Privacy Policy

This Privacy Policy explains how Xitst Co., Ltd. ("Xitst," "we," "us," or "our") collects, uses, stores, and shares information when you use xtion — our internal workspace available on the web, iOS, and desktop ("the Service").

xtion is intended for authorized team members. By signing in or using the Service, you acknowledge this policy.

Depending on how you use xtion, we may collect:

• Account information — email address, display name, and authentication credentials (passwords are stored in hashed form).
• Workspace content — tasks, goals, direct messages, channels, meeting notes, documents, client records, calendar items, and other content you create or upload in the workspace.
• AI assistant (Xolomon) data — chat messages, session titles, and workspace context sent to our AI features to generate responses or perform actions you request.
• Push notification data — device push tokens, platform (iOS, Android, or web), app version, and a device identifier used to deliver notifications via Firebase Cloud Messaging. On the web, notifications require your browser permission and, on iOS, installing xtion to your home screen.
• Presence and activity signals — online status and lightweight activity indicators shared with other workspace members.
• Technical data — session cookies, IP address, browser or app version, and diagnostic logs needed to operate, secure, and troubleshoot the Service.

We use the information above to:

• authenticate users and maintain secure sessions;
• provide workspace features such as messaging, tasks, documents, and search;
• deliver push notifications for inbox and workspace events you opt into;
• power Xolomon AI features at your direction;
• sync data across web, iOS, and desktop clients;
• monitor reliability, prevent abuse, and improve the Service.

We do not sell your personal information.

We rely on trusted service providers to operate xtion, including:

• Hosting and infrastructure — application hosting and edge delivery (e.g., Vercel).
• Database and realtime — data storage and live sync (e.g., PostgreSQL and Supabase Realtime).
• Push notifications — Firebase Cloud Messaging (Google) for iOS, web browsers, and related platforms.
• AI models — OpenAI for Xolomon chat and related AI features. Prompts may include workspace context needed to fulfill your request.

These providers process data on our behalf under contractual safeguards and only as needed to deliver the Service.

We retain account and workspace data while your account is active and as needed to provide the Service. Content you delete may remain in backups for a limited period before permanent removal.

Push device tokens are refreshed or removed when you sign out, uninstall the app, or when tokens expire.

We apply administrative, technical, and organizational measures — including encrypted transport (HTTPS), access controls, and least-privilege practices — to protect your information. No method of transmission or storage is completely secure; please use a strong password and protect your device.

Depending on applicable law (including the Personal Information Protection Act in Korea), you may have the right to access, correct, delete, or restrict processing of your personal information, or to withdraw consent where processing is consent-based.

To exercise these rights, contact us using the details below. We may need to verify your identity before responding.

xtion is not directed at children under 14 and we do not knowingly collect personal information from children.

Your information may be processed in the Republic of Korea and in other countries where our service providers operate. We take steps to ensure appropriate safeguards when data crosses borders.

We may update this Privacy Policy from time to time. The effective date at the top of this page will reflect the latest version. Material changes may be communicated through the Service or by other reasonable means.

Data controller: Xitst Co., Ltd.
CEO: Sungho Kim
Business registration no.: 679-87-02936
6F, KT&G Sangsang Planet, 38, Ttukseom-ro 13-gil, Seongdong-gu, Seoul, Republic of Korea

Privacy inquiries / DPO: Namhee Kim
Email: hello@xitst.com