Privacy policy

We collect the minimum needed to make the product work:

• Your email (sign-in) and optional display name
• Your business profile (name, address, license, insurance) — used to fill contracts
• Documents you create or upload, plus their audit-trail metadata
• Delivery and access records for documents you send or share (see “Document delivery and access records” below)
• Counterparty contact info you save in your CRM
• Phone numbers you provide for a recipient (yours or a signer's) when you choose to deliver a document by text
• Your phone number and a record of your consent, if you opt in to text messages
• If you turn on two-step sign-in, the setup record for your authenticator app (never the codes themselves)
• Billing details held by Stripe — name, email, and what you bought. Card numbers never reach us
• Bank account details you enter for checks and bill payments, and, if you connect a bank account through Plaid, the account information described in “Connecting a bank account”
• Support messages you send us, including anything you attach, and how you use our help pages
• Basic usage measurement: which pages get opened and which features get used. No advertising trackers, and no one buys this from us

We do not ask for a Social Security number or a date of birth. If you write or mail checks, or set up bank payments for bills, you give us the bank account and routing numbers to print on them. If you choose to connect a bank account, we receive account information through Plaid (see “Connecting a bank account” below). We never ask for, see or store your online banking username or password. If a document you upload happens to contain something like that, it is treated like the rest of the document's content — stored for you, and readable by nobody outside your account.

• We do not sell your data.
• We do not share your data with third parties for advertising.
• We do not use your contracts to train any AI model — ours or anyone else's.
• We do not let one customer see another customer's documents. Every record is walled off to the account that owns it, in the database itself.
• No human at XOaos reads your documents as a matter of course. We open one when you ask us to — a support request you file about it, or a bug we cannot reproduce without it — and we say so when we do.

What we do do, which the rest of this page explains: send document content to our AI providers when a feature needs it, including automatically when you upload a document; keep records of who opened what you sent; and measure how well the XOsign app reproduces the documents it unlocks.

We share your information only (1) with the service providers that run XOaos for us, listed with what each one can see on our subprocessors page, under contracts that let them use it only to provide their service to us; (2) with people you choose to send or share something with, such as a signer, a fax recipient or a payee; (3) with Plaid and your bank, when you connect an account; and (4) when the law requires it, or to protect the rights and safety of our users or of XOaos. If XOaos is ever sold or merged, this policy will continue to apply to your data, and we'll tell you before it changes.

When you send a document for signature, share it by link, or serve it through a tracked viewer, we record how that copy was delivered and accessed: the time, the network (IP) address and browser information of the person opening it, the approximate location derived from that network address, and — for tracked viewing — which pages were viewed, for how long, and any email address the viewer provides at an access step. These records exist to give the document’s sender a reliable account of who received and opened their document — the same purpose the signature audit trail serves — and they are shown to the sender as part of the document’s activity record. They are kept with the sender’s account and deleted with it.

When you use an AI-assisted feature — Photo-to-Contract, Contract Upgrade, a summary, a translation, a review — the content it needs is sent to one of our two model providers, Anthropic or OpenAI, over an authenticated connection. Which provider handles which feature is a setting we control and it changes as we tune quality and cost; both are listed on our subprocessors page, which records the current split. Under both providers' commercial API terms, your content is not used to train their models. The output is stored in your account and is readable only by your account.

One of these can run without you asking. When you upload a document, XO reads it once and writes down what it found — what kind of document it is, who the parties are, the key dates and amounts — so it is filed and searchable without anyone pressing a button. In XOsign the account owner can turn this off (“Reading new files”, in Settings under Plan & usage); a file uploaded or imported in XOfiles is always read. When you unlock a document, XO reads it in full and makes it an XOdoc, so what you do with it afterwards uses what was written down instead of re-reading the whole file. Summary, Clauses, Risks and Suggest edits come from a deeper read that runs only when you ask for one. We call what these reads write down the document's Brain. It is stored with the document, deleted with it, and it is the reason a document you upload can reach a model even if you never press an AI button. The same no-training terms cover it.

Separately from any AI model training, we check how well XOsign reproduces a page when it unlocks a document, so we can fix it where it gets things wrong. Three things are true about that, and we would rather state all three than the flattering one:

• Nothing here trains a model. No model weights are trained on your documents, by us or by anyone else. This is a quality check on our own unlocking, nothing more.
• The reference documents are our own. The documents we check against are ones processed through XOaos's own team accounts, not from customer accounts.
• Keeping the text of your edits is off unless we switch it on, and we cannot switch it on for you. When someone corrects an unlocked page, the correction is useful evidence — but recording the words involved is turned off for every account by default and stays off unless it is deliberately enabled for that account. There is no setting in the product for this yet, so there is no consent record either. We are telling you that instead of implying a choice you were never offered. If you want to be certain your account is excluded, write to us and we will confirm it in writing.

We keep full copies of the documents used for these checks, and those copies are not linked back to an account — which means we could not find and remove yours on request even if it were there. That is a gap we know about, and it is the reason customer documents are kept out of it.

You can try XOsign without signing up. When you do, we create an anonymous guest account for you behind the scenes and put a sample document in it — that way you are using the real product, not a picture of it. We do not know who you are: there is no email address, no name, and nothing you type is connected to a person.

Guest accounts and everything in them are deleted automatically seven days after they are created. If you decide to sign up, the account stops being a guest at that moment and becomes yours, with the ordinary retention below.

Public demo wizards let you upload a file or paste text to create a preview without creating a document in your account or sending anything for signature. If you choose the sign-up handoff, some workflows keep it in this browser until the matching signed-in wizard claims it or you clear browser data; others use a server-side draft that expires after seven days if it is not claimed.

On paid plans, we keep a register of every copy of a document that leaves XOaos into someone's possession — a download, a print, an emailed attachment, a piece of mail. Each entry records which document, when, by whom, and the network address and browser it went out through, and it gets a short serial number. Viewing a document inside the app is not a copy and is not registered.

On plans that include it, the PDF copy itself also carries that serial number, marked into the file in a way that is not meant to be visible when you read it. It exists for one purpose: if a document turns up somewhere it should not have, its owner can find out which copy it was. It identifies the copy, not the reader, and it carries no personal information.

Free accounts get neither — nothing is registered and nothing is marked.

If the Google Drive connection is available and you choose to connect it, you grant XOaos read-only access to the files your Google account can access. This can include My Drive, files shared with you, and Shared drives. We also read your Google account email to identify the connection. Signing in to XOaos with Google alone does not grant this Drive access.

When you start a scan, XOfiles lists and stores file metadata such as names, identifiers, types, sizes, folder paths, modified dates and content hashes, together with classification results and your keep-or-skip choices. This includes records for files you do not import. To classify supported documents that these details cannot identify, we may download document content and send a limited text excerpt to OpenAI before you approve the final import. Scanning therefore processes some document content before import confirmation.

You review the scan report and choose what to import. Imported documents and their source details are stored in your XOaos account and handled by the document features described above. If you turn on live sync, XOfiles checks for changes about every fifteen minutes and imports new or changed documents that match your saved rules. Recent edits wait for fifteen minutes of quiet. The connection does not edit or delete your files in Google Drive. Deleting a source file in Drive does not delete the copy already stored in XOfiles.

We retain encrypted access and refresh tokens to maintain the connection. Disconnecting stops sync and removes our stored tokens. It does not delete documents already imported, scan records or connection history. You can also revoke XOaos's access in your Google account. Account deletion follows the retention and deletion terms below.

The no-sale, no-advertising and no-model-training commitments above also apply to Google Drive data. Hosting, storage and AI processors handle the data needed to provide these features; see our subprocessors page.

XOaos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

XOaos uses Plaid Inc. (“Plaid”) to connect your business bank accounts. When you choose to connect an account, you sign in to your bank inside Plaid's own window. Your bank username and password go to Plaid and your bank, never to XOaos. Plaid's collection and use of your information is governed by the Plaid End User Privacy Policy. By connecting an account, you agree that Plaid may collect, use and share your information as that policy describes.

Bank connection through Plaid is being rolled out and may not be available on your account yet.

What we receive. Depending on the features you use, we receive the following from Plaid about the accounts you choose to connect: the bank's name, the account name, type and the last four digits; the account and routing numbers; current and available balances; transactions (date, amount, description, merchant and category); and, if you use owner verification, the account holder's name, email, phone and address as the bank reports them. We also store a Plaid access token (a key that lets us request updates) and an item identifier for each connection.

Why we use it. Only to provide the features you turn on: verifying that you own the account you send and receive payments and checks from; showing balances and transactions next to your invoices, bills and checks; and matching bank transactions to those records so your books stay reconciled. We request only the Plaid products those features need.

What we never do with it. We do not sell, rent or trade bank data. We do not share it with anyone for their own marketing or advertising, and we do not use it to target ads. We do not use it to train any AI model, ours or anyone else's. We do not send your Plaid access tokens to AI providers, and we do not send bank data to AI providers unless a feature you choose needs it and this page says so first. Only you and the people you give access to in your account can see it.

Extra protection. Connecting a bank account, adding or editing bank details for checks, setting up bank payments and printing checks all require two-step sign-in with an authenticator app. If you haven't set it up, we'll take you through it first. Plaid access tokens are encrypted by our servers before they are stored, on top of the database's own encryption.

Disconnecting. You can disconnect a bank account at any time in XOaos under Settings. You can also remove XOaos's access from Plaid Portal (my.plaid.com) or through your bank. When you disconnect, we tell Plaid to end the connection, delete the access token immediately, and delete the balances and transactions we received through Plaid within 30 days. The same happens when you delete your account. Records you created from that data, such as a check you printed, a bill you marked paid or a reconciled ledger entry, stay with your records under “How long we keep your data”.

Where the Google Drive or Dropbox file picker is available, you choose the files to import. Those files are stored and processed like other uploads. Using a file picker does not itself establish the ongoing Google Drive connection described above.

You can sign in with an email address and password, or with your Google account. If you use Google, Google tells us your email address and name and nothing else; we never see your Google password.

You can add two-step sign-in with an authenticator app, and the owner of a team can require it of everyone on that team. We store the setup record that lets us check your codes — never the codes.

We record how our help pages and help chat are used — which articles get opened, what people search for, and the conversations held with the help assistant — so we can fix the answers that are not working. Our own staff can read those records, including chat transcripts. Please do not put anything in the help chat you would not want us to read.

Support requests and anything you attach to them are kept with your account so we can follow the thread, and are deleted with it.

Some cookies are needed for the site to work, and they are always on: keeping you signed in, remembering your language, and remembering your cookie choice (for 12 months). When XOaos's own staff or test accounts sign in, one more marks their browser so we never count our own visits.

The rest are optional:

• Analytics. A cookie that remembers which ad, link or audience page brought you here, so the account you create can be credited to it (90 days); our own count of different visitors, a random id that is never linked to your account (13 months); and Google Analytics, when it is switched on.
• Advertising. Meta, LinkedIn and Google Ads tags, when switched on. They tell those platforms when one of our ads led to a sign-up or a purchase.

Where you are sets the starting point. In the European Union and the rest of the EEA, the United Kingdom, Switzerland and Canada, and anywhere we cannot tell, nothing optional runs until you say yes. Elsewhere the optional cookies start on, and you can turn them off. If your browser sends Global Privacy Control, advertising stays off whatever else you choose. None of these ever run on a signing link, and inside your account they never record which pages you open; the only thing they can report from there is that a purchase was completed.

Right now there is nothing to choose: no optional tool beyond the visit-source cookie is switched on. When one is, a banner asks first, and Cookie settings appears at the bottom of every page. Switched on today: none of the tools above. What each one sees is listed on our subprocessors page.

XOaos also keeps small preferences in your browser's own storage — which panel you had open, your zoom level, tips you have dismissed. Those never leave your device and we cannot read them.

Paid plans are billed through Stripe, which handles the payment and holds the card. Card numbers never touch XOaos's systems; we see your billing name and email, what you bought, and whether it succeeded.

What the AI does is paid for in credits, charged per page of document (1 credit a page to read and file or to unlock, 1 for a Deeper read, 3 to translate), so we count the pages read and the credits used against your account and keep a record of what was charged and why. That record is how you can check a bill, so it stays as long as the billing ledger does.

When you choose to deliver a document by text, we send the recipient a transactional SMS — a short notice that a document is waiting and a link to open it. We use Telnyx as our messaging provider to send and receive these texts on our behalf; the phone number and message content are processed by Telnyx solely to deliver the message.

You can also opt in to receive your own account and document notifications by text (signing reminders, completed-signature confirmations, and security codes) by adding your mobile number and checking the SMS opt-in box at sign-up or in Settings. This is optional, and you can opt out anytime by replying STOP. We collect the mobile number you provide and a record of your consent (the time and the disclosure you agreed to) to operate and document this.

• Texts are transactional only — signature requests and document links. We never send marketing texts.
• We do not sell, rent, or share phone numbers with third parties for advertising. Mobile information is not shared with third parties for their marketing purposes.
• You can opt out at any time by replying STOP to any message; reply HELP for help. Message frequency varies; message and data rates may apply.

When you send a document by fax, the document and its cover page go to the fax number you enter through Telnyx, our fax provider, which processes the document and both fax numbers solely to deliver it. We keep a record of each fax (the numbers, the page count and whether it went through) and email you a confirmation with a copy of what was sent.

If your business has its own fax number, faxes sent to it are received by Telnyx, filed in your XOfiles and emailed to the account owner.

Without a number of your own, faxes go out from and can reach you at XOaos's shared fax number. To deliver a fax sent to the shared number, we read its first page with Google Document AI to find your fax code, or match it as a reply to a number only your business faxed recently. A fax we can't match with certainty is never guessed: XOaos staff may open it to find who it is for, and it is deleted after 30 days if nobody claims it. A fax waiting for your account's credits is kept for up to 7 days.

• Every connection to XOaos uses HTTPS (TLS 1.2 or newer), as do the connections between our servers and our providers, including Plaid.
• Everything we store is encrypted at rest by our database and storage provider (AES-256). Plaid access tokens get an extra layer of encryption from our own servers, with the key kept separately from the database.
• Every record is walled off to the account that owns it, enforced in the database itself. Within an account, roles limit what each person can do.
• You can turn on two-step sign-in with an authenticator app, a team owner can require it for everyone, and it is always required before bank connections and check printing. Our own staff need it for admin access.
• Only the people who need production access to run the service have it, and we review that access regularly.
• We scan our code and its dependencies for known vulnerabilities and fix them on a set timetable.
• We monitor our systems and have a written plan for responding to a security incident, including telling affected customers and Plaid when the law or our agreements require it.

No system is perfectly secure. If you think your account has been misused, write to security@xoaos.com straight away.

Your documents, uploads, profile and support history are kept until you delete them, or until 30 days after you close your account. Three things outlive the account, because they belong to more people than you: signed PDFs and their audit trails (7 years), notarial journal records where notarization was used (10 years, per Florida §117.245), and the billing ledger (7 years, for tax records). Someone who signed your agreement is entitled to prove what they signed.

Data-export zips are deleted after 24 hours. Server logs are kept for 90 days. Guest demo accounts and everything in them are deleted seven days after they are created. The register of copies that left the system outlives the document it describes, on purpose — a leak is usually investigated after the original is gone — and it holds the copy's serial number, not its contents. Signed counterparties retain their own copies independently, with audit trails intact.

Bank connection data from Plaid: the access token is deleted the moment you disconnect, and balances and transactions are deleted within 30 days of disconnecting, deleting your account, or the connection no longer being needed. Bank account and routing numbers you enter for checks are kept until you delete them or close your account. Checks you have issued remain part of your records, with the billing ledger (7 years).

You can take everything with you from Settings → Privacy. One button downloads every record we hold on you as a JSON file straight away; the other emails you a link to a zip holding the same records, your audit timeline, and every file you own — the originals you uploaded and the PDFs. The link works for 24 hours, and you can ask for one full export per day.

Deleting your account is on the same page. You confirm twice — the second step is typing your own email address — and then your account is scheduled for erasure 30 days out, with a banner on every page offering to cancel. After the 30 days, your files and records are erased, subject to the legal retention windows above (signed documents and their audit trails stay, with your personal details stripped out wherever they can be).

For anything outside the self-service surfaces — a specific question, a deletion that needs to happen faster, or a data-portability request our endpoints don't cover — write to us from our contact page, using the address on your account so we can match the request to it. Put “privacy” in the message and it goes straight to the right person.

Questions, exercising your rights, or a complaint: use our contact page, or write to support@xoaos.com and say it is about privacy. The form is the surer route — every message it sends is recorded on our side, so it cannot get lost on the way to a mailbox.