Privacy Policy for Exania AI services.

Exania AI provides AI agents, chatbots and automation systems for businesses. Exania operates under the umbrella of Exohood Labs INC, 793 Commercial Rd, London E14 7HG, United Kingdom.

This Privacy Policy applies when you visit exania.ai, use the Try Exania demo, start a project, request pricing, contact support, contract with us, receive services from us or interact with an Exania powered agent on a client website, WhatsApp flow, booking flow, knowledge base or automation workflow.

If you are a client deploying Exania for your own customers, leads, employees or website visitors, you are responsible for giving those people the notices, consents and legal information required for your business use case.

This policy covers all current and future Exania business AI services, including Micro Bot, Launch Bot, Growth Agent, Automate System, Enterprise AI, monthly care plans, discovery, onboarding, support and optimization.

Website and analytics data

We may collect IP address, device type, browser type, approximate location, pages viewed, clicks, referral source, session behaviour, cookie identifiers and similar analytics data.

Sales and project data

We may collect name, company, email, phone, website, business type, selected package, budget, requested services, preferred channels, appointment preferences and any message you submit.

Client implementation data

We may collect FAQs, service descriptions, prices, product information, business hours, lead rules, tone of voice, documents, web pages, integrations, CRM fields, calendar rules, routing logic and support preferences.

Chat and automation data

When someone interacts with an Exania powered agent, the system may process message content, timestamps, conversation history, selected language, lead answers, submitted contact details, requested services, appointment preferences and technical metadata needed to provide the service.

Billing and support data

We may process invoices, payment status, package details, subscription records, transaction references, tax information, support tickets, screenshots, error messages and technical diagnostics.

Exania may process client supplied business knowledge, prompts, instructions, documents, conversation examples, live messages, test messages, workflow outputs and configuration data to build, test, launch, monitor and improve the specific agent or automation purchased by the client.

AI outputs may be incomplete, inaccurate, outdated or unsuitable for a specific decision. Exania does not guarantee that every AI response will be correct. Clients must review agent configuration, test responses, approve knowledge sources and set human escalation for important business, legal, financial, health, employment, safety or regulated decisions.

Unless expressly agreed in writing, clients must not submit unnecessary sensitive data, government identifiers, bank statements, health records, passwords, private keys, payment card numbers or special category data into ordinary chat flows.

Clients are responsible for how they use Exania agents in their own business. This includes making sure the agent is lawful, appropriate for the industry, properly disclosed to users and connected only to systems the client has authority to use.

• Clients must provide accurate business information, lawful knowledge sources and authorised integration access.
• Clients must publish privacy notices, cookie notices, consent wording, WhatsApp notices and customer disclosures required for their own visitors, leads, customers or employees.
• Clients must not use Exania to collect data they are not legally allowed to collect.
• Clients must review AI responses before launch and regularly monitor performance after launch.
• Clients must tell Exania before using agents in regulated, high risk, sensitive or legally restricted workflows.
• Clients remain responsible for final decisions, customer commitments, pricing, offers, refunds, advice, appointments and fulfilment.

Additional liability, payment, cancellation and indemnity terms may appear in the Exania Terms, project agreement, proposal, invoice or Data Processing Agreement.

Where privacy laws require a lawful basis, we may rely on contract, legitimate interests, consent, legal obligation, protection of rights, security, fraud prevention or another lawful basis available under applicable law.

For our own website, marketing, enquiries, playground, start flow, billing, support and analytics, Exania normally acts as a controller because we decide why and how that information is processed.

For client deployed agents, the client is often the controller for personal data of its own customers, leads, employees or website visitors. Exania may act as a processor or service provider when processing information according to client instructions.

A client project may require a Data Processing Agreement, Standard Contractual Clauses, security addendum, restricted data scope, retention rules or custom privacy setup. Those requirements must be disclosed and agreed before launch.

We use cookies and similar technologies to operate the website, remember preferences, understand behaviour, improve user experience, measure marketing performance and support business communications.

Our pages may use Google Analytics, Microsoft Clarity, Hotjar, HubSpot and Yandex Metrika. These tools may collect device identifiers, session events, page views, click behaviour, referral data, approximate location, browser information and similar analytics information.

Essential cookies are used for security and service operation. Non essential analytics and marketing technologies should be used in line with applicable cookie consent rules. You can manage cookies through the banner where available and through your browser settings.

We may share information with trusted providers and approved integrations where needed to operate, deliver, secure, analyse and improve Exania services.

• Hosting, infrastructure, database, logging and security providers.
• AI model and API providers used to generate agent responses or automate tasks.
• Analytics and behaviour tools such as Google Analytics, Microsoft Clarity, Hotjar and Yandex Metrika.
• CRM, forms, email, scheduling and customer support tools such as HubSpot or equivalent systems.
• Messaging platforms when WhatsApp, SMS, email or similar channels are enabled.
• Client approved integrations such as CRM, calendar, spreadsheets, e-commerce, documents or workflow tools.
• Professional advisers, payment providers, insurers, auditors, authorities or regulators where necessary.

We do not sell personal information to advertisers. We may disclose information if required by law, to protect rights, to investigate misuse or in connection with a restructuring, merger, acquisition or sale of assets.

Exania services may involve providers, infrastructure or support personnel located in different countries. Information may be processed in the United Kingdom, European Economic Area, United States, Canada or other locations where our providers operate.

Where required, we use appropriate safeguards such as data processing agreements, contractual commitments, transfer safeguards, vendor assessments and security controls.

Client projects with strict data residency requirements must disclose those requirements before implementation. Additional fees or technical limitations may apply where a client requires a restricted hosting region, private deployment or dedicated infrastructure.

We keep information only for as long as reasonably necessary for the purposes described in this policy, unless a longer period is needed for legal, accounting, security, dispute resolution or contract reasons.

Depending on your location and applicable law, you may have rights to request access, correction, deletion, restriction, portability, objection, withdrawal of consent and information about how your personal data is processed.

We may need to verify your identity before completing a request. Some rights are not absolute and may be limited by legal obligations, security requirements, confidential business information, technical feasibility or the rights of others.

If your data was processed by an Exania agent on behalf of one of our clients, we may direct you to that client because they may be the controller. We will support reasonable client requests where we act as a processor.

We use technical and organisational measures designed to protect information against unauthorised access, loss, misuse, alteration and disclosure. Measures may include encryption in transit, access controls, role based permissions, secure configuration, limited production access, logging, monitoring, backups, vendor review and incident response procedures.

No online service can guarantee absolute security. Clients are responsible for protecting their own accounts, passwords, API keys, CRM access, WhatsApp Business access, calendar credentials and third party tools connected to their agent.

If you believe a security issue affects Exania, contact us quickly with details so we can investigate.

• Exania is not responsible for client supplied inaccurate, unlawful, incomplete or misleading business information.
• Exania is not responsible for a client's failure to provide privacy notices, obtain consents or comply with laws that apply to the client's own business.
• Exania is not responsible for third party platforms, payment gateways, messaging providers, CRM tools, calendar tools, AI APIs, hosting providers or integrations outside our direct control.
• Exania does not provide legal, medical, financial, tax, employment, immigration, insurance or regulated professional advice through ordinary AI agents unless a specific written scope says otherwise.
• Clients must use human review for decisions that may affect rights, eligibility, pricing, refunds, safety, contracts, employment, health, finance, housing or regulated services.
• Any special data protection terms, private deployment, data residency, high risk processing or sensitive data workflow must be agreed in writing before launch.

Exania services are designed for businesses, not for direct use by children. Clients must not configure Exania agents to knowingly collect personal data from children unless they have the required legal basis, parental or guardian consent where required and a written agreement with Exania covering that use case.

Ordinary Exania agents should not request sensitive information such as passports, ID documents, bank statements, health data, passwords, payment card numbers, private keys or government identifiers unless the project has been specifically designed and contracted for secure handling of that information.

We may update this Privacy Policy to reflect changes in our services, legal requirements, technology, tracking tools, integrations or business operations. When we make material changes, we will update the date at the top of the policy and may provide additional notice where appropriate.

Your continued use of the website or services after an update means the updated policy applies from the effective date, subject to rights you may have under applicable law.

For privacy requests, data questions, deletion requests, security concerns or questions about this policy, contact Exania through the following channels: