Privacy Policy

xta is run by LetsChop. For your account details and how you use xta, we decide how your information is used: in legal terms, we are the “data controller”.

The content an organisation puts into its workspace is a little different. The organisation decides what goes in, and we look after it on the organisation's behalf (see section 12).

Things you give us

• Account details: your name, email address and password. We store the password only as a secure hash, never as you typed it.
• Workspace details: your organisation’s name and logo, the people on your team and their roles.
• Workspace content: your company profile, products, storylines, timeline events, funding opportunities, applications, drafted and edited answers, review comments and memory.
• Messages you send us, for example when you ask for help.
• Payment details, if you buy a paid plan. Our payment provider collects these; we only receive a record of the payment, never your full card number.

Things collected when you use xta

• Sign-in sessions, kept in secure cookies so you stay signed in (see section 11).
• Your IP address, used briefly to stop abuse, such as too many sign-in attempts. We don’t store it with your account.
• Records of the emails we send you (invites, password resets, review requests), so we can retry ones that fail.
• Usage counts, such as how many AI drafts your workspace has used this month, to apply plan limits.

We don't use advertising trackers, and we don't buy information about you from anyone else.

• To run xta for you: create your account and workspace, draft and store answers, run reviews and send the emails xta needs to work. We need this to provide the service you signed up for.
• To keep xta safe: prevent fraud and abuse, protect accounts and fix problems. This is in our legitimate interest, and yours.
• To improve xta: understand which features help, using information that doesn't identify you where we can.
• To follow the law: for example, keeping payment records or answering lawful requests from authorities.

Where we rely on your consent, such as for optional shared insights (section 6), you can withdraw it at any time.

We don't sell your information, we don't use it for advertising, and we don't send you marketing emails unless you ask for them.

When you ask xta to draft an answer, score an opportunity or read an application form, we send the parts of your workspace content that are needed for that task to an AI model. We use OpenRouter to reach models from providers such as Anthropic, Google and OpenAI, and may call Anthropic directly.

• We only route your content to AI providers that don’t keep it or use it to train their models.
• We don’t use your content to train any AI models of our own.
• Only what a task needs is sent, and only when you or your team ask for that task.

We share information only with companies that help us run xta, and only what they need:

• Hosting and storage providers, which run our servers, database and file storage (currently including Amazon Web Services).
• AI providers, as described in section 4.
• Our email provider, to deliver the emails xta sends.
• Our payment provider, if you buy a paid plan.

These companies may only use your information to provide their service to us. Inside xta, the people in your workspace can see its content, according to their role.

We may also share information:

• when the law requires it, for example a valid court order;
• to protect the rights, safety or property of our users, the public or us; or
• if xta is sold or merged with another business. The new owner would have to respect this policy, and we would tell you first.

We may offer insights built from many organisations, for example which funders suit organisations like yours. This is off by default. It only uses information from workspaces that choose to take part, combined and made anonymous so that no organisation or person can be identified and no workspace content is revealed. Your workspace content itself never leaves your workspace. An owner or admin can turn it off at any time.

Our servers and service providers may be outside your country, including in the European Union and the United States. When your information is moved across borders, we use providers with strong security and contracts that protect it to the standard required by the Nigeria Data Protection Act 2023 and, where it applies, the GDPR.

• Everything sent between your browser and xta is encrypted (HTTPS).
• Passwords are stored as secure hashes. Sign-in tokens live in cookies that page scripts can’t read, and we store only scrambled versions of them.
• Each workspace is kept separate. Every request is checked so people can only see the workspaces they belong to.
• Files are stored privately and only served to members of the workspace they belong to.

No system is perfectly secure. If a breach affects your information, we will tell you and the regulators without undue delay, as the law requires.

• Account and workspace content: for as long as your account or workspace is open. When it is closed, we delete it within 30 days, apart from copies in backups, which are removed as those backups expire.
• Files you replace or remove: deleted after a short grace period, usually 24 hours.
• Records of emails we have sent: deleted after 30 days.
• Payment records: kept for as long as tax and accounting law requires.
• If you are removed from a workspace, a record that you were a member stays with that workspace, so its history makes sense.

Under the Nigeria Data Protection Act 2023 and, where they apply, the GDPR and UK GDPR, you can ask us to:

• give you a copy of your information;
• correct information that is wrong;
• delete your information;
• give you your information in a format you can move to another service;
• stop or limit how we use it, or object to a use; and
• withdraw any consent you have given.

You can update most details yourself in xta. For anything else, email [email protected]. We will reply within 30 days and may need to confirm your identity first. For content in an organisation's workspace, we may pass your request to that organisation (see section 12).

If you are unhappy with how we handle your information, please tell us first. You can also complain to the Nigeria Data Protection Commission or the data protection authority where you live.

We use only the cookies xta needs to work: two sign-in cookies (xta_at and xta_rt) that keep you signed in securely. We don't use advertising or tracking cookies, so there is nothing to opt out of.

Organisations often add information about people to their workspace, such as team bios, advisers or partners. For that content, the organisation decides what is collected and why, and we process it on their behalf and on their instructions.

If you are named in a workspace and want to see, correct or remove that information, contact the organisation first. You can also email us and we will help.

xta is for people aged 18 and over. We don't knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.

We may update this policy as xta changes. The date at the top shows when it last changed. If a change is significant, we will tell you by email or in xta before it takes effect.

Questions or requests about your privacy? Email us at [email protected]. See also our Terms of Use.