Privacy Policy

Draft — pending legal approval. This placeholder is provided for product integration and review only. It contains unresolved bracketed fields and is not a final or legally approved version. Do not rely on it as legal advice or as the final terms governing the service.

Version 1.0 · Effective [●] 2026 · Published at [Privacy URL]

This Privacy Notice is issued by [Infinia Legal Entity Name] ("Infinia") in respect of Personal Data processed by it as a controller in connection with Xailon Token Factory. It is incorporated into the Xailon Token Factory Terms of Service by Section 1.2(h) of those Terms and is referred to in Section 6.11 of those Terms. It is given for the purposes of Articles 13 and 14 of Regulation (EU) 2016/679, the corresponding provisions of the UK General Data Protection Regulation, the ADGM Data Protection Regulations 2021, UAE Federal Decree-Law No. 45 of 2021 and the Digital Personal Data Protection Act 2023, and of any other Data Protection Law that applies to that processing.

1. Introduction and status of this Notice

1.1 Infinia operates Xailon Token Factory, a sovereign inference and artificial-intelligence control-plane platform under which requests are executed within a defined Sovereign Zone. In the course of operating that platform Infinia processes Personal Data in two distinct capacities, and the distinction determines which document governs.

1.2 Where Personal Data is comprised in Customer Content, the Customer determines the purposes and means of the processing and Infinia acts only on the Customer's documented instructions. In that capacity Infinia is a processor and Annex B of the Terms (Data Processing Addendum) governs. This Notice does not apply to that processing.

1.3 Where Infinia processes Personal Data in order to establish and administer the contractual relationship, to verify identity, to meter and invoice, to provide support, to secure the Service and to comply with obligations imposed on it by Applicable Law, Infinia determines the purposes and means of that processing and is a controller in its own right. This Notice applies to that processing, and to it alone.

1.4 This Notice forms part of the Agreement. It does not vary Sections 6.1 to 6.4 of the Terms or Annex B, and in the event of any inconsistency those provisions prevail in accordance with the order of precedence in Section 1.3 of the Terms.

1.5 The Service is offered to businesses, public bodies, academic and research institutions and individuals acting in the course of a trade, business, profession or research activity, and is not offered to consumers or to any person under the age of eighteen (Sections 3.1 and 3.2 of the Terms). Infinia does not knowingly process the Personal Data of children and will delete any such data that comes to its attention.

1.6 Capitalised terms used but not defined in this Notice have the meanings given to them in the Terms.

2. Definitions

"Data Protection Law", "Personal Data", "controller", "processor", "data subject", "processing", "special categories" and "supervisory authority" have the meanings given to them in Section 2.1 of the Terms and in Section B.1.2 of Annex B and, where no meaning is given, in the GDPR.

"Individual" means a natural person to whom Personal Data processed by Infinia under this Notice relates, including an Authorised User, a billing, technical or security contact of a Customer, a director or beneficial owner whose particulars are verified under Section 3.7 of the Terms, a person who corresponds with Infinia, and a visitor to the Site.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed by Infinia as a controller.

"Site" means the website operated by Infinia at [Site URL] and the Xailon Token Factory portal.

References in this Notice to "you" and "your" are to the Individual. References to a Section without further identification are to a Section of this Notice; references to a Section of the Terms, to Schedule 1 or to an Annex are identified as such.

3. Identity of the controller and contact particulars

4. Scope

4.1 This Notice applies to the Personal Data described in Section 6, being the account, Organisation, billing, identity-verification, screening, support, security and Site data processed by Infinia as a controller.

4.2 This Notice does not apply to Personal Data comprised in Inputs, Outputs or Stored Objects. In respect of that data the Customer is the controller (or a processor acting for its own controller) and Infinia is a processor. An Individual whose Personal Data has been submitted to the Service by a Customer should address any request to that Customer, which is the controller of it. Section 13.6 sets out how Infinia will deal with a request of that kind that is addressed to it, and Section 5 explains the limitations that arise from Infinia's design.

4.3 Where an Authorised User makes a request in respect of Personal Data described in Section 6, Section 13.6 does not apply and Infinia will deal with the request itself. Section B.14.2 of the Terms so provides.

Index of Sections

5. Treatment of Inputs and Outputs

5.1 An Input may contain Personal Data, and an Output may reproduce or generate it, in each case as determined by the Customer. The following provisions of the Terms govern Infinia's treatment of that data and are summarised here because they materially affect the rights that can be exercised against Infinia in respect of it.

5.2 Non-retention. Infinia does not store, log, retain or otherwise persist Inputs or Outputs beyond the transient processing required to serve a request and return a response, and does not retain them after the response has been returned (Section 6.3 of the Terms).

5.3 Non-examination. Infinia does not read, inspect, review, filter, screen, sample or otherwise examine the content of any Input or Output, whether by human or automated means. That commitment is expressed in the Terms as absolute and admitting of no exception.

5.4 Residency. Each request is executed wholly within the Sovereign Zone or Zones comprising the Region Scope configured by the Customer. A request that cannot be served within that Region Scope is refused and is not served from another location (Sections 6.1 and 6.2 of the Terms).

5.5 No training. Neither Infinia nor any Model Provider, Zone Operator or other third party may use Inputs, Outputs, Customer Models or other Customer Content to train, retrain, fine-tune, evaluate or otherwise improve any Model or machine-learning system. That provision is not subject to opt-in and may not be varied except by written agreement signed by both parties (Section 6.4 of the Terms).

5.6 Consequences of the foregoing. Infinia is unable to produce a copy of an Input or an Output, to rectify it, to confirm whether a particular Input was submitted, to restore it following loss, or to screen it for unlawful or harmful content, and makes no representation that it does so. Where Infinia receives a request or order from a court, regulator or law-enforcement body for access to an Input or an Output, it will ordinarily have no such material in its possession, and Section 6.8 of the Terms requires it to notify the Customer unless legally prohibited from doing so, to challenge any request it reasonably considers overbroad or unlawful, to disclose only the minimum required, and to record the request in the transparency reporting published in the Trust Centre.

5.7 Usage Data. Infinia retains Usage Data in respect of each request, comprising request timestamps, Model and Sovereign Zone identifiers, token counts, latency, error codes, routing decisions, attestation records, API-key identifiers, region identifiers and billing records. Usage Data contains no part of the content of an Input or an Output. Usage Data is processed for the purposes stated in Section 8 and is retained for the period stated in Annex C of the Terms.

5.8 Stored Objects. A Customer may elect to store Batch input and output files, uploaded datasets and files, Customer Models and Fine-Tuned Models. Those are Stored Objects, are held within the Region Scope for the periods stated in Annex C of the Terms, and are Customer Content for which the Customer is the controller. Section 6.10 of the Terms permits two automated integrity controls to be applied to Stored Objects and to no other material: comparison of stored image, audio and video files against cryptographic hash lists of material identified as child sexual abuse material, which returns a match or no match and discloses nothing further; and structural scanning of Customer Models, Fine-Tuned Models and uploaded files for malware and unsafe serialisation formats. Neither control reads, interprets or retains the substantive content of a Stored Object, and neither is applied to an Input or an Output.

6. Categories of Personal Data processed

6.1 Personal Data provided to Infinia. Infinia processes the following categories of Personal Data provided to it by an Individual or by the Customer on whose behalf the Individual acts.

6.2 Personal Data collected automatically. Infinia collects the following categories of Personal Data in the course of an Individual's use of the Site.

6.3 Personal Data obtained from third parties. Infinia obtains the following categories of Personal Data from the sources stated. Each source is a Sub-processor identified in Annex D of the Terms.

6.4 Personal Data not processed. Infinia does not process the content of Inputs or Outputs; does not receive or store primary account numbers or security codes; does not extract, derive or store any biometric identifier (Section 15); does not obtain Personal Data from data brokers; does not construct advertising profiles; and does not track Individuals across third-party websites or services.

6.5 Special categories. Infinia does not require or request special categories of Personal Data. An identity document supplied under Section 3.7 of the Terms may incidentally disclose data of that character, including nationality or date of birth. Such data is processed solely for the purpose of verification, is held segregated and subject to the access restrictions in Section B.12(h) of the Terms, and is retained in accordance with Annex C of the Terms.

7. Cookies and similar technologies

7.1 Infinia deploys cookies and similar technologies on the Site. Certain of those technologies are strictly necessary for the Site to function. In respect of all others, where Data Protection Law requires the prior consent of the Individual, including Directive 2002/58/EC as implemented in Italy and the guidance of the Garante per la protezione dei dati personali, no such technology is deployed until consent has been obtained, refusal is presented as readily as acceptance, and consent may be withdrawn at any time by means of the link presented in the footer of each page of the Site.

7.2 Infinia does not deploy cookies or similar technologies for advertising purposes. Infinia does not conduct interest-based, personalised or targeted advertising, does not participate in advertising networks, and does not disclose Personal Data to advertisers. Infinia does not deploy session-replay technology, does not record the screen or keystrokes of any Individual, and does not deploy tracking pixels in operational communications.

7.3 The categories of technology deployed are as follows.

7.4 The individual technologies within each category, the provider of each and the duration of each are set out in the preferences panel accessible from the footer of each page of the Site, which is maintained so as to reflect the technologies actually deployed. Providers of analytics technologies are identified in Annex D of the Terms. An Individual may also configure the browser to block or delete cookies, in which case the portal may not function correctly.

7.5 Infinia may measure whether a marketing communication has been opened and which links within it have been followed. An Individual may object to that measurement by notice to [privacy@●]. No such measurement is applied to operational communications.

8. Purposes of processing and legal bases

8.1 Infinia processes Personal Data for the purposes and on the legal bases set out in the following table. Where Infinia relies on legitimate interests, it has conducted and documented an assessment balancing those interests against the interests, rights and freedoms of the Individual, and will provide a summary of that assessment on request made under Section 13.

9. Automated decision-making

9.1 Three of the determinations made by Infinia are made by automated means and are capable of producing legal effects concerning an Individual or of similarly significantly affecting an Individual, in that each may result in access to the Service being refused, suspended or restricted. They are disclosed below for the purposes of Article 13(2)(f) of the GDPR and the corresponding provisions of other Data Protection Law.

9.2 Where a determination of the kind described in Section 9.1 would prevent the Customer or the Individual from using the Service, Infinia will not treat the output of the automated system as determinative without human review. The Individual is entitled to obtain that review, to express a point of view and to contest the determination, and Infinia will respond within the period stated in Section 13.4. Section B.14.3 of the Terms so provides.

9.3 Infinia does not profile Individuals for marketing purposes, does not score Individuals for advertising purposes, and does not use Usage Data to make determinations concerning Individuals.

10. Recipients and disclosures

10.1 Sub-processors. Infinia engages the service providers identified in Annex D of the Terms, which states for each its role, the Personal Data it processes, its place of processing and the Sovereign Zones for which it is engaged. Each is bound by written terms imposing obligations no less protective than those to which Infinia is subject, may process the Personal Data only for the purpose for which it is engaged, and is prohibited from using Customer Content for training or for any purpose of its own. Infinia gives not less than thirty days' notice before authorising a new Sub-processor, and the Customer may object in accordance with Section B.5.2 of the Terms.

10.2 Zone Operators. A Sovereign Zone may be hosted, powered or operated by a Zone Operator. A Zone Operator does not receive Inputs or Outputs, which are not held at rest, and does not receive control-plane identity data. Section 17.1 of the Terms makes Infinia responsible to the Customer for the performance of a Zone Operator and requires Infinia to impose on each Zone Operator obligations as to security, residency, confidentiality and data protection that are no less protective than those in the Agreement.

10.3 Affiliates. Personnel of Infinia's Affiliates may process account, billing and support data for the purpose of administering and supporting the Service. Access to production systems within a Sovereign Zone is restricted to personnel authorised for that Zone, is granted on a least-privilege basis and is logged (Section 6.7 of the Terms). Where the Documentation identifies the jurisdiction of the personnel operating a Zone, Infinia gives not less than thirty days' notice of a change that would move operational access outside that jurisdiction.

10.4 The Customer. Where the Individual is an Authorised User, the Owners and Admins of the Organisation may view the Individual's role, API Credentials and administrative actions through the portal and the audit log. The allocation of those roles is a matter for the Customer.

10.5 Competent authorities. Infinia discloses Personal Data to a court, regulator or law-enforcement body where required to do so by Applicable Law. Section 6.8 of the Terms requires Infinia to notify the Customer unless legally prohibited from doing so, to challenge any request it reasonably considers overbroad or unlawful, to disclose only the minimum required, and to record the request in the transparency reporting published in the Trust Centre.

10.6 Professional advisers and corporate transactions. Infinia's auditors, legal advisers and insurers may receive Personal Data where necessary, subject to professional obligations of confidence. In the event of a merger, acquisition or transfer of the whole or part of Infinia's business, Personal Data may be transferred as part of that transaction, of which affected Customers will be notified in advance, and the transferee remains bound by this Notice until it is lawfully superseded.

10.7 Disclosures not made. Infinia does not sell Personal Data within the meaning of any Data Protection Law, and does not share Personal Data for cross-context behavioural advertising or targeted advertising. Infinia does not disclose Personal Data to Model Providers. A Model Provider licenses a Model for inclusion in the Model Catalogue and the Model is executed within the Sovereign Zone; no request, Input or Output is transmitted to the Model Provider.

11. Location of processing and international transfers

11.1 Customer Content. Inputs, Outputs and Stored Objects are processed and held solely within the Region Scope configured by the Customer, are not transferred outside it by Infinia or by any Sub-processor, and a request that cannot be served within it is refused rather than served elsewhere. There is accordingly no transfer of Customer Content to a third country for the purposes of Chapter V of the GDPR.

11.2 Personal Data processed by Infinia as controller. The Personal Data described in Section 6 is processed by Infinia, which contracts from the Abu Dhabi Global Market. Where the Individual is in the European Economic Area or the United Kingdom, that Personal Data — and not any Input, Output or Stored Object — is transferred to a jurisdiction in respect of which the European Commission has adopted no adequacy decision.

11.3 Safeguards. That transfer is made in reliance on the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 and, where the UK GDPR applies, on the International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018. Those clauses are incorporated by Section B.11.1 of the Terms. Annex E of the Terms records the module selected, the options taken and the completed Annexes I, II and III, and contains the assessment made under Clause 14 of those clauses together with the supplementary measures applied, being encryption in transit and at rest with keys managed within the relevant jurisdiction, segregation and access restriction of verification records, minimisation of the data transferred, and the challenge and notification obligations in Section 6.8 of the Terms. A copy of that assessment is available on request made under Section 13.

11.4 The Abu Dhabi Global Market applies the ADGM Data Protection Regulations 2021, which are administered by an independent Commissioner of Data Protection with powers of enforcement and from whose decisions an appeal lies. That circumstance is recorded in the assessment referred to in Section 11.3 and does not displace the safeguards there described.

11.5 Section 27.3 of the Terms permits Infinia to designate an Affiliate incorporated in or near the jurisdiction of a Sovereign Zone as the contracting and invoicing entity for that Zone. Where Infinia does so in respect of the European Union, the transfer described in Section 11.2 ceases in respect of Customers contracting with that entity, and this Notice will be amended accordingly in accordance with Section 18.

12. Retention

12.1 Annex C of the Terms is the retention schedule for the Agreement and section C.3 of that Annex governs the Personal Data described in this Notice. The principal periods are set out below. Where more than one period is capable of applying to the same record, the longer governs. Where Applicable Law requires retention for a period longer than Infinia would otherwise apply, the record is retained for that period and is processed for no other purpose.

12.2 Upon expiry of the applicable period the Personal Data is deleted or irreversibly aggregated. Deletion takes effect in active systems immediately and in backups within the cycle stated above.

13. Rights of Individuals

13.1 Subject to the conditions and exceptions imposed by the Data Protection Law applicable to the Individual, an Individual has the rights set out below. Infinia applies them irrespective of the Individual's location, save where to do so would contravene a law binding upon it.

13.2 Exercise of rights. A request may be made by notice to [privacy@●] or to the Data Protection Officer at [dpo@●], identifying the right invoked and, where applicable, the Personal Data to which the request relates.

13.3 Verification. Infinia will verify the identity of the requester before giving effect to a request, since to act upon the request of a person other than the Individual would itself constitute a contravention of Data Protection Law. Verification will ordinarily be effected through the electronic mail address associated with the account, and further information may be requested where the request is broad in scope or relates to sensitive material. Information supplied for the purpose of verification is processed for that purpose alone.

13.4 Time for response. Infinia will respond within one month of receipt of a valid request. Where a request is complex, or where an Individual has made a number of requests, that period may be extended by up to two further months, and Infinia will notify the Individual of the extension and of the reasons for it within the first month. No fee is charged, save that where a request is manifestly unfounded or excessive Infinia may charge a reasonable fee or decline to act, and will state which course it has taken and why.

13.5 Refusal. Infinia may decline a request in whole or in part where retention is required by Applicable Law, including the anti-money-laundering and sanctions records identified in Section 12; where compliance would disclose Personal Data concerning another person; where the request is manifestly unfounded or excessive; or where compliance would prejudice the prevention or detection of crime or contravene sanctions law. Infinia will in every case notify the Individual that the request has been declined and the ground relied upon, unless to do so would itself be unlawful.

13.6 Requests concerning Customer Content. Where a request concerns Personal Data comprised in Customer Content, Infinia is a processor and Section B.7.2 of the Terms requires it to refer the Individual to the Customer, which is the controller. Infinia will do so promptly. For the avoidance of doubt, and as Section 5.6 records, Infinia does not hold Inputs or Outputs and is not able to give effect to such a request.

13.7 This Section 13 is given effect contractually by Section B.14.2 of the Terms.

14. Marketing communications

14.1 Infinia may send communications concerning Xailon Token Factory, including the availability of Models and Sovereign Zones, changes to the Service, events and published research, on the basis stated in Section 8.

14.2 Each such communication contains a facility by which the Individual may unsubscribe. An Individual may also object by notice to [privacy@●]. Effect will be given to an objection without undue delay, subject only to communications already dispatched.

14.3 The operational communications identified in Section 8 do not constitute marketing, are sent in performance of the contract, and are not capable of being unsubscribed from while the Customer uses the Service. Section 27.5 of the Terms requires the Customer to maintain current contact particulars for that purpose.

15. Biometric Data

15.1 Certain Models in the Model Catalogue accept audio, image or video Inputs, and certain of those Models perform processing constituting the processing of Biometric Data, including voice cloning, voice conversion, speaker identification, voice-preserving translation and the generation of a likeness of a person's face. The Model Catalogue identifies each such Model.

15.2 Infinia does not extract, derive, generate, store or retain any voiceprint, faceprint, biometric template or other biometric identifier. Audio, image and video material is transmitted to the Model within the Sovereign Zone and the result is returned; no such material is retained, by reason of Section 6.3 of the Terms. Infinia does not use Biometric Data to identify any person and does not disclose Biometric Data, holding none.

15.3 The Customer submitting such material is the controller of any Biometric Data it comprises. Section 8.9 of the Terms and Section A.5 of Annex A set out the Customer's obligations, which include identifying a condition under Article 9 of the GDPR or the equivalent provision of the applicable Data Protection Law, which will ordinarily be the explicit consent of the individual concerned; holding documented consent from any third party whose voice, face or likeness is submitted; and observing any additional requirement as to notice, consent, retention schedule or non-disclosure imposed by Applicable Law in respect of biometric identifiers.

15.4 An Individual who believes that their voice, face or likeness has been submitted to the Service without their consent may give notice to [privacy@●] and to [abuse@●]. Infinia will act upon that notice in accordance with Section A.8 of Annex A. Infinia will not be able to produce the material, holding none, but may take action in respect of the account concerned and will inform the Individual of the action taken so far as Applicable Law permits.

15.5 Where audio, image or video material is stored as a Stored Object, it is retained for the period stated in Annex C of the Terms and the hash-matching control in Section 6.10(a) of the Terms is applied to it. That control compares the file against lists of material identified as unlawful and discloses nothing further; it does not recognise faces, identify speakers or generate any biometric identifier.

16. Security and Personal Data Breaches

16.1 Infinia maintains the technical and organisational measures set out in Section B.12 of the Terms. The measures material to the Personal Data described in this Notice are: encryption in transit and at rest, with keys managed within the relevant jurisdiction; federated authentication with role-based access control, Infinia holding no password; least-privilege access for Infinia personnel restricted to the Sovereign Zone for which they are authorised, logged and periodically reviewed; segregation of identity-verification records from operational systems; an immutable audit log of administrative access; and independent penetration testing not less than annually. Infinia's current certifications are listed in the Trust Centre at [Trust URL].

16.2 No measure of security can be guaranteed to be effective in every circumstance. Where a Personal Data Breach occurs, Infinia will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; and will communicate the breach to affected Individuals without undue delay where it is likely to result in a high risk to their rights and freedoms, in clear and plain language and stating the nature of the breach, the likely consequences and the measures taken or proposed.

16.3 Where a security incident affects Customer Content, Infinia notifies the Customer within twenty-four hours in accordance with Section B.8.1 of the Terms, and within four hours in the case of a Customer that has identified itself under Section 24.4 of the Terms as subject to Regulation (EU) 2022/2554 or an equivalent regime.

16.4 The Individual is responsible for maintaining the confidentiality of the credentials issued by the Customer's identity provider and of any API Credential, and must notify Infinia at [security@●] within twenty-four hours of becoming aware of any actual or suspected compromise (Section 3.9 of the Terms).

17. Jurisdiction-specific provisions

17.1 European Union and United Kingdom. This Notice is given for the purposes of Articles 13 and 14 of the GDPR and of the corresponding provisions of the UK GDPR. Infinia's representative appointed under Article 27 of the GDPR is identified in Section 3. The Data Protection Officer is contactable at [dpo@●].

17.2 Italy. Where the Individual is in Italy, the competent supervisory authority is the Garante per la protezione dei dati personali. The consent requirements in Section 7 reflect the guidance of that authority in respect of cookies and other tracking tools.

17.3 Abu Dhabi Global Market and United Arab Emirates. Infinia processes Personal Data in accordance with the ADGM Data Protection Regulations 2021 and, where applicable, UAE Federal Decree-Law No. 45 of 2021. Processing within a Sovereign Zone in the United Arab Emirates does not constitute a cross-border transfer for the purposes of those instruments.

17.4 India. Where the Digital Personal Data Protection Act 2023 applies, Infinia is the Data Fiduciary in respect of the Personal Data described in this Notice, and processing within a Sovereign Zone in India involves no transfer outside India. In respect of Customer Content the Customer is the Data Fiduciary and Infinia the Data Processor, in accordance with Section B.11.3 of the Terms.

17.5 United States. Infinia does not sell Personal Data and does not share Personal Data for cross-context behavioural advertising within the meaning of the privacy laws of the several States. The rights set out in Section 13 are available to residents of those States, and Infinia does not discriminate against an Individual by reason of the exercise of any of them.

18. Amendment of this Notice

18.1 Infinia may amend this Notice. The current version and its effective date are published at [Privacy URL], where superseded versions are archived.

18.2 Where an amendment materially affects the manner in which Personal Data is collected, used or disclosed, or materially reduces the rights available under this Notice, Infinia will give not less than thirty days' notice by electronic mail to the Owners and billing contact of each Organisation and by notice in the portal before the amendment takes effect, corresponding to the notice required by Section 22.2 of the Terms in respect of the Terms. Other amendments take effect upon publication.

19. Complaints

19.1 An Individual dissatisfied with Infinia's processing of Personal Data or with Infinia's response to a request may raise the matter with Infinia by notice to [privacy@●] or to the Data Protection Officer at [dpo@●].

19.2 An Individual is entitled to lodge a complaint with a supervisory authority, and the exercise of that right is without prejudice to any other administrative or judicial remedy. The competent authority is that of the Individual's habitual residence or place of work, or of the place of the alleged contravention. For Italy the authority is the Garante per la protezione dei dati personali; for the United Kingdom the Information Commissioner's Office; for the Abu Dhabi Global Market the Commissioner of Data Protection; for the United Arab Emirates outside the financial free zones the UAE Data Office; and for India the Data Protection Board of India.

Xailon Token Factory Privacy Notice · Version 1.0 · © [year] [Infinia Legal Entity Name]. All rights reserved.