information beyond what is needed for content publishing.\n\nAll content sharing actions on social media are performed only after your explicit initiation and approval of each individual post. Xelta never posts to your social media accounts automatically or without your active instruction to do so. You may revoke social media permissions at any time through your account settings on our platform or directly through the settings of the respective social media platform.\n\nXelta is not responsible for the data collection or processing practices of third-party social media platforms. We recommend that you review the privacy policies of any social media platform you connect to our services to understand how they handle your data independently of Xelta."},{"number":2,"title":"Consent Mechanism","content":"CONSENT MECHANISM\nWe obtain your consent to process your personal data through in-app prompts that require your explicit opt-in before any data collection begins, and through feature-level consent requests that are presented to you at the point of using any feature that involves the collection of sensitive data. Our consent mechanisms are designed to be clear, specific, and freely given. We do not bundle consent for multiple purposes into a single request.\n\nYou have the right to withdraw your consent at any time. You can do this through your account settings within the application, or by requesting account deletion which will result in the cessation of all consent-based processing and the deletion of your data. All consent events, including the time, nature, and scope of the consent given, and any subsequent withdrawals, are logged by our systems for the purposes of regulatory compliance and audit readiness."},{"number":3,"title":"How Do We Process Your Information?","content":"HOW DO WE PROCESS YOUR INFORMATION?\nWe process your personal information for a variety of specific purposes, each of which is described in detail below. We process data only for these defined purposes and only to the extent necessary to accomplish them.\n\nWe process your information to facilitate account creation and authentication and to otherwise manage user accounts. This includes enabling you to create and maintain your account, keeping your login credentials functioning, and ensuring that only authorized users can access your account and its associated data.\n\nWe process your information to deliver the services you have requested. When you use any feature of our platform, we process the data you provide or generate as a necessary step in executing that feature and delivering the output to you.\n\nWe process your information to respond to your inquiries and to provide customer support. When you contact us with a question, issue, or complaint, we use the information you provide along with your account information to investigate and resolve the matter.\n\nWe process your information to send you administrative communications. This includes notifications about changes to our terms of service, updates to this privacy policy, changes to our platform features, service downtime notifications, and other information that is necessary for your use of our services.\n\nWe process your information to request your feedback. We may periodically contact you to ask about your experience with our platform, to understand how we can improve our services, and to gather insights about your needs as a user.\n\nWe process your information to protect the integrity and security of our services. This includes monitoring for fraudulent activity, detecting and preventing unauthorized access, investigating suspicious behavior, and taking protective action where necessary to safeguard the platform and its users.\n\nIn limited and exceptional circumstances, we may process your information to protect the vital interests of an individual where there is a risk of serious harm. This is a narrow basis for processing that we would apply only in genuine emergency situations."},{"number":4,"title":"Artificial Intelligence and Automated Processing","content":"ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING\nXelta is an AI-powered platform, and our services involve the use of artificial intelligence to generate, transform, and enhance content. It is important to us that you understand exactly how your data interacts with our AI systems.\n\nAll AI-generated outputs are produced in direct response to your specific requests and instructions. Our AI systems process your inputs in real time to produce the outputs you have requested. Your data is not used to train, fine-tune, or improve our AI models. We do not use your images, videos, prompts, or any other personal data you submit as training data for any machine learning system.\n\nOur platform does not make automated decisions that produce legal effects or similarly significant effects on you. No decision that materially affects your rights, access to services, or legal status is made solely through automated means without human involvement. Where our systems engage in any form of automated processing that could affect you, human oversight is maintained as required by applicable law."},{"number":5,"title":"What Legal Bases Do We Rely On?","content":"WHAT LEGAL BASES DO WE RELY ON?\nWe only process your personal information when we have a valid and specific legal basis to do so under applicable law. The legal bases we rely on vary depending on your location and the nature of the processing involved. This section describes the legal bases applicable to users in different regions.\n\nFor Users in the European Union and United Kingdom (GDPR and UK GDPR)\nThe General Data Protection Regulation and the UK GDPR require us to identify and document the lawful basis for each type of processing we undertake. The legal bases we rely on are as follows.\n\nConsent. We may process your personal information where you have given us clear and specific permission to do so for a defined purpose. We rely on consent primarily for the processing of biometric and face data and for any optional features or communications that go beyond what is necessary to provide the core service. You may withdraw your consent at any time and we will cease the relevant processing upon receipt of your withdrawal.\n\nPerformance of a Contract. We may process your personal information where it is necessary to fulfill our contractual obligations to you. When you create an account and use our platform, you enter into a service agreement with us. Processing your account data and the content you submit is necessary to deliver the services you have contracted for.\n\nLegitimate Interests. We may process your personal information where we have a legitimate business interest in doing so and that interest is not overridden by your fundamental rights and freedoms. We rely on this basis for activities such as fraud prevention and detection, security monitoring, and improving our platform based on usage patterns. We always assess the balance of our interests against your rights before relying on this basis.\n\nLegal Obligations. We may process your personal information where it is necessary for us to comply with a legal obligation to which we are subject. This includes cooperating with law enforcement and regulatory authorities where required by applicable law, and retaining records as mandated by law.\n\nVital Interests. In exceptional circumstances, we may process your personal information where it is necessary to protect your vital interests or those of another natural person, such as in a genuine emergency involving a risk to life.\n\nFor Users in Canada (PIPEDA)\nIn Canada, we rely on your express or implied consent to process your personal information. Express consent is obtained through explicit opt-in mechanisms. Implied consent may apply in circumstances where the purpose of collection is obvious and you have voluntarily provided your information. You may withdraw your consent at any time, subject to legal and contractual restrictions.\n\nThere are limited exceptional circumstances under Canadian law where we may process your information without your consent. These include situations where collection is clearly in your interests and consent cannot be obtained in a timely way, for fraud detection and prevention, for compliance with legal subpoenas or court orders, and where the information is publicly available. We invoke these exceptions only where truly applicable and do not use them as a routine basis for processing.\n\nFor Users in India (Digital Personal Data Protection Act 2023)\nFor users in India, we process personal data on the basis of consent or on grounds of legitimate use as defined under the Digital Personal Data Protection Act of 2023. We obtain your explicit consent before processing your personal data, and we maintain records of that consent. You have the right to withdraw your consent at any time and to seek grievance redressal through our designated channels. You also have the right to nominate another individual to exercise your data rights on your behalf in certain circumstances.\n\nFor Users in the United Arab Emirates (PDPL)\nFor users in the UAE, we process personal data in compliance with the UAE Personal Data Protection Law. We rely on your consent, the performance of a contract, or our legitimate interests as the legal basis for processing, depending on the specific activity involved. You have the right to data portability, the right to object to processing, and the right to access and correct your personal data."},{"number":6,"title":"When and With Whom Do We Share Your Information?","content":"WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?\nWe do not sell your personal information to third parties. We do not share your personal information with advertisers or marketing companies for their independent use. We share your information only in the limited circumstances described below, and only to the extent necessary for the purpose identified.\n\nBusiness Transfers. In the event that Xelta is involved in a merger, acquisition, corporate restructuring, sale of company assets, or similar transaction, your personal information may be transferred as part of that transaction. We will notify you in advance of any such transfer and of any changes to how your data will be handled as a result of the transaction.\n\nAffiliates. We may share your information with our affiliated entities, including our parent company, subsidiaries, joint venture partners, and other entities under common control with us. Any affiliate that receives your information is required to handle it in accordance with this privacy policy and to honor the rights and protections described herein.\n\nBusiness Partners. We may share your information with trusted business partners where doing so is necessary to provide you with a specific product, service, or promotion that you have expressed interest in. We require our business partners to maintain appropriate data protection standards.\n\nSubprocessors and Service Providers\nWe engage third-party service providers to assist us in operating our platform and delivering our services. These providers act as data processors on our behalf, meaning they process your data only according to our documented instructions and are not permitted to use it for their own purposes.\n\nAll of our subprocessors are subject to Data Processing Agreements that define the scope of their access to your data, the security measures they must implement, and their obligations upon termination of the engagement. Our current core subprocessors include Amazon Web Services, which provides hosting and storage infrastructure, and Cloudflare, which provides content delivery network and security services.\n\nWe maintain an up-to-date list of all our subprocessors. This list can be accessed at the subprocessors page on our website. We will notify you of any material changes to our subprocessor arrangements where required by applicable law.\n\nTo confirm our commitment: Xelta has not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve months, and we commit to maintaining this standard going forward."},{"number":7,"title":"Cross-Border Data Transfers","content":"CROSS-BORDER DATA TRANSFERS\nAs a global service, the data we collect may be transferred to, stored in, and processed in countries other than your country of residence. This may include transfers to countries that have different data protection laws to those in your jurisdiction.\n\nWhere we transfer your personal data outside of the European Economic Area, the United Kingdom, or other jurisdictions with data transfer restrictions, we implement appropriate safeguards to ensure that your data receives an equivalent level of protection. The primary safeguard we use for international transfers is Standard Contractual Clauses as approved by the European Commission, which impose binding data protection obligations on the parties to the transfer.\n\nOur primary data storage and processing takes place in AWS regions. Specific region information is available upon request. By using our services, you acknowledge that your data may be transferred internationally in accordance with the safeguards described in this section."},{"number":8,"title":"How Long Do We Keep Your Information?","content":"HOW LONG DO WE KEEP YOUR INFORMATION?\nWe retain your personal data only for as long as is necessary to fulfill the purposes for which it was collected, or for as long as we are required to retain it under applicable law. We do not keep your data for longer than necessary and we regularly review our retention practices to ensure compliance.\n\nAccount data, meaning your name, email address, username, and related credentials, is retained for as long as your account remains active. This retention is necessary to provide you with continuous access to our services. When you delete your account, this data is removed from our active systems.\n\nFace data and biometric information, where collected with your consent for specific features, is retained for a maximum of Thirty days following submission. This period allows for the completion of processing and provides a brief window for error recovery and resubmission if needed. After Thirty days, all such data is permanently deleted from our systems and cannot be recovered.\n\nGenerated content, meaning the outputs produced by our AI tools based on your inputs, is retained for a period of Thirty days from the date of creation. During this period, the content is accessible from your account. After Thirty days, the content is deleted from our servers unless you have taken steps to save or download it.\n\nSystem backups, which are maintained for the purpose of disaster recovery and business continuity, are retained for a period of thirty days. Backup data is isolated from active systems and is not used for any purpose other than system restoration in the event of a failure.\n\nAs a general outer limit, we will not retain your personal information for longer than three months following the termination of your account, except where a longer retention period is required by applicable law such as tax, accounting, or other legal obligations. Where we are legally required to retain certain data for a longer period, we will segregate that data and restrict access to it during the extended retention period.\n\nWhen we have no ongoing legitimate basis to retain your personal information, we will either delete it securely or anonymize it in such a way that it can no longer be associated with you. If immediate deletion is not technically feasible, for example because data is stored in backup archives, we will isolate the data and prevent it from being processed until deletion becomes possible."},{"number":9,"title":"How Do We Keep Your Information Safe?","content":"HOW DO WE KEEP YOUR INFORMATION SAFE?\nThe security of your personal information is a priority for us. We have implemented a comprehensive set of technical and organizational security measures designed to protect the personal information we process against unauthorized access, disclosure, alteration, and destruction.\n\nOur technical security measures include the use of Transport Layer Security version 1.2 and above for the encryption of all data in transit between your device and our servers. All data stored on our systems is encrypted using AES-256 encryption, which is a widely recognized and highly secure encryption standard. We implement role-based access control, which ensures that our staff members can only access the data necessary for their specific job functions. We maintain comprehensive audit logs of all access to and actions taken on personal data within our systems. Our infrastructure is designed with isolation principles to prevent unauthorized lateral movement in the event of a security incident. We have formal incident response procedures in place so that we can respond quickly and effectively to any security event.\n\nDespite our extensive security measures, we must be transparent with you that no system connected to the internet can be guaranteed to be completely and unconditionally secure. There are inherent risks in transmitting information over the internet, and we cannot guarantee that unauthorized third parties will never be able to breach our security measures. Transmission of personal information to and from our services is done at your own risk. You can help protect yourself by using our services only within a secure network environment and by keeping your account credentials confidential."},{"number":10,"title":"Data Breach Notification","content":"DATA BREACH NOTIFICATION\nIn the event that we become aware of a data breach that is likely to result in a risk to the rights and freedoms of individuals whose data we process, we will take immediate steps to investigate and contain the breach. We will notify the relevant data protection supervisory authorities as required by applicable law. Under the GDPR and UK GDPR, this notification must be made within 72 hours of becoming aware of the breach where feasible.\n\nWhere a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay. Our notification will include a description of the nature of the breach, the categories and approximate number of individuals affected, the categories and approximate number of records affected, the likely consequences of the breach, and the measures we have taken or propose to take to address the breach.\n\nEnterprise customers and business partners will be notified of any material breach that affects their data within 72 hours of our becoming aware of the breach, regardless of the regulatory threshold that would otherwise apply."},{"number":11,"title":"Do We Collect Information from Minors?","content":"DO WE COLLECT INFORMATION FROM MINORS?\nOur services are not directed at children or minors, and we do not knowingly collect personal information from children. For the purposes of this policy, a child is defined as a person under the age of 13 in the United States, and under the age of majority as defined by the applicable law in other jurisdictions. In most jurisdictions where we operate, the applicable minimum age is 13 or higher.\n\nBy using our services, you represent and warrant that you are at least 18 years of age, or that you are the parent or legal guardian of a minor who is using the services with your knowledge and consent. If you are using the services on behalf of a minor, you accept responsibility for ensuring that the minor uses the services in accordance with this policy and all applicable terms of service.\n\nIf we become aware or have reason to believe that we have collected personal information from a user who is a minor below the applicable age threshold without appropriate parental consent, we will take immediate steps to deactivate that user account and to delete the associated personal information from our records.\n\nParents or guardians who believe that their child has provided personal information to Xelta without their consent are encouraged to contact us at support@xelta.ai. We will take prompt action to investigate and, where appropriate, to delete the relevant information."},{"number":12,"title":"App Permissions and Mobile Compliance","content":"APP PERMISSIONS AND MOBILE COMPLIANCE\nWhen you use our mobile applications, we may request access to certain features and capabilities of your device. These permissions are requested only where they are necessary to provide specific functionality that you have chosen to use, and they are entirely within your control.\n\nWe may request access to your device camera to enable content creation features that involve capturing images or video directly within the application. We may request access to your device storage to enable the saving of generated content and outputs to your device. We require network access to deliver our services, as our platform operates through internet connectivity.\n\nAll permissions are optional in the sense that you can choose to decline them. If you decline a permission, the specific feature that requires that permission will not be available to you, but you will generally continue to be able to use other features of our platform that do not require that permission. You can review and manage the permissions granted to our application at any time through your device settings."},{"number":13,"title":"Apple and Google Platform Compliance","content":"APPLE AND GOOGLE PLATFORM COMPLIANCE\nWe have designed our applications to comply fully with the requirements of both the Apple App Store and the Google Play Store, including their respective policies on data collection, user privacy, and account management.\n\nApple App Store Compliance\nIn compliance with Apple App Store Guideline 5.1.1(v), our application is designed so that users can explore and access a meaningful set of features without creating an account or providing personal information. Guest access is supported for features that do not require personalization or data storage. Users who wish to access account-based features such as AI generation, credit tracking, cloud storage, and social media integration are required to register, and the reasons for this requirement are clearly explained within the application.\n\nOur application supports in-app account deletion, meaning you can permanently delete your Xelta account directly from within the iOS application without needing to contact support or visit an external website. The standard End User License Agreement that governs your use of our iOS application is available at https://www.apple.com/legal/internet-services/itunes/dev/stdeula/\n\nGoogle Play Compliance\nOur Android application complies with Google Play requirements for data safety and transparency. All data transmitted by our application is encrypted in transit. We have disclosed our data collection and usage practices in the Data Safety section of our Google Play listing. Users can request the deletion of their account and associated data through the application, in accordance with Google Play policy on account deletion."},{"number":14,"title":"Guest Access and Account Registration","content":"GUEST ACCESS AND ACCOUNT REGISTRATION\nWe believe that users should be able to understand and explore our platform before committing to creating an account. Accordingly, we make a range of features and information accessible without requiring you to register or provide any personal information.\n\nWithout creating an account, you can browse the application interface and explore the range of tools and features we offer, view feature descriptions, tutorial content, and example outputs that demonstrate what our platform can do, and access any publicly available content within the application.\n\nAccount registration is required only for features that are inherently account-based or that involve the storage or processing of your personal data. These include our AI-powered image and video generation features, which operate on a credit basis and require a verified account to manage credit balances and access history. Usage and credit tracking requires an account to associate your usage with your subscription or purchase. Cloud storage of generated outputs across sessions requires an account to identify your content and make it available to you when you return to the platform. Social media integration for content sharing requires an account to maintain your connected social media authorizations.\n\nWe do not require registration for features that are not account-based. Where registration is required, we explain this requirement clearly and provide an alternative experience for users who prefer not to register."},{"number":15,"title":"Cookies and Tracking Technologies","content":"COOKIES AND TRACKING TECHNOLOGIES\nWe use cookies and similar technologies to operate and improve our platform. A cookie is a small data file that is placed on your device when you visit our website. Cookies help us remember your preferences, keep you logged in, and understand how you use our platform.\n\nWe use strictly necessary cookies that are essential for the operation of our platform. Without these cookies, features such as user authentication and session management would not function properly. We also use analytics cookies that help us understand how users interact with our platform, which pages are most frequently visited, and where users encounter difficulties. This information is used to improve the user experience.\n\nWe do not use cookies or tracking technologies for advertising purposes. We do not sell or share cookie data with advertising networks or marketing companies.\n\nMost web browsers accept cookies by default. You can configure your browser to refuse all cookies or to notify you when a cookie is set. Please be aware that refusing cookies may affect the functionality of our website and may prevent certain features from working correctly. Specific information about the cookies we use and how you can manage your preferences is set out in our separate Cookie Notice, which is available on our website."},{"number":16,"title":"Social Login and Google YouTube API Data Usage","content":"SOCIAL LOGIN AND GOOGLE YOUTUBE API DATA USAGE\nIf you choose to connect your Google account to our platform, Xelta may request access to your YouTube account through the YouTube Data API v3. This access is requested solely to enable video publishing and management features that you have chosen to use.\n\nWe use this access to upload videos to your YouTube channel on your behalf when you instruct us to do so, to manage the metadata associated with those videos including titles, descriptions, and thumbnails, and to enable publishing actions that you explicitly initiate from within our platform.\n\nWe do not access or store your YouTube account password. We do not access private videos or content on your YouTube channel unless you explicitly request a feature that requires such access. We do not sell, transfer, or share your Google account or YouTube data with any third parties for their independent use. All actions involving your YouTube account are performed only after you explicitly consent to and initiate those actions within our platform.\n\nXelta’s use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements. This means that we use the data we receive from Google APIs only to provide or improve user-facing features that are prominent in our application, and not for serving advertisements, for data broking, or for other secondary purposes. The full text of the Google API Services User Data Policy is available at https://developers.google.com/terms/api-services-user-data-policy"},{"number":17,"title":"Abuse and Misuse Policy","content":"ABUSE AND MISUSE POLICY\nXelta is committed to ensuring that our platform, including our AI-powered features and face data processing capabilities, is used responsibly and ethically. We strictly prohibit the use of our services for any purpose that could harm, exploit, or violate the rights of others.\n\nThe following activities are strictly prohibited on our platform. Users may not use face-based features to process images of another person without that person explicit and informed consent. Users may not create deepfake content, meaning synthetic media that misrepresents a real person likeness, for the purpose of deception, defamation, harassment, or any other harmful purpose. Users may not use our platform to impersonate another person, whether a public figure or a private individual. Users may not use our services to create content that harasses, threatens, or intimidates any person.\n\nIf you believe that our platform is being used in violation of these prohibitions, or if you have been harmed by content created using our tools, you can report the abuse to us at support@xelta.ai. We take all abuse reports seriously and will investigate promptly. Where a complaint is verified, we will remove the offending content and take appropriate action against the account responsible, which may include account suspension or termination."},{"number":18,"title":"What Are Your Privacy Rights?","content":"WHAT ARE YOUR PRIVACY RIGHTS?\nDepending on where you are located, you may have a range of rights in relation to the personal information we hold about you. This section sets out the rights available to users in different jurisdictions and explains how you can exercise those rights.\n\nAll users, regardless of their location, have the following general rights. You have the right to access the personal information we hold about you and to receive a copy of that information. You have the right to request the correction of any inaccurate or incomplete personal information we hold. You have the right to request the deletion of your personal information, subject to certain legal exceptions. You have the right to restrict the processing of your personal information in certain circumstances. You have the right to withdraw your consent to any processing that is based on your consent, at any time, without this affecting the lawfulness of processing carried out before the withdrawal.\n\nUsers in the European Economic Area and the United Kingdom also have the right to data portability, which means the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. You also have the right to object to the processing of your personal information where we rely on legitimate interests as the legal basis. If you believe we are unlawfully processing your personal information, you have the right to lodge a complaint with your local data protection supervisory authority. Contact details for data protection authorities in the EU are available at https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm and for Switzerland at https://www.edoeb.admin.ch/edoeb/en/home.html\n\nUsers in California have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act. These include the right to know what categories of personal information we collect, the right to know whether your personal information is being sold or shared and to whom, the right to opt out of the sale or sharing of your personal information, the right to non-discrimination for exercising your privacy rights, and the right to limit our use and disclosure of sensitive personal information. As noted throughout this policy, we do not sell or share personal information under the CCPA definition of those terms.\n\nUsers in India have the right to grievance redressal under the Digital Personal Data Protection Act of 2023. If you have a concern about how we are handling your personal data, you may contact our Grievance Officer at support@xelta.ai and we will respond within the timeframe prescribed by law.\n\nUsers in the UAE have the right to data portability and the right to object to processing under the UAE Personal Data Protection Law.\n\nTo exercise any of the rights described in this section, you may contact us by email at support@xelta.ai or by visiting our contact page at https://xelta.ai/contact. We will respond to all legitimate requests within the timeframes required by applicable law. We may need to verify your identity before processing your request in order to prevent unauthorized access to your data.\n\nYou also have the right to opt out of receiving marketing and promotional communications from us at any time. You can do this by clicking the unsubscribe link in any marketing email we send you, by replying STOP to any marketing SMS we send you, or by contacting us using the details provided in this policy. Please note that opting out of marketing communications will not prevent us from sending you service-related messages that are necessary for the administration of your account."},{"number":19,"title":"California-Specific Privacy Rights","content":"CALIFORNIA-SPECIFIC PRIVACY RIGHTS\nThis section provides additional information for residents of California as required by the California Consumer Privacy Act, the California Privacy Rights Act, and related regulations.\n\nThe Shine the Light Law\nCalifornia Civil Code Section 1798.83, also known as the Shine The Light law, permits California residents to request information about the categories of personal information we have disclosed to third parties for their direct marketing purposes during the preceding calendar year, and the names and addresses of those third parties. California residents may submit such a request once per year and free of charge by contacting us using the details provided in the contact section of this policy.\n\nIf you are under 18 years of age and a California resident with a registered account on our platform, you have the right to request the removal of content or information that you have publicly posted on our services. To request removal, please contact us with your account email address and a statement that you are a California resident. We will make commercially reasonable efforts to ensure the content is not publicly displayed on our platform, though we cannot guarantee complete removal from all systems including backups and cached copies.\n\nCategories of Personal Information Collected (CCPA)\nThe following describes the categories of personal information we have collected from consumers in the past twelve months and how long we retain each category.\n\nCategory A: Identifiers, including real name, email address, unique personal identifier, and Internet Protocol address. We have collected this category of information. We retain identifiers for a period of six months following account termination.\n\nCategory B: Personal information as defined in the California Customer Records statute, including name and contact information. We have collected this category of information. We retain this information for as long as the user maintains an active account with us.\n\nWe have not collected the following categories in the past twelve months: protected classification characteristics such as gender and date of birth, commercial information such as purchase history, biometric information as defined by California law such as fingerprints and voiceprints, internet or network activity information such as browsing history and online behavior, precise geolocation data from devices, audio, electronic, or visual information collected in connection with business activities, professional or employment-related information, education information, inferences drawn from personal information to create profiles, or sensitive personal information as defined by the CPRA.\n\nHow We Use and Share California Consumer Information\nMore information about our data collection and sharing practices is set out throughout this privacy policy. For California-specific inquiries, you may contact us by email at support@xelta.ai or by visiting https://xelta.ai/contact.\n\nWe may disclose your personal information to our service providers pursuant to written contracts that require those providers to maintain the same level of privacy protection mandated by the CCPA. We use personal information for our own internal business purposes, including research and development, which does not constitute a sale of personal information. We have not sold or shared any personal information with third parties for a business or commercial purpose in the preceding twelve months, and we will not do so in the future.\n\nVerification of Rights Requests\nWhen you submit a request to exercise any of your California privacy rights, we are required to verify your identity to ensure that we disclose or delete information only to or at the direction of the individual to whom that information belongs. We accomplish this by asking you to provide certain information that we can match against information already in our records, or by contacting you through a communication channel such as your registered email address that you have previously used with us.\n\nWe will use the information you provide for verification purposes only and will not retain it for any other purpose. Where we cannot verify your identity from the information already in our possession, we may ask you to provide additional information. Any additional information collected solely for verification purposes will be deleted once verification is complete.\n\nIf you wish to submit a request through an authorized agent, the agent must provide proof of their authorization to act on your behalf. We may deny a request made through an authorized agent that cannot demonstrate valid authorization."},{"number":20,"title":"Do-Not-Track Signals","content":"DO-NOT-TRACK SIGNALS\nMost web browsers and some mobile operating systems and applications include a Do-Not-Track feature or setting that you can activate to signal your preference not to have your online browsing activities monitored and collected across websites.\n\nAt this time, no uniform technical standard for recognizing and responding to Do-Not-Track signals has been finalized or widely adopted across the industry. As a result, we do not currently respond to Do-Not-Track browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a recognized standard for online tracking is adopted in the future that requires our compliance, we will update this privacy policy to reflect our practices and notify you of the change."},{"number":21,"title":"Governing Law","content":"GOVERNING LAW\nThis Privacy Policy is primarily governed by and construed in accordance with the laws of the State of Delaware, United States of America, without regard to its conflict of law provisions. Xelta LLC. is incorporated in Delaware, which is the primary legal jurisdiction for our corporate operations.\n\nNotwithstanding the foregoing, where mandatory local laws apply, including the GDPR for EU and UK residents, the Digital Personal Data Protection Act for Indian residents, the UAE Personal Data Protection Law for UAE residents, and the CCPA and CPRA for California residents, those local laws will govern to the extent that they impose stricter obligations than Delaware law. We do not use this governing law provision to diminish the mandatory rights you have under your local law."},{"number":22,"title":"Do We Make Updates to This Notice?","content":"DO WE MAKE UPDATES TO THIS NOTICE?\nWe review this privacy policy regularly and may update it from time to time to reflect changes in our data practices, changes in applicable law, or changes to our services. When we make changes, we will update the Last Updated date at the top of this document.\n\nIf we make material changes to this privacy policy, meaning changes that significantly affect how we process your personal information or that significantly reduce your rights, we will notify you in advance. We may do this by posting a prominent notice on our platform, by sending you a notification through the application, or by emailing you at the email address associated with your account. We encourage you to review this privacy policy periodically to stay informed about how we are protecting your information.\n\nYour continued use of our services following the effective date of any updated privacy policy constitutes your acceptance of the updated terms. If you do not agree with the changes, you should cease using our services and may request deletion of your account."},{"number":23,"title":"How Can You Contact Us About This Notice?","content":"HOW CAN YOU CONTACT US ABOUT THIS NOTICE?\nIf you have any questions, comments, or concerns about this privacy policy or about our data practices, we encourage you to contact us. We are committed to addressing your concerns promptly and transparently.\n\nYou may contact our privacy team by email at support@xelta.ai for all privacy-related inquiries including requests to exercise your data rights.\n\nYou may contact our general support team by email at support@xelta.ai for questions about your account or our services.\n\nOur registered address for formal correspondence is H.NO. 906/15, Sonipat-131001, Haryana, India.\n\nYou may also visit our contact page at https://xelta.ai/contact to submit an inquiry through our online form."},{"number":24,"title":"How Can You Review, Update, or Delete Your Data?","content":"HOW CAN YOU REVIEW, UPDATE, OR DELETE YOUR DATA?\nBased on the applicable laws of your country or state, you may have the right to request access to the personal information we collect from you, to request that inaccurate information be corrected, or to request that your personal information be deleted. We take these rights seriously and will act on your requests in accordance with applicable law.\n\nTo request access to your personal information, we will provide you with a copy of the data we hold about you in a portable and readable format within the timeframe required by applicable law. To request correction of your information, please provide us with the information you believe is inaccurate and the correct information that should replace it. To request deletion of your personal information, we will delete or anonymize your data as requested, subject to any legal obligations that require us to retain certain information.\n\nTo submit any of these requests, please contact us at support@xelta.ai or visit https://xelta.ai/contact. Please include your full name, your registered email address, and a clear description of the request you are making. We may need to verify your identity before processing your request. We aim to respond to all requests within 30 days, although complex or numerous requests may take longer. We will inform you if we require an extension.\n\nPlease note that even after account deletion, we may retain certain information where we have a legitimate legal basis to do so, such as for fraud prevention, to resolve disputes, to enforce our agreements, or to comply with legal obligations. In such cases, we will inform you of the specific reason for retaining the information.\n\nLast Updated: April 25, 2026 | support@xelta.ai | https://www.xelta.ai"}]}}