xAI Privacy Policy

Last Updated: November 11, 2024 (previous version)

At X.AI Corp. ("xAI", "our", "us" or "we"), we value your privacy and are committed to being fair, accountable, and transparent in how we handle your personal information. Our Privacy Policy outlines how we collect and use your personal information when you use our websites, products, applications, and other xAI services (our "Service"). It also describes your privacy rights.

This Privacy Policy does not apply to data that we process on behalf of our enterprise or business customers, such as information managed through our API. Our processing of such data is governed by the terms and agreements established with each customer. If you wish to exercise your rights with respect to personal information processed under those agreements, please contact the company on whose behalf we are processing such data. They maintain control over your information and are responsible for addressing any requests.

Quick links

We recommend that you read this Privacy Policy in full to ensure you are completely informed about the processing of your personal information. However, to make it easier for you to access a particular section of this Privacy Policy, you can click on the relevant link below to jump to that section:

1. About xAI and Grok
2. Collection of your personal information
3. How we use your personal information (our purposes)
4. Sharing of your personal information
5. Marketing
6. Security of your personal information
7. Retention of your personal information
8. Links to other websites and social media features
9. Children's privacy
10. Your rights and choices
11. Additional information for individuals located in Europe
12. Additional information for U.S. residents
13. Changes to this Privacy Policy
14. How to contact us

1. About xAI and Grok

xAI is a US-based company working on building artificial intelligence tools to accelerate human scientific discovery. We are guided by our mission to advance our collective understanding of the universe. xAI is a separate company from X Corp ("X", previously Twitter).

For example, we have developed “Grok,” a conversational generative AI powered by xAI’s large language models. Grok’s training journey, and more information about Grok, is available on the xAI website.

2. Collection of your personal information

2.1 Personal information you provide

When you use our Service, communicate with us, or apply for a job, you provide certain personal information. This may include:

• Account Data:  When an xAI account is required to access the Service, we will collect your name, contact information, account credentials, and, where payment is required, Payment Data (described below). If you register or log into our Service using another service, that service will send your information to us. For example, when you use your existing X credentials to access the Service on an xAI website, X shares the following information with us at your direction: Twitter/X handle/username; your publicly visible name on X; numeric Twitter ID; the URL to your profile picture; and whether you are subscribed to X Premium.

• Payment Data: Where payment is required to access the Service, we may collect payment information (such as payment card information) directly from you and details regarding your transactions with us.

• Contact and Communications Data: If you communicate with us, we will collect contact information such as your name, email address, any other contact details you voluntarily choose to provide us, and any additional information you provide in your communications with us.

• Applicant Data: If you apply for a job or role with xAI, we will collect your personal information such as your contact details, resume/CV, education and work history, visa status, and other information obtained during interviews (including interview recordings and screenshots, where permissible). You also may choose to provide your gender, ethnicity, veteran status, disability status, and links to your website, blog, portfolio, LinkedIn or other public profiles.

• Social Media Information: We have pages on social media sites like Instagram, Facebook, Medium, X, YouTube and LinkedIn. When you interact with our social media pages, we collect personal information that you choose to provide to us, such as your contact details (collectively, “Social Data”). In addition, the companies that host our social media pages may provide us with aggregate information and analytics about our social media activity.

With the exception of our recruitment activities, we do not aim to collect sensitive personal information (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometric data, criminal background, or trade union membership) and ask that you do not provide us with any such information.

2.2 Personal information we collect when you use Grok

When you use or interact with Grok, whether on X or on our Service, we collect certain information from or about you. This may include:

• User Content: We collect personal information that is included in user prompts or inputs (like the text, photos, images, file uploads, and other materials you submit to Grok) ("Input") and the outputs generated by Grok (like the text responses that Grok generates based on your Input) ("Output") (together, "User Content"). If you include personal information in Inputs you provide to Grok, this information may be reproduced in the Output. Please do not share any personal information (including any sensitive information) in your Input to Grok.

• Feedback Data: We may collect your suggestions, recommendations, or other feedback relating to Grok. This might arise if, for example, in a given conversation with Grok, you report that Grok returned inaccurate information in an Output or you rate an Output to your Input using the thumbs-up/thumbs-down icons. If you provide such feedback, we may collect it even if you have opted out of our use of your information to train our models.

• Interaction Data: We also receive certain information about your use of Grok, such as the frequency and duration of interactions, the number and length of sessions, response times, and how often you use Grok over time. This may also include other usage data, such information about the features you engage with, the sequence of actions, and types of tasks performed.

We use this information to provide Grok's functionality to you, to improve your user experience, and to further train and improve our models.

2.3 Personal information we collect automatically

We automatically collect certain device and usage information when you use or interact with our Service (collectively, "Technical Usage Data"). This may include:

• Device data: Technical information such as your IP address, device type, country from which you access, browser type and version, browser plug-in types and versions, operating system.

• Usage data: Information about your use of the Service, pages you view, date and time of your visit, duration of visits, pages visited, browsing history, search history, traffic data, standard server log information, and other communication data.

• Inferred location data: your country-level, state-level and city-level location based on the IP address.

We may collect this information through our Service or through other methods of web analysis, including with the help of technologies, such as cookies, web beacons, and clear gifs. For more information about the tracking technologies currently deployed through our Service, see our Cookie Policy.

2.4 Personal information from other sources

The personal information we obtain from other sources may include:

• Publicly Available Data: We collect a variety of information that is publicly available on the internet to train and develop the models that power our Service. In some instances, this information may include personal information (for example, information about politicians, celebrities, published authors or other public figures) and sensitive information (for example, political opinions, religious or philosophical beliefs, or information concerning sexual orientation, among others).

• Public X Posts: We collect public posts shared on X, which includes the content of public posts, the date shared, and engagement data such as the number of followers associated with the account as well as the number of views, likes, reposts, shares, and replies.

• Internet Search Data: In responding to search queries, some aspects of the Service may include the ability to conduct a real-time web search of public results from the internet. In some instances, this data may include personal information.

• Licensed Datasets: Datasets we license from third party businesses.

In addition, for job applicants, we may receive personal information about you from our affiliated companies and third parties, such as recruitment agencies, social media platforms, and individuals who refer you. This information may include:

• Mailing addresses, job titles, email addresses, phone numbers, intent data (or user behavior data), IP addresses, social media profiles, LinkedIn URLs, and custom profiles.

• Resumes, reference information, and background check information.

3. How we use your personal information (our purposes)

We use your personal information for a variety of purposes, including:

• To process payments for our Service: We may process payment data in relation to access to certain features of our Service, as applicable.

• To provide and maintain our Service: We use your personal information to provide and maintain our Service (including to provide Output in response to Input).

• To provide support and assistance in relation to our Service, including to communicate with you and respond to your enquiries: We use your personal information to troubleshoot and diagnose problems, provide customer care and support services.

• To develop and improve our Service: We use your personal information for research and development purposes, to analyze trends to identify future opportunities for the development, promotion, and improvement of our Service. For example, we process Publicly Available Data and User Content to train and improve the models that power our Service.

• To ensure the security and integrity of our Service: We process your information to protect the security of the Service and our systems, and to detect and prevent fraud, unauthorized use, unlawful activity, and other misuses of our Service by reviewing your activity and User Content, investigating suspicious activity, and enforcing our terms and policies.

• To comply with our legal obligations: We process your personal information when cooperating with public and government authorities, courts or regulators in accordance with our legal obligations under applicable laws, to the extent this requires the processing or disclosure of personal information to protect our rights, or is necessary for protecting against misuse or abuse of our Service, protecting personal property or safety, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes, or to respond to lawful requests.

• To process job applications: We process your personal information if you apply for a job or role with xAI, to evaluate your application and make hiring decisions, communicate with you and inform you of current and future career opportunities (unless you tell us that you do not want us to keep your details for such purposes), manage and improve our recruiting and hiring processes, conduct reference and background checks (where required or permitted by applicable local law), and to detect and prevent security incidents or other deceptive, fraudulent, or illegal activity.

• For our business or commercial purposes: We may use your personal information for other legitimate business purposes, such as to identify new customers, data analysis, developing new products, identifying usage trends, and operating and expanding our business activities.

We may use your personal information for reasons not described in this Privacy Policy, where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal information for an unrelated purpose, we will notify you and explain the applicable legal basis.

4. Sharing of your personal information

We do not share your personal information with third parties, other than as follows:

• With our contracted vendors, service providers and consultants: To assist in providing the Service to you or performing business operations, we provide your personal information to vendors and service providers including providers of hosting services, cloud services, web analytics providers, content delivery services, support and safety monitoring services, and payment and transaction providers and other technology service providers, for the purposes described above.

• In connection with business transfers: In connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction, or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets to another company. If required by applicable laws, we will use reasonable efforts to notify you of any transfer of personal information to an unaffiliated third party.

• To comply with our legal obligations: To (i) comply with laws or to respond to lawful requests and legal process, (ii) protect the rights and property of xAI and our agents, customers, and others, including to enforce our agreements, policies, and terms of service, or (iii) in an emergency, to protect the personal safety of xAI, its customers, or any person.

• With our related companies: We may disclose personal information to our related companies to the extent such sharing is necessary to fulfill a request you have submitted via our Service or for customer management, customer support, technical operations, or the purposes described above.

We may also create and share anonymized, aggregated and de-identified usage data with our related companies and also with third parties to help us perform analysis and make improvements. Additionally, we may share anonymous usage data on an aggregate basis in the normal course of operating our business. For example, we may share information publicly to show trends in the use of our Service.

Save as expressly detailed above, we do not share, sell, or rent any of your personal information to any third party and will not do so without updating this Privacy Policy, notifying you, or, where necessary, obtaining your consent.

Please note that any personal information or other information you choose to submit in communities, forums, blogs, or chat rooms on our websites may be read, collected, and used by others who visit these forums or pages.

5. Marketing

We do not collect and use your personal information for marketing purposes and do not share your personal information with third parties for the purpose of marketing.

6. Security of your personal information

xAI takes reasonable precautions to safeguard your personal information, including through use of appropriate organizational and technical measures to help safeguard your personal information against accidental or unlawful destruction, loss, misuse, and unauthorized access, disclosure, alteration, and destruction.

However, no security measure or modality of data transmission over the internet is 100% secure. Although we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. As such, you acknowledge and accept that we cannot guarantee the security of your personal information and that any such transmission of your personal information to us is at your own risk. Once we have received your personal information, we will use strict procedures and security features to prevent unauthorized access to it. You are solely responsible for protecting your password, limiting access to your devices, and signing out of websites and online accounts after your sessions.

7. Retention of your personal information

We retain your personal information where we have an ongoing legitimate business need to do so (e.g., to provide you with a service you have requested or to comply with applicable legal requirements). In certain circumstances, we will need to keep your information for legal reasons after our contractual relationship has ended. The specific retention periods depend on the nature of the information and why it is collected and processed and the nature of the legal requirement.

For example, we may retain your personal information:

• when we have a legal obligation to do so (e.g., if we receive a court order, we would retain your information for longer than our usual retention periods);

• to deal with and resolve requests and complaints (e.g., if there is an ongoing complaint about you);

• to protect the safety, security, and integrity of our business and the Service, as well as to protect our rights and property and those of others (e.g., if we detect misuse of our Service or otherwise detect unusual activity on your account or in your interactions with us); and

• for litigation or regulatory matters (e.g., we would retain your information if there was an ongoing legal claim and the information was relevant to the claim).

8. Links to other websites and social media features

Our Service may contain hyperlinks to websites or plugins of social media platforms that are not operated by us. These hyperlinks and plugins are provided for your reference and convenience only. This Privacy Policy only applies to the personal information that we collect or which we receive as detailed in this Privacy Policy, and we cannot be responsible for personal information about you that is collected and stored by third parties.

Third party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites. We do not endorse or otherwise accept any responsibility or liability for the content of such third-party websites or third-party terms and conditions or policies.

9. Children's privacy

As noted in the Terms of Service, our Service is not directed at children or minors under the age of 18 and we do not knowingly collect any personal information from them. While we have taken measures to limit undesirable training data and outputs, Grok could produce output that is not appropriate for all ages.

If you are a child under the age of 18, please do not attempt to register for or otherwise use our Service. If we learn that we have inadvertently obtained personal information about a child under the age of 18 via our Service, or from any other source, then we will delete that information as soon as possible.

Please contact us at privacy@x.ai if you are aware that we may have inadvertently collected personal information from a child under the age of 18.

10. Your rights and choices

Depending on where you are located and subject to applicable legal exceptions, you may have certain rights in relation to your personal information. For more information on the rights that apply under European and US privacy laws, please see Sections 11 and 12 below.

11. Additional information for individuals located in Europe

If you are located in the European Economic Area ("EEA"), United Kingdom ("UK") or Switzerland (collectively, "Europe") the following disclosures apply:

Data controller

X.AI Corp. is the controller of your personal information as described in this Privacy Policy, unless otherwise specified.

Legal basis

When we process your personal information, we will only do so in the following situations:

• Contract: Where we need it to perform a contract with you, including where necessary to provide you our Service under our consumer Terms of Service (such as processing user prompts to provide a response).

• Legitimate interests: Where it is necessary for our legitimate interests (or those of a third party) and your interests and rights do not override our interests. Our legitimate interests include:

  • protecting our Service from abuse, fraud, or other misuses;

  • maintaining and improving our Service, including to train and improve the models that power our Service;

  • research and development, including developing new products and features;

  • ensuring the safety and security of our Service;

  • detecting, preventing, and enforcing violations of our terms including misuse of services, fraud, abuse, and other trust and safety protocols;

  • processing job applications and managing, improving, and safeguarding our recruiting and hiring processes; and

  • protecting our rights and the rights of others.

• Consent: Where you have given us your consent. When we process personal information based on your consent, it will be expressly indicated to you at the point and time of collection. You have the right to withdraw your consent at any time.

• Legal obligation: From time to time, we may also need to process personal information to comply with a legal obligation, if it is necessary to protect the vital interests of you or others, or if it is necessary for a task carried out in the public interest.

The following table provides more details on our purposes for processing your personal information and the related legal bases. The legal basis under which your personal information is processed will depend on the data concerned and the specific context in which we use it.

With the exception of our recruitment activities, we do not aim to collect sensitive personal information (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometric data, criminal background, or trade union membership) and ask that you do not provide us with any such information.

Automated decision-making

xAI does not make decisions or take actions against individuals in ways that could have a legal or significant impact on them.

In addition, in relation to Grok's training, xAI does not process training data for the purposes of inferring or deriving any sensitive or special category data about individuals and we do not actively seek out data sources that include sensitive or special category data.

International transfers

By using our Service, you understand and acknowledge that your personal information will be used, stored and/or accessed by us in the United States and disclosed to our service providers in other jurisdictions. We maintain primary data centers in the United States. We take steps designed to ensure that the personal information we collect under this Privacy Policy is processed as described in this Policy and according to applicable law.

When we provide any personal information about you to any non-UK and non-EEA third-party, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this Privacy Policy. These measures may include the following:

• Ensuring that there is an adequacy decision by the UK Government in the case of transfers out of the UK, or by the European Commission in the case of transfers out of the EEA, which means that the recipient country is deemed to provide adequate protection for such personal information; or

• Having in place standard contractual clauses with the recipient which have been approved by the UK Government for transfers out of the UK or by European Commission for transfers outside the EEA.

Further details on the steps we take to protect your personal information, in these cases, are available up on request by contacting us by email at privacy@x.ai at any time.

Your rights

• You may access, correct, update or request deletion of your personal information, subject to certain exceptions.

Please note that we cannot guarantee the factual accuracy of Output from our models. If Output contain factually inaccurate personal information relating to you, you can submit a correction request and we will make every effort to correct this information — but due to the technical complexity of our models, it may not always be possible for us to do so.

• You can object to processing of your personal information when our processing is based on our legitimate interests, ask us to restrict processing of your personal information or request portability of your personal information, (i.e., your data to be transferred in a readable and standardized format).

Please note you can opt-out of our use of your information to train our models by contacting us at privacy@x.ai.

• If we send you any marketing communications, you have the right to opt-out of marketing communications at any time. We may still send you non-promotional emails, such as emails about your Grok access or our ongoing business relations.

• If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

• You have the right to complain to a supervisory authority about our collection and use of your personal information. For more information, please contact your local supervisory authority. Contact details for supervisory authorities in the EEA and the UK are available here. Certain supervisory authorities may require that you exhaust our own internal complaints process before looking into your complaint.

If you have an xAI account to access the Service, some of these rights may be exercised through your account. You can also exercise your rights by contacting us at privacy@x.ai. We will consider all such requests and provide our response in accordance with applicable data protection laws.

Please note, however, that your personal information may be exempt from such requests in certain circumstances, for example if we need to keep using your information to comply with our own legal obligations or to establish, exercise or defend legal claims. If an exception applies, we will inform you when responding to your request. We may request that you provide us with information necessary to confirm your identity before responding to any request you make.

For more information on your rights with respect to data we use train out models, please read these FAQs.

12. Additional information for U.S. residents

Collection of your personal information

You can find a list of the categories of personal information that we collect in Section 2 “Collection of your personal information” above. The chart below provides additional details regarding the categories of personal information that we collect and have collected over the past 12 months. Please refer to the Sections above regarding how we collect your personal information, how we use your personal information, and how we disclose your personal information for further detail.

Some of the personal information described above may be deemed sensitive personal information under certain state privacy laws. We only collect such information for the purposes allowed by law or with your consent. We do not collect or process sensitive personal information with the purpose of inferring any characteristics about you and have not "sold" or "shared" (as those terms are defined under U.S. privacy laws) personal information. We also do not knowingly sell or share the personal information of individuals under the age of 18.

For more information on how your information is disclosed, please see Section 4 “Sharing of your personal information” above. As stated in Section 5 “Marketing” above, we do not share your personal information with third parties for their direct marketing purposes.

As stated in Section 7 “Retention of your personal information” above, we typically retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

For details regarding the sources from which we obtain personal information, please see Section 2 “Collection of your personal information” above. We collect and use personal information for the business or commercial purposes described in Section 3 “How we use your personal information (our purposes)” above.

Your rights

In addition to the rights detailed above in Sections 10 and 11 (e.g., your right to access, correct, or update your personal information), depending on what U.S. privacy law applies to you and subject to certain exceptions, you may also have the following rights:

• The right to submit certain privacy requests through an Authorized Agent.

• The right to request deletion of your personal information.

• The right to be free from discrimination for exercising the rights afforded to you under applicable privacy laws.

• The right to appeal a decision we make about your rights request.

Exercising your rights: Some of these rights may be exercised in the xAI service but others you will need to submit a request to privacy@x.ai. Once you have submitted your request, we will respond within the time frame permitted by applicable privacy laws.

Verification: In order to protect your personal information, your ability to exercise some of the rights detailed in this Privacy Policy may be subject to your ability to verify that you are the person about whom your request pertains. For example, we may require you to verify your identity by validating your account credentials. If we suspect fraudulent or malicious activity, we may ask you to supply additional information to allow us to verify your identity.

Authorized Agents: To exercise your rights using an Authorized Agent (as defined under applicable law), you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf. We reserve the right to deny a request from an Authorized Agent that does not submit proof that they have been authorized by you to act on your behalf.

Appeals:  If we refuse to take action on a request within a reasonable period of time after receiving your request, you may appeal our decision by emailing us at privacy@x.ai. In such an appeal, you must (1) provide sufficient information to allow us to verify that you are the person about whom the original request pertains and to identify the original request, and (2) provide a description of the basis of your appeal. Please note that your appeal will be subject to your rights and obligations afforded to you under applicable law. We respond to all appeal requests as soon as we reasonably can, and no later than legally required.

Do Not Track: Please note that because the effect of "Do Not Track" signals remains unclear, and because there continues to be no consistent industry understanding of how to respond to such a signal, we do not alter our privacy practices when we detect a "Do Not Track" signal from your browser.

13. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. If we make any changes, we will post an amended version and change the "Last Updated" date above. Where appropriate, we may provide you with notice prior to the update taking effect, such as by posting a conspicuous notice on our website or by contacting you using the email address you provided. Please review this Privacy Policy periodically.

If you use the Service after any changes to the Privacy Policy have been posted, that means you agree to all the changes.

14. How to contact us

If you have any queries or complaints about our collection, use or storage of your personal information, or if you wish to exercise any of your rights in relation to your personal information, please contact privacy@x.ai or by mail using the following contact details:

Attn: Privacy Team
X.AI Corp.
216 Park Road
Burlingame, CA 94010

In the EU:
Name: Lionheart Squared (Europe) Ltd
Email: xai@lionheartsquared.eu
Post: Lionheart Squared (Europe) Ltd
FAO x.ai
2 Pembroke House, Upper Pembroke Street 28-32
Dublin, D02 EK84, Republic of Ireland

In the UK:
Name: Lionheart Squared Limited
Email: xai@lionheartsquared.co.uk
Post: Lionheart Squared Limited
FAO x.ai
17 Glasshouse Studios, Fryern Court Road, Fordingbridge
Hampshire, SP6 1QX United Kingdom

In Switzerland:
Name: Lionheart Squared Switzerland SarL
Email: xai@lionheartsquared.ch
Post: Lionheart Squared Switzerland SarL
FAO x.ai
Blvd George Favon 43
CH-1204 Geneva

xAI Corp (@xAI) © 2024
All rights reserved.