Privacy policy

xAI Privacy Policy

Last Updated: 15 March 2024

At X.AI Corp. ("xAI", "our", "us" or "we"), we value your privacy and are committed to being fair, accountable, and transparent in how we handle your personal information. Our Privacy Policy outlines how we collect and use your personal information, when you use our websites, products (like Grok) and other xAI services (our "Services"). It also describes your privacy rights.

This Privacy Policy does not apply to personal information we process for and on behalf of our customers, like X Corp. ("X", previously Twitter). In that case, the enterprise customer's privacy policy or other agreement between you and them, and not this Privacy Policy, would apply to such processing. If you wish to discontinue such processing or otherwise exercise your rights with respect to such personal information, please contact the enterprise on whose behalf we are processing such data. For example, your use of Grok on X is governed by the X Privacy Policy and Terms, not this Privacy Policy.

Quick links

We recommend that you read this Privacy Policy in full to ensure you are completely informed about the processing of your personal information. However, to make it easier for you to access a particular section of this Privacy Policy, you can click on the relevant link below to jump to that section:

About xAI and Grok
Collection of your personal information
How we use your personal information (our purposes)
Sharing of your personal information
Marketing
Security of your personal information
Retention of your personal information
Links to other websites and social media features
Children's privacy
Your rights and choices
Additional information for individuals located in Europe
Additional Information for U.S. residents
Changes to this Privacy Policy
How to contact us

1. About xAI and Grok

xAI is a US-based company working on building artificial intelligence tools to accelerate human scientific discovery. We are guided by our mission to advance our collective understanding of the universe. xAI is a separate company from X Corp ("X", previously Twitter).

We have developed a conversational generative AI chatbot powered by Grok, a large language model ("LLM") that performs natural language processing tasks, including question answering, information retrieval, creative writing, and coding assistance. Grok’s training journey, and more information for access to Grok, is available on the xAI website and Model Card.

2. Collection of your personal information

2.1 Personal information you provide

When you use our Services or communicate with us, you provide certain personal information. This may include:

Registration Data: When you use your existing X credentials to access Grok on the xAI website, X shares the following information with us at your direction: Twitter/X handle/username; your publicly visible name on X; numeric Twitter ID; the URL to your profile picture; and whether you are subscribed to X Premium.
Payment Data: We may collect payment information directly from you and details regarding your transactions with us.
Contact and Communications Data: If you communicate with us, we will collect contact information such as your name, email address, any other contact details you voluntarily choose to provide us, and any additional information you provide in your communications with us.
Prompt Data (or search queries) and Output Data: Grok allows you to submit search queries in free text format ("Prompts"), which will generate text responses based on your Prompts ("Outputs") (together, "Conversation Data"). If you include personal information in your Prompts, this information may be reproduced in the Outputs. Please do not share any personal information (including any sensitive information) in your questions to Grok.
Feedback Data: Where applicable, we will collect your Feedback (as defined in our Terms of Use). This might arise if, for example, in a given conversation with Grok you report that Grok returned inaccurate information in an Output, or if you rate an Output to your Prompt using the thumbs-up/ thumbs-down icons.
Applicant Data: If you apply for a job with xAI, we will collect your personal information such as your contact details, resume/CV, education and work history, and visa status. You also may choose to provide your gender, ethnicity, veteran status, disability status, and links to your website, blog, portfolio, LinkedIn or other public profiles.
Social Media Information: We have pages on social media sites like Instagram, Facebook, Medium, X, YouTube and LinkedIn. When you interact with our social media pages, we collect personal information that you choose to provide to us, such as your contact details (collectively, “Social Data”). In addition, the companies that host our social media pages may provide us with aggregate information and analytics about our social media activity.

With the exception of our recruitment activities, we do not aim to collect sensitive personal information (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometric data, criminal background, or trade union membership) and ask that you do not provide us with any such information.

2.2 Personal information we collect automatically

We automatically collect certain device and usage information when you use or interact with our Services (collectively, "Technical Usage Data"). This includes:

Device data: Technical information such as your IP address, device type, country from which you access, browser type and version, browser plug-in types and versions, operating system.
Usage data: Information about your use such as links you click, pages you view, date and time of your visit, duration of visits, pages visited, browsing history, search history, traffic data, standard server log information, and other communication data.
Inferred location data: your country-level location based on the IP address.

We may collect this information through our Services or through other methods of web analysis, including with the help of technologies, such as cookies, web beacons, and clear gifs.

2.3 Personal information from other sources

The personal information we obtain from other sources includes:

Publicly available data: Like most LLM's today, Grok has been pre-trained on a variety of data from publicly available sources (i.e., open-source public data sets) which mainly consist of raw web page data, metadata extracts, and text extracts from the Internet up to Q3 2023. We only use publicly available information that is freely and openly available on the Internet. xAI does not access password protected pages or bypass CAPTCHA controls, nor seek personal information behind paywalls or from the dark web. In some instances, this pre-training data may incidentally include personal information (for example, information about politicians, celebrities, published authors or other public figures) and sensitive information (for example, political opinions, religious or philosophical beliefs, or information concerning sexual orientation, among others). We take steps to minimize the processing of personal and sensitive data for our training purposes.

For clarity, xAI does not actively seek out personal information to train our models and we do not use any personal information to build individual profiles, to contact or advertise to individuals, to try to sell them anything, or to sell the personal information itself.

Public X posts and Internet search data: In responding to search queries, Grok has a feature that allows it to search public X posts and conduct a real-time web search of public results from the Internet. Grok’s access to real-time data allows Grok to respond to search queries with up-to-date information and insights on a wide range of topics. In some instances, this data may include personal information.

In addition, we may receive personal information about you from our affiliated companies and third parties, such as recruitment agencies and social media platforms. This information may include:

Mailing addresses, job titles, email addresses, phone numbers, intent data (or user behavior data), IP addresses, social media profiles, LinkedIn URLs, and custom profiles.
Resumes and background check information.

3. How we use your personal information (our purposes)

We use your personal information for a variety of purposes, including:

To process payment for our Services: in relation to access to certain features of our Services, as applicable.

To provide our Services (including to provide Outputs in response to Prompts): We use your personal information to operate and provide our Services and to tailor our Services to your needs and preferences to perform our contract with you.
To provide support and assistance in relation to our Services, including to communicate with you and respond to your enquiries: We use your personal information to troubleshoot and diagnose problems, provide customer care and support services.
To maintain and improve our Services: We use your personal information for research and development purposes, to analyze trends to identify future opportunities for the development, promotion, and improvement of our Services. For example, we use data, often in a de-identified form, to develop new features, capabilities, or products, improve the user experience, assess capability requirements, and identify customer opportunities.
To train and fine-tune our LLM: xAI will process (i) publicly available data, public X posts and Internet search data (see Section 2.3 above), and (ii) a subset of Conversation Data and Feedback Data you voluntarily choose to provide to us, for training and fine-tuning purposes (e.g., to improve the accuracy of responses, the style of the responses, detect errors, etc.). This means that when you interact with Grok, your questions and responses provided by Grok may be used to train the LLM.
To ensure the security and integrity of our Services: We do this by preventing and detecting fraud, unauthorized use, and other unlawful use of our Services by verifying activity, investigating suspicious activity, and enforcing our terms and policies.
To comply with our legal obligations: We process your personal information when cooperating with public and government authorities, courts or regulators in accordance with our legal obligations under applicable laws, to the extent this requires the processing or disclosure of personal information to protect our rights, or is necessary for protecting against misuse or abuse of our Services, protecting personal property or safety, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes, or to respond to lawful requests.
To process job applications: We process your personal information if you apply for a job with xAI, to evaluate your application and make hiring decisions, communicate with you and inform you of current and future career opportunities (unless you tell us that you do not want us to keep your details for such purposes), manage and improve our recruiting and hiring processes, or to conduct reference and background checks where required or permitted by applicable local law.
For our business or commercial purpose: We may use your personal information for other legitimate business purposes, such as to identify new customers, data analysis, developing new products, identifying usage trends, and operating and expanding our business activities.

In carrying out these purposes, we combine data we collect from different contexts or that we obtain from third parties to give you a more seamless, consistent, and personalized experience, to make informed business decisions, and for other legitimate purposes.

We may use your personal information for reasons not described in this Privacy Policy were permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal information for an unrelated purpose, we will notify you and explain the applicable legal basis.

4. Sharing of your personal information

We do not share your personal information with third parties, other than as follows:

With our contracted vendors, service providers and consultants: To assist in providing the Services to you or performing business operations, we provide your personal information to vendors and service providers including hosting services, cloud services, web analytics providers, and payment processors, among others, for the purposes described above.
In connection with business transfers: In connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction, or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets to another company. If required by applicable laws, we will use reasonable efforts to notify you of any transfer of personal information to an unaffiliated third party.
To comply with our legal obligations: To (i) comply with laws or to respond to lawful requests and legal process, (ii) protect the rights and property of xAI and our agents, customers, and others, including to enforce our agreements, policies, and terms of use, or (iii) in an emergency, to protect the personal safety of xAI, its customers, or any person.
With our related companies: We may disclose personal information to our related companies to the extent such sharing is necessary to fulfil a request you have submitted via our Services or for customer management, customer support, technical operations, or the purposes described above.

We may also share anonymized, aggregated and de-identified usage data with our related companies and also with third parties to help us perform analysis and make improvements. Additionally, we may share anonymous usage data on an aggregate basis in the normal course of operating our business. For example, we may share information publicly to show trends in the use of our Services.

Save as expressly detailed above, we do not share, sell, or rent any of your personal information to any third party and will not do so without updating this Privacy Policy, notifying you, or, where necessary, obtaining your consent.

Please note that any personal information or other information you choose to submit in communities, forums, blogs, or chat rooms on our websites may be read, collected, and used by others who visit these forums or pages.

5. Marketing

We do not collect and use your personal information for marketing purposes and do not share your personal information with third parties for the purpose of marketing.

6. Security of your personal information

xAI takes reasonable precautions to safeguard your personal information, including through use of appropriate organizational and technical measures to help safeguard your personal information against accidental or unlawful destruction, loss, misuse, and unauthorized access, disclosure, alteration, and destruction.

However, no security measure or modality of data transmission over the Internet is 100% secure. Although we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. As such, you acknowledge and accept that we cannot guarantee the security of your personal information and that any such transmission of your personal information to us is at your own risk. Once we have received your personal information, we will use strict procedures and security features to prevent unauthorized access to it. You are solely responsible for protecting your password, limiting access to your devices, and signing out of websites and online accounts after your sessions.

7. Retention of your personal information

We retain your personal information where we have an ongoing legitimate business need to do so (e.g., to provide you with a service you have requested or to comply with applicable legal requirements). In certain circumstances, we will need to keep your information for legal reasons after our contractual relationship has ended. The specific retention periods depend on the nature of the information and why it is collected and processed and the nature of the legal requirement.

For example:

we keep your personal information when we have a legal obligation to do so (e.g., if we receive a court order, we would retain your data for longer than our usual retention periods);
to deal with and resolve requests and complaints (e.g., if there is an ongoing complaint about you); and
to protect individuals' rights and property and for litigation or regulatory matters (e.g., we would retain your information if there was an ongoing legal claim and the information was relevant to the claim).

8. Links to other websites and social media features

Our Services may contain hyperlinks to websites or plugins of social media platforms that are not operated by us. These hyperlinks and plugins are provided for your reference and convenience only. This Privacy Policy only applies to the personal information that we collect or which we receive as detailed in this Privacy Policy, and we cannot be responsible for personal information about you that is collected and stored by third parties.

Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such third-party websites or third-party terms and conditions or policies.

9. Children's privacy

As noted in the Terms of Use, our Services are not directed at children or minors under the age of 18 and we do not knowingly collect any personal information from them. While we have taken measures to limit undesirable training data and outputs, Grok could produce output that is not appropriate for all ages.

If you are a child under the age of 18, please do not attempt to register for or otherwise use our Services. If we learn that we have inadvertently obtained personal information about a child under the age of 18 via our Services, or from any other source, then we will delete that information as soon as possible.

Please contact us at [email protected] if you are aware that we may have inadvertently collected personal information from a child under the age of 18.

10. Your rights and choices

Depending on where you are located and subject to applicable legal exceptions, you may have certain rights in relation to your personal information. For more information on the rights that apply under European and US privacy laws, please see Sections 11 and 12 below.

11. Additional information for individuals located in Europe

If you are located in the European Economic Area ("EEA"), United Kingdom ("UK") or Switzerland (collectively, "Europe") the following disclosures apply:

Data controller

X.AI Corp. is the controller of your personal information as described in this Privacy Policy, unless otherwise specified.

Legal basis

When we process your personal information, we will only do so in the following situations:

Contract: Where we need it to perform a contract with you. For example, we process your Registration Data, Payment Data, Contact and Communications Data to provide you our Services under our Terms of Use.
Legitimate interests: Where it is necessary for our legitimate interests (or those of a third party) and your interests and rights do not override our interests. Our legitimate interests include:
protecting our Services from abuse, fraud, or security risks;
maintaining and improving our Services, including when we train and fine-tune our LLM;
research and development, including developing new products and features;
ensuring the security of our Services;
detecting, preventing, and enforcing violations of our terms including misuse of services, fraud, abuse, and other trust and safety protocols; and
protecting our rights and the rights of others.
Consent: Where you have given us your consent. When we process personal information based on your consent, it will be expressly indicated to you at the point and time of collection. You have the right to withdraw your consent at any time.
Legal obligation: From time to time, we may also need to process personal information to comply with a legal obligation, if it is necessary to protect the vital interests of you or others, or if it is necessary for a task carried out in the public interest.

The following table provides more details on our purposes for processing your personal information and the related legal bases. The legal basis under which your personal information is processed will depend on the data concerned and the specific context in which we use it.

Purpose	Type of Data	Legal Basis
To process payment for our Services	Registration Data Contact and Communications Data Payment Data	Contract
To provide our Services (including to provide Outputs in response to Prompts)	Publicly available data Public X posts and Internet search data Registration Data Payment Data Contact and Communications Data Conversation Data Technical Usage Data	Contract
To provide support and assistance in relation to our Services	Registration Data Contact and Communications Data Technical Usage Data Conversation Data Feedback Data	Contract Otherwise, as necessary for our legitimate interests (to operate, provide and improve our business; to communicate with you).
To maintain and improve our Services	Contact and Communications Data Conversation Data Feedback Data Technical Usage Data	Legitimate Interests (to improve our business).
To train and fine-tune our LLM	Publicly available data Public X posts and Internet search data Conversation Data Feedback Data	Legitimate Interests Consent
To ensure the security and integrity of our Services	Registration Data Payment Data Contact and Communications Data Conversation Data Feedback Data Technical Usage Data	Necessary for our and our third parties' legitimate interests (to detect or prevent illegal activities and/or to manage the security of our IT infrastructure, and the safety and security of our employees, customers and vendors).
To comply with our legal obligations	Registration Data Payment Data Contact and Communications Data Conversation Data Feedback Data Technical Usage Data	Legal obligation Legitimate Interests (in protecting against misuse or abuse of our Services, protecting personal property or safety, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes, or to respond to lawful requests)
To process job applications	Applicant Data	Legal obligation Legitimate Interests (in assessing the suitability of our candidates and managing our recruiting process) Consent
For our business or commercial purposes	Registration Data Contact and Communications Data Social Data Conversation Data Feedback Data Technical Usage Data	Legitimate Interests (to identify new customers, data analysis, developing new products, identifying usage trends, and operating and expanding our business activities)

Automated decision-making and profiling

Grok does not derive predictions or inferences about individuals. xAI is not creating any profiles on individuals, and it does not make decisions or take actions against data subjects in ways that could have a legal or significant impact on them.

In addition, in relation to Grok's training, xAI is not processing the training data for the purposes of inferring or deriving any personal information, including any special category data and xAI has not actively sought out data sources that include sensitive data. Moreover, xAI has implemented and will continue to implement measures to minimize and eliminate any personal information processing for training purposes.

International transfers

By using our Services, you understand and acknowledge that your personal information will be used, stored and/or accessed by us (an entity based in the United States) and disclosed to our service providers in other jurisdictions. We maintain primary data centers in the United States. We take steps designed to ensure that the personal information we collect under this Privacy Policy is processed as described in this Policy and according to applicable law wherever the data subjects are located.

When we provide any personal information about you to any non-UK and non-EEA third-party, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this Privacy Policy. These measures may include the following:

Ensuring that there is an adequacy decision by the UK Government in the case of transfers out of the UK, or by the European Commission in the case of transfers out of the EEA, which means that the recipient country is deemed to provide adequate protection for such personal information including reliance on the EU-U.S. Data Privacy Framework ("EU-U.S. DPF") and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce; or
Having in place standard contractual clauses with the recipient which have been approved by the European Commission for transfers outside the EEA or the UK Government for transfers out of the UK.

Further details on the steps we take to protect your personal information, in these cases, are available up on request by contacting us by email at [email protected] at any time.

Your rights

You may access, correct, update or request deletion of your personal information, subject to certain exceptions.

Please note that we cannot guarantee the factual accuracy of Outputs. If Outputs contain factually inaccurate personal information relating to you, you can submit a correction request and we will make every effort to correct this information —but due to the technical complexity of our LLM, it may not always be possible for us to do so.

You can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information, (i.e., your data to be transferred in a readable and standardized format).
If we send you any marketing communications, you have the right to opt-out of marketing communications at any time. We may still send you non-promotional emails, such as emails about your Grok access or our ongoing business relations.
If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
You have the right to complain to a supervisory authority about our collection and use of your personal information. For more information, please contact your local supervisory authority. Contact details for supervisory authorities in the EEA and the UK are available here. Certain supervisory authorities may require that you exhaust our own internal complaints process before looking into your complaint.

You can exercise your rights by contacting us at [email protected]. We will consider all such requests and provide our response in accordance with applicable data protection laws.

Please note, however, that certain personal information may be exempt from such requests in certain circumstances, for example if we need to keep using the information to comply with our own legal obligations or to establish, exercise or defend legal claims. If an exception applies, we will inform you when responding to your request. We may request you provide us with information necessary to confirm your identity before responding to any request you make.

12. Additional Information for U.S. residents

Collection of your personal information

The chart below provides additional details regarding the categories of personal information that we collect and have collected over the past 12 months. Please refer to the sections above regarding how we collect your personal information, how we use your personal information, and how we disclose your personal information for further detail.

Category of Personal Information	Categories of Third Parties With Whom We Share this Personal Information
Identifiers, including Registration Data we receive when you log into our platform and Contact and Communications Data you provide to us	Service providers, analytics partners, and parties you authorize, access, or authenticate.
Payment Data, to facilitate your transactions with us	Service providers.
Commercial information, such as records of your transaction history	Service providers, analytics partners, and parties you authorize, access, or authenticate.
Internet or other electronic network activity information , including your Technical Usage Data.	Service providers, analytics partners, and parties you authorize, access, or authenticate.
Photos, including as provided in the Registration Data we receive when you log into our platform	Service providers, analytics partners, and parties you authorize, access, or authenticate.
Other identifying information that you voluntarily choose to provide, including in the form of Conversation Data, Feedback Data, Social Media Information	Service providers, analytics partners, and parties you authorize, access, or authenticate.
Applicant data California applicants, please refer to our California Applicant Notice	Service providers, analytics partners, and parties you authorize, access, or authenticate.

We do not collect or process sensitive personal information with the purpose of inferring any characteristics about you and have not "sold" or "shared" (as those terms are defined under U.S. privacy laws) personal information.

Your rights

In addition to the rights detailed above in Sections 10 and 11, depending on what U.S. privacy law applies to you and subject to certain exceptions, you may also have the following rights :

The right to submit certain privacy requests through and Authorized Agents
The right to request deletion of your personal information
The right to be free from discrimination for exercising the rights afforded to you under applicable privacy laws

Exercising your rights: Some of these rights may be exercised in the xAI service but others you will need to submit a request to [email protected].

Verification: In order to protect your personal information, your ability to exercise some of the rights detailed in this Privacy Policy may be subject to your ability to verify that you are the person about whom your request pertains. For example, we may require you to verify your identity by validating your X account credentials. If we suspect fraudulent or malicious activity, we may ask you to supply additional information to allow us to verify your identity.

Authorized Agents: To exercise your rights using an Authorized Agent (as defined under applicable law). To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf.

Appeals: The right to appeal a decision we make. If we refuse to take action on a request within a reasonable period of time after receiving your request, you may appeal our decision by emailing us at [email protected]. In such an appeal, you must (1) provide sufficient information to allow us to verify that you are the person about whom the original request pertains and to identify the original request, and (2) provide a description of the basis of your appeal. Please note that your appeal will be subject to your rights and obligations afforded to you under applicable law.

Do Not Track: Please note that because the effect of "Do Not Track" signals remains unclear, and there continues to be no consistent industry understanding of how to respond to such a signal, we do not alter our privacy practices when we detect a "Do Not Track" signal from your browser.

13. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. If we make any changes, we will post an amended version and change the "Last Updated" date above. Where appropriate, we may provide you with notice prior to the update taking effect, such as by posting a conspicuous notice on our website or by contacting you using the email address you provided. Please review this Privacy Policy periodically.

If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all the changes.

14. How to contact us

If you have any queries or complaints about our collection, use or storage of your personal information, or if you wish to exercise any of your rights in relation to your personal information, please contact [email protected] or by mail using the following contact details:

X.AI Corp. 216 Park Road Burlingame, CA 94010