xAI’s Europe Privacy Policy Addendum
Effective: April 7, 2025
xAI’s main Privacy Policy outlines how xAI collects and uses your personal information. If you are outside the European Economic Area, United Kingdom, and Switzerland (“Europe”), you only need to read the main Privacy Policy. If you are in Europe, this Europe Privacy Policy Addendum is a continuation of the main Privacy Policy and adds information that is specific to Europe.
If you are located in the European Economic Area ("EEA"), United Kingdom ("UK") or Switzerland (collectively, "Europe") the following disclosures apply:
13.1 Data controller
X.AI LLC, which is based in the USA, is the controller of your personal information as described in this Privacy Policy, unless otherwise specified. See section 12 of the main Privacy Policy for how to contact xAI.
13.2 Legal basis
We provide below more details on the purposes for which we process your personal information, what information we process for each purpose, and the related legal bases.
- To process payments for our Service
- We process Account Data, Communication Data, and Payment Data
- This is necessary to perform our contract with you, or - if there is no contract - this is necessary for our legitimate interest in processing a payment at your request
- To provide our Service (including to provide Output in response to Input)
- We process Account Data, Communication Data, User Content, Public X Posts and internet search data and Technical Usage Data
- This is necessary to perform our contract; otherwise this is necessary for our legitimate interests (to provide and maintain our Service, including customising Output in response to your prompts and- for over-18 users who use X to sign in to our Service - personalising the interaction with the Service)
- To provide support and assistance in relation to our Service
- We process Account Data, Communication Data, Technical Usage Data, User Content and Feedback Data
- This is necessary to perform our contract with you; otherwise, this is necessary for our legitimate interest to operate, provide and improve our business and to communicate with you
- To develop and improve our Service
- We process Communication Data, User Content, Feedback Data and Technical Usage Data
- This is necessary for our legitimate interest in improving and developing our Service
- To train and improve our models
- We process Publicly available data, User Content, X Public posts for over 18 year olds and Feedback Data
- This is necessary for our legitimate interests in improving the accuracy and performance of our models used to power the Services and to train more advanced models
- To ensure the security and integrity of our Service
- We process Account Data, Communication Data, User Content, Feedback Data and Technical Usage Data
- This is necessary for our and others’ legitimate interests (to detect or prevent activities which are illegal or breach our Terms of Service or Authorized Use Policy, and/or to manage the security of our IT infrastructure, and the safety and security of our employees, customers and vendors)
- To comply with our legal obligations
- We process Account Data, Communications Data, User Content, Feedback Data and Technical Usage Data
- This is necessary to comply with legal obligations in Europe (such as for age assurance or to protect our IT infrastructure); otherwise, this is necessary for our legitimate Interests in protecting against misuse or abuse of our Service, protecting personal property or safety, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes, or to respond to lawful requests
- For our business or commercial purposes
- We process Account Data, Communication Data, Social Data, User Content, Feedback Data and Technical Usage Data
- This is necessary for our legitimate interests (to identify new customers, data analysis, developing new products, identifying usage trends, and operating and expanding our business activities)
We do not aim to collect sensitive personal information (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometric scans, criminal background, or trade union membership) and ask that you do NOT provide us with any such information.
When we process your personal information because this is necessary for our, or someone else’s legitimate interests, we have carried out a balancing test to document our interests, to consider what the impact of the processing is on individuals, and to determine if those interests outweigh our interests in the processing taking place. You can find out more information about this balancing test by using the contact details at the end of this notice.
We process all of your personal information in the United States, where we maintain our primary data centers.
We use service providers that may be involved in processing personal information as listed on our subprocessor page. These companies either participate in the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework and the UK extension to the EU-US Data Privacy Framework, which offer adequate protection for European personal information; or we have standard contractual clauses in place with them (including text from modules 1 and 2) which have been approved by the UK, European Commission, and Switzerland.
We share parts of Input Data with Brave Software, Inc., so we can include Brave’s search results in the Service. Brave’s privacy policy is linked here.
We have Google Payments, Apple Pay and Stripe conduct payment processing services (respective privacy policies linked). They do not share your credit card information with us.
13.4 Your rights
- You may access, correct, update, or request deletion of your personal information.
- Please note that we cannot guarantee the factual accuracy of Output from our models. If Output contains factually inaccurate personal information relating to you, you can submit a correction request and we will make reasonable efforts to correct this information — but due to the technical complexity of our models, it may not be feasible for us to do so.
- You can object to processing of your personal information when our processing is based on our legitimate interests, ask us to restrict processing of your personal information or request portability of your personal information, (i.e., your data to be transferred in a readable and standardized format).
- Please note you can object to our use of your information to train our models in your settings. See Consumer FAQs.
- You have the right to opt-out of any marketing communications we may send at any time and to opt-out of profiling for purposes of direct marketing. We may still send you non-promotional emails, such as emails about your Grok access, legally required notices, or our ongoing business relations.
- If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
- You have the right to complain to a supervisory authority about our collection and use of your personal information. For more information, please contact your local supervisory authority. Contact details for supervisory authorities in the EEA and the UK are available here. Certain supervisory authorities may require that you exhaust our own internal complaints process before looking into your complaint.
- In France, you can choose to ask us to keep or destroy your personal information, after your death, to a nominated third party. You may also be able to ask us to disclose your personal information, after your death, to a specified recipient.
If you have an xAI account to access the Service, some of these rights may be exercised through your account. See Consumer FAQs. You can also exercise your rights by contacting us at https://privacy.x.ai/.
If you are not a user of the Service but wish to exercise any of the above rights to the extent that they may be applicable, you can do so by contacting us at https://privacy.x.ai/.
Sometimes your personal information may be exempt from such requests, for example if we need to keep using your information to comply with our own legal obligations or to establish, exercise or defend legal claims. If an exception applies, we will inform you when responding to your request. We may request that you provide us with information necessary to confirm your identity before responding to your request.
For more information on your rights with respect to data we use train out models, please read these Consumer FAQs.
To contact us, please see Section 12 in the main Privacy Policy.