Privacy Policy

Xylora Studios operates Xylo and is responsible for the handling described here. Questions and rights requests can be submitted through the protected contact route linked below; we do not publish email addresses that can be harvested automatically.

We process messages you send, Xylo's responses, assessment answers and results, donation details, and information included in a flag or support request. Conversations may contain health, sexual-life, abuse, religious, identity or other highly sensitive information. Share only what you are comfortable having processed under this policy, and avoid names, addresses, phone numbers or other identifiers where they are unnecessary.

The active conversation is stored in your browser so it can survive a refresh. Complete conversation transcripts, automated safety signals and user-submitted reports are transmitted to restricted internal review channels. They may be reviewed for safety, quality assurance, investigation and improvement of Xylo, including preparing and evaluating future AI systems. Human review may occur. Do not assume a transcript is monitored live or that sending a message will summon emergency help.

Assessment answers remain in the page while you complete the Depression Test. A result you choose to discuss with Xylo becomes part of the conversation transcript. Payment providers process card and transaction information under their own policies; Xylo receives only the details needed to administer a donation, such as donor contact information, amount, status and consent records.

Hosting and security providers may process IP address, approximate location inferred from it, device and browser details, timestamps, requested pages, request identifiers and error information. We use this to deliver the service, prevent abuse, diagnose failures and investigate incidents.

We process information to provide requested features, maintain conversation continuity, process donations, protect users and the service, investigate reports, improve quality, meet legal duties and establish or defend legal claims. Depending on applicable law, the grounds may include performance of a contract, legitimate interests, consent and compliance with legal obligations. Where explicit consent is required for sensitive information, your decision to submit it after seeing this notice provides that consent; you may stop using Xylo or clear the local conversation at any time.

Selected AI, hosting, delivery, payment and internal communication providers process information for Xylo. Access is limited to people and providers who need it for an authorized purpose. Information may be processed outside your country under the contractual and legal safeguards available for the relevant transfer.

Browser data remains until you use Clear conversation or remove site data. Internal transcripts, moderation records, transaction records and security logs are retained only as long as reasonably necessary for their stated purpose, legal obligations, dispute handling and system integrity, then deleted or de-identified where feasible. Backups and derived evaluation material may take additional time to cycle out. We use access controls, encrypted transport and server-side secrets, but no service can promise absolute security.

Xylo is not directed to children below the minimum age at which they may consent to online services where they live. A child should use Xylo only with appropriate parent or guardian involvement and should not disclose identifying information. A parent or guardian may submit a request concerning information they reasonably believe a child provided.

Depending on where you live, you may ask to access, correct, delete, restrict or object to processing, withdraw consent, request portability, or complain to a data-protection authority. Because Xylo has no user accounts and sessions use random identifiers, we may need the relevant session information and may be unable to identify a transcript without it. We may retain limited records where law requires or permits.

Use the contact page for privacy questions or rights requests. We may update this policy as the service or law changes; material changes will be identified on this page with a revised effective date.