Privacy Policy

1. Introduction

Xiaotime Labs ("we", "us", "our") operates the xiaotimelabs.ai website and the Integrated Cyber Risk Governance (ICRG) platform (the "Service"). This Privacy Policy describes how we collect, use, and protect your information.

2. Information We Collect

We may collect the following types of information:

• Account Information: Name, email address, and company name provided when you register for the Service or contact us.
• Usage Data: Your interactions with the Service, including the policies, controls, and evidence you configure, to operate and improve it.
• Connected Systems: With your explicit authorization, configuration and telemetry from systems you operate (source control, CI/CD, cloud accounts, and security tooling) in order to evaluate policy and produce governance evidence.
• Technical Data: IP address, browser type, and device information for security and analytics purposes.

3. How We Use Your Information

• To provide, maintain, and improve the Service.
• To evaluate your policies and controls and produce the evidence you ask us to produce.
• To communicate with you about your account and service updates.
• To detect and prevent fraud, abuse, or security incidents.

4. Data Storage and Security

Your data is stored on secure, encrypted infrastructure. We implement industry-standard security measures to protect your information. Data from your connected systems is processed to operate the Service for you and is not shared with other customers or third parties.

5. We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties. We do not use your data to train general-purpose AI models. Your data is used solely to operate the Service for you.

6. Third-Party Services

We use third-party providers for infrastructure and hosting, including Amazon Web Services. These providers have their own privacy policies. We only share the minimum data necessary for these services to function.

7. Data Retention

We retain your data for as long as your account is active. You may request deletion of your data at any time by contacting us. Upon account deletion, we will remove your personal data within 30 days.

8. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Revoke access to connected systems at any time.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the service.

10. Contact

For privacy-related inquiries, contact us at info@xiaotime.ai.