Privacy Policy

1. Scope and essential points

This Policy explains how XCIS Consulting Inc, operating as XCIS AI (“XCIS,” “we,” “us,” or “our”), handles personal information in the XCIS-operated NuclearPath AI website and hosted Service. Personal information is information about an identifiable person and may include professional contact details, account-linked technical records and personal information appearing in prompts or documents.

We use necessary information to operate accounts, answer your requests, secure the Service and comply with law. The Public Service accepts non-confidential research material, not protected plant information or sensitive personal records. Conversations and uploads do not become public merely because software is made available as open source.

We do not use customer prompts, responses, files, workspace context or associated content to train or fine-tune models or create reusable model-evaluation datasets. No customer-content contribution or training permission is requested at signup. Section 6 explains the distinction between answering your requests and training.

Schedules P1 and P2 and the cookie disclosure in section 11 form part of this Policy. They describe recipients, processing locations and retention. An organization administrator may have access only under disclosed workspace permissions. An independent self-hosted operator is responsible for its own processing; this Policy applies where XCIS receives information.

2. Who is responsible

The responsible organization is XCIS Consulting Inc, operating as XCIS AI, 21-1640 Grandview St North, Oshawa, ON, L1K 0S6, Canada. Mohammed Ahmer Rafiq, Managing Partner, is our Privacy Officer. Send requests to hello@xcis.ai, addressed to the Privacy Officer, or write to the postal address above. Do not include sensitive or restricted material with an initial inquiry.

XCIS determines the purposes and means of processing for account administration, security, service operations and its communications. Where relevant law uses the term, XCIS is the controller for those activities.

Where an organization separately engages XCIS to process workspace personal information solely on its documented instructions under an executed data-processing agreement, that organization is the controller/business and XCIS acts as processor/service provider for that information. The agreement and organization notice identify this arrangement. A work email address alone does not establish it or authorize XCIS to repurpose organization content.

The Privacy Officer is responsible for privacy inquiries and complaints, rights requests, oversight of retention and provider handling, and coordination with the product and security teams. Questions about an organization’s separate purposes or workspace access should also be directed to that organization. We will assist with routing an appropriate request.

3. Information collected and its sources

Account and professional information. From you or a verified organizational invitation, we collect the account information requested in the interface, such as name, business email, organization, role, account identifier, country/region and necessary eligibility information. A business email is required for registration. Corporate single sign-on is not currently linked. We do not require a full date of birth or government identifier for routine signup. Schedule P1 identifies authentication and communications processing.

Service Content. From your interactions, we process prompts, responses, selected sources, citations, conversation titles and history and, where enabled, files, extracted text, indexes, embeddings, project context, annotations, operating experience and decision history. We also process information you voluntarily send for support. These records can identify people or reveal an organization’s activities. Embeddings or pseudonyms are not automatically anonymous.

Technical and security information. We record service transactions for infrastructure and service-operation assessment. Depending on the interaction, these records may include IP address, approximate region, browser/device type, session and request identifiers, timestamps, feature usage, latency, usage counts, errors, authentication events and abuse indicators. Diagnostic or safety records may contain relevant portions of a prompt or response; the no-training commitment does not mean no logging. We limit access and use to the stated service, security and support purposes. We do not collect precise GPS location, biometric identifiers or cross-site advertising profiles under this Policy.

Agreement, support and communications records. We retain records of accepted policy versions, account preferences, optional marketing choices, support messages and privacy-request verification and responses as described in Schedule P2. Ordinary support is not a channel for protected nuclear information, health records, passwords or other sensitive content.

Source Materials and third parties. Regulatory sources and appropriately licensed publications may contain professional names or other personal information. We assess rights to index and reuse them; public internet availability is not unrestricted permission. Any external search or retrieval processing is separately described in Schedule P1. Future user-authorized connections require an appropriate notice before activation.

Payments and excluded information. The public free offering does not require payment-card information. A future paid checkout would identify the payment provider and processing before collection. The Public Service is not intended for children’s information, sensitive personal records, classified or controlled information, or confidential plant/client documents. Accidental receipt may require restricted incident handling and lawful removal or securing of the information.

4. Purposes, necessity and choices

We identify the purposes for collection and use and limit processing to what is reasonably necessary. The main purposes are set out below.

The lawful basis depends on the activity and jurisdiction, including meaningful consent, performance of an applicable contract, a legal obligation or another basis the law permits. We do not use “legitimate interests” as a universal substitute for Canadian consent requirements. A Privacy Policy acknowledgement is not blanket consent to every possible activity. Optional marketing is not a condition of access.

5. What happens when you ask a question

The Service processes your question and any permitted context to retrieve relevant information and generate a response. This may involve transmitting prompts and selected source passages to the AI provider identified in Schedule P1, parsing files, creating embeddings and indexes, retrieving content, and storing history where that function is enabled.

The application uses Microsoft Azure infrastructure, a managed PostgreSQL database, Azure-hosted retrieval/indexing and Azure OpenAI models for inference and embeddings. Schedule P1 describes those arrangements. Separate saved histories, indexes and service records can persist even though generating a response does not itself train the model.

External web search. A request may use external web retrieval where that function is made available. It is initiated in response to your request, not as independent background tracking. The associated search results stored by NuclearPath AI form part of that conversation and follow its deletion rules. Before a function sends information to a separate search provider or website, we will identify the recipient, data sent and relevant processing information in the function’s notice or this Policy. Requesting an answer is not permission to send an entire private workspace or unrelated files to an undisclosed recipient.

Storage is not the same as transmission. Keeping a retrieved result in Azure does not mean that a search query, URL or network request never reached a third party. An outbound search or fetch may disclose search terms, requested URLs and connection information to the destination. We do not represent that all activity stays within the application simply because its results are saved there. The source site’s own notice applies when you visit a link directly.

Inference and retrieval are not training. Using information to answer the current request or index your own authorized workspace does not itself update the underlying model’s weights. Reusing customer interactions in generalized training, fine-tuning or model-evaluation datasets is not permitted under section 6.

Contracted providers receive information needed for their functions. We do not authorize independent model training on User Content. Microsoft may apply automated safety checks and, under the applicable abuse-monitoring arrangements, restrictively review flagged prompts and responses, including authorized human review. We do not claim that provider content logging or human review is disabled. Provider storage and retention remain distinct from XCIS’s application records, as described in P1 and P2.

A limited group of authorized XCIS personnel may access production information where necessary for service operation, your support request, security or incident handling. Access is restricted by purpose and applicable confidentiality obligations. This is not permission to read conversations for sales, unrelated research or model development. A restricted production-access group does not, by itself, establish that all personnel access occurs in a particular country.

6. No customer-content model training

We do not use User Content, including prompts, responses, files, extracted passages, workspace history, embeddings or related customer content, to train or fine-tune models, create reusable evaluation or benchmark datasets, or develop general-purpose model improvements for XCIS, other users or third parties. Customer-content model-improvement contributions are not offered.

We do not request a training opt-in, and an account registration, rating, support message, organization administrator’s action or public sharing does not supply training permission. Removing direct identifiers, calling information “aggregated,” or creating synthetic examples from customer content does not bypass this commitment.

This does not prevent processing necessary to answer your request, maintain your authorized workspace, apply safety checks or resolve a specific support or security incident. We may improve service reliability using minimized operational measurements and lawful anonymous statistics. Independently sourced public or licensed reference datasets remain subject to their own rights and applicable law.

Any future proposal for customer-content training would require a separately described lawful arrangement, appropriate notice and any required express consent or rights-holder agreement before it begins. Updating this Policy does not retroactively authorize a new use of previously collected information.

7. Aggregation, anonymization and public research

We may calculate and retain anonymous totals for searches, requests, documents created or reviewed, adoption, service performance and appropriately supported estimates of time saved. These statistics help operate the Service and explain its use to the nuclear ecosystem. Estimates are not guaranteed customer outcomes. We may retain non-identifying aggregate counts after an individual account is deleted, but not the person’s prompts, files or identifiable history merely to reconstruct those counts.

Before publishing an aggregate, we assess whether a person, organization, utility, facility, project or sensitive event could be singled out or inferred, including through small groups or combination with other information. We remove or combine rare categories and exclude confidential or restricted facts. We do not sell identifiable usage histories or present customer case studies without permission.

Information that can reasonably be linked back to a person remains protected. Deleting an account identifier, applying a hash or marking a record inactive does not establish anonymization. We do not attempt re-identification except lawful, controlled testing needed to evaluate the effectiveness of de-identification. Where Quebec law applies, claimed anonymization must meet its applicable requirements.

Anonymous statistics do not grant a right to publish the underlying documents, conversations or protected material. We do not retain identifiable customer conversations indefinitely by relabelling them anonymous.

8. Who receives information

Service providers. Hosting, database, storage, authentication, communications, AI inference, retrieval, monitoring and support providers receive information needed for their roles. Schedule P1 identifies those arrangements. Providers are not automatically entitled to independent use merely because they supply a tool.

Organization participants and selected recipients. Where collaboration is enabled, members and verified administrators receive access according to disclosed permissions. Accounts at the same email domain are not automatically mutually visible. Information you deliberately share may be retained by independent recipients under their own policies; revoking a link cannot necessarily recall their copies.

Legal, safety and incident recipients. Where necessary and lawful, limited information may be disclosed to regulators, courts, law-enforcement authorities, security responders, insurers and professional advisers. We assess demands, seek to limit inappropriate requests and provide notice where permitted. Restricted nuclear information requires an appropriately authorized handling process.

Corporate transactions. Information may be reviewed or transferred in a lawful financing, reorganization, merger or business sale with appropriate safeguards. A transaction does not override existing privacy restrictions or authorize materially incompatible processing without the required notice and legal basis.

No advertising sale or sharing. We do not sell personal information, share it for cross-context behavioural advertising, or disclose it for third parties’ independent direct marketing. Necessary contracted processing is disclosed rather than described as “no sharing.” We do not knowingly sell or share minors’ information. Any material change requires assessment and accurate notice before activation.

9. Storage, international processing and security

Hosting and storage. The shared Public Service uses Microsoft Azure infrastructure in Canada and the United States. You cannot select a country-specific instance or geographic isolation when signing up. Storage, AI inference, backup replication and personnel access are separate activities; the location of a website or storage resource does not determine every processing location.

Global AI processing. Our use of Azure OpenAI includes Global deployments. Microsoft describes Global deployments as permitting processing in any geography where the relevant model is deployed. Prompts, retrieved context and responses may therefore be processed outside Canada, the United States and North America. The Public Service does not provide a North-America-only processing commitment. Microsoft’s deployment documentation describes this distinction; it does not change XCIS’s responsibilities under this Policy.

• Microsoft: deployment types and processing locations (opens in a new tab)

Regional requirements. If your organization requires data to be stored, processed, backed up or accessed only in a specified jurisdiction, do not upload that information to the Public Service. Contact hello@xcis.ai to discuss a separately scoped local or region-restricted deployment. Availability is not guaranteed and depends on agreed requirements, a suitable technical configuration, separate written terms and any required regulatory or transfer assessments.

Changes and transfers. We may move resources within the disclosed processing arrangement for availability, capacity or cost management. This is not permission to disregard a material change in recipients, countries, purposes or protections. We will update the relevant disclosures and provide notice, obtain consent or implement additional safeguards where required before a materially different processing arrangement begins. Foreign authorities may obtain access under the laws applicable to a recipient. Accepting this Policy is not an export authorization or a substitute for required transfer safeguards.

Safeguards. Production access is limited to authorized personnel with a service need. We apply administrative, technical and organizational safeguards appropriate to the information and risk, including controls on permitted access and disclosure. Specific encryption parameters, audit certifications, customer-managed keys, air-gapping and dedicated residency are not promised by this Policy. No system can guarantee absolute security; this does not excuse our legal duties.

Incidents. We investigate suspected incidents, restrict or stop affected processing where appropriate, mitigate harm, keep required records and notify affected individuals, organizations and authorities when law or contract requires. Privacy, contractual and nuclear-information reporting duties can differ. For an initial report, contact hello@xcis.ai without attaching or quoting sensitive or restricted content.

10. Retention and deletion

We retain personal information only for an identified, necessary and lawful purpose. Schedule P2 distinguishes active records, logs, support correspondence, legally required records and backups. Dormant status, account closure, soft deletion and permanent removal are different events.

Active-data deletion. On a valid account, conversation, workspace or file deletion request, we will promptly stop ordinary access, search and sharing for the affected material. We will permanently remove the relevant active account data, prompts, responses, uploaded files, extracted text, chunks, indexes, embeddings and associated saved search results within 30 days of the valid request, sooner where applicable law requires. Account deletion covers the user-owned material associated with that account. Marking content inactive or simply removing the account identifier is not permanent deletion.

Backup copies. Residual copies in backups, snapshots and disaster-recovery archives may remain after active deletion, but will expire no later than 12 months after the valid deletion request, unless a specific legal preservation duty requires a narrower identified record to be retained. This is the total residual backup period measured from the request, not a new twelve months added after active deletion. Backup copies are restricted from ordinary use, search, analytics and training. If a backup is restored, the applicable deletion and access restrictions must be reapplied before the restored data are returned to ordinary service use.

Exceptions and other recipients. A limited record may be preserved for an identified legal duty, actual claim or specific security incident, only for that continuing purpose. Provider abuse-monitoring records and copies lawfully controlled by an organization or independent recipient may require separate handling. We will explain an applicable exception and assist with requests; we do not treat these categories as a blanket exemption from deletion or privacy law. The scheduled periods do not extend a mandatory response or deletion deadline.

Aggregation. Genuinely anonymous, non-confidential aggregate statistics may remain after deletion. We do not keep source prompts, uploaded files or identifiable history merely because aggregate metrics are useful. Removing a username, hashing an identifier or marking a record inactive does not establish that the underlying content is anonymous.

11. Cookies, similar technologies and communications

The application uses cookies or browser storage necessary for authentication and session continuity. A user who elects to remain signed in can have an authentication token retained for up to 48 hours. This token is used to recognize the signed-in session, not to track browsing across other websites. Removing a browser token does not delete server-side account or conversation records.

The application does not currently use optional cross-site tracking, advertising cookies, third-party tracking pixels or session-replay tools. Service transaction logs and anonymous operational statistics are separate from advertising cookies. The use of a necessary authentication token means the application is not cookie-free.

Browser settings can remove or block cookies and local storage, but doing so may prevent sign-in or other requested features. Sign out on a shared device. If optional tracking or analytics technologies are introduced, we will disclose their provider, purpose, information and lifetime and provide the choices required by law before activation. We do not label optional tracking necessary.

Where applicable law requires it, we honour recognized universal opt-out signals for the activities they cover. A legacy browser “Do Not Track” setting is not necessarily the same as a legally recognized signal. Because we do not sell personal information or use cross-context advertising, these signals do not stop necessary account processing.

Essential service, account, privacy and security messages are separate from optional product news. Optional marketing requires a separate, initially unchecked choice or another lawful permission, with an unsubscribe method. You can also contact hello@xcis.ai to withdraw marketing permission. Declining marketing does not prevent ordinary access or remove necessary service notices.

12. Your privacy choices and requests

Subject to applicable law, you may request confirmation and access, correction, deletion, a portable copy, information about recipients, restriction or objection, withdrawal of consent, or review of certain automated decisions. Some rights and exceptions depend on the law governing the processing.

Send a request to hello@xcis.ai, addressed to the Privacy Officer, or write to XCIS Consulting Inc, operating as XCIS AI, 21-1640 Grandview St North, Oshawa, ON, L1K 0S6, Canada. Use the subject “NuclearPath AI privacy request”; for a review or appeal, use “NuclearPath AI privacy appeal.” These labels help routing but are not mandatory for a valid request.

You do not need an account to request action concerning information about you in a source corpus or another user’s content. Provide enough detail to locate the information without sending government identifiers, protected documents or unnecessary sensitive material. We will offer an appropriate verification route if one is needed.

We verify identity and representative authority proportionately. Authorized agents may act where permitted. We use verification information only for the request and related protection. We respond within applicable statutory periods, notify you of permitted extensions, and explain refusals and available appeal or regulator-complaint routes. We do not discriminate for exercising protected rights.

Withdrawing consent to optional communications does not affect ordinary access. Withdrawing consent needed to supply a feature may mean we can no longer provide that feature; we explain the consequence. Where an AI response cannot establish a definitive fact, we may correct a source or index, restrict presentation or explain uncertainty rather than treating inferred personal information as unprotected.

13. Canadian provisions

Where the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, we follow its applicable accountability, reasonable-purpose, consent, access, safeguards and retention requirements. Depending on the activity and location, Alberta, British Columbia, Quebec or other legislation may also apply. Server location alone does not determine the applicable rules.

The Privacy Officer function and contact details are in section 2. Our privacy-governance framework assigns responsibility for inquiries and complaints, requests, access decisions, provider oversight, retention and incident coordination. Retention rules are summarized in P2; complaints follow section 12. Where Quebec law applies, we conduct required privacy-impact and cross-border assessments, apply required privacy defaults and address applicable access, correction, portability and de-indexing rights.

Where exclusively automated processing of personal information produces a decision covered by applicable law, we provide required information and an opportunity for review by personnel able to address it. Where Alberta law requires disclosure of providers outside Canada, the relevant countries, purposes and contact are given in P1 and section 2; you may ask about provider-handling policies.

You may complain to the Office of the Privacy Commissioner of Canada or the competent provincial privacy authority, as applicable. Contacting us is not a condition of a statutory complaint, and no arbitration waiver is required to exercise privacy rights.

14. United States provisions

Where an applicable US state privacy law covers our processing, you may have rights to know/access, correct, delete or obtain portable information and to opt out of sale, targeted advertising or specified consequential profiling. Some laws also address sensitive information, recipients, authorized agents and appeals. We apply the relevant law rather than assuming all states have the same rules.

For California notice-at-collection purposes, sections 3–10 and P1–P2 describe identifiers, professional information, internet/network activity, electronic content and any account credentials falling within a sensitive-information category, together with sources, business purposes, recipients and retention. Sensitive authentication information is used for necessary account/security purposes. We do not seek biometric templates, precise geolocation, protected-trait profiles or sensitive personal records.

This Policy describes the current hosted offering and its continuing handling of information retained from earlier testing or use. It does not establish that there was no processing before publication, or retroactively authorize a use or disclosure that required an earlier notice or permission. You may request information about the categories, recipients and uses applicable to your information, including the relevant earlier period, through section 12.

The no-sale and no-cross-context-advertising commitments in section 8 apply. There is no financial-incentive programme tied to personal information. Where an applicable law provides an appeal, use the privacy contact in section 12; we provide the required decision and applicable regulator-contact information. Nothing limits non-waivable privacy or consumer remedies.

15. Availability, other regions and automated decisions

The initial supported customer markets are Canada and the United States. A publicly reachable website does not establish that the Service is offered or legally suitable in every other market. Additional-market access may require separate assessment and arrangements. This customer-market scope does not restrict the locations of Azure Global processing described in section 9.

Applicable mandatory privacy, consumer and language protections continue to apply despite the Ontario governing-law clause. Required French-language materials and the applicable language-choice process must be provided before contracting where the law requires them. Contact the Privacy Officer about language or accessibility needs.

Where EEA or UK data-protection law applies, XCIS is responsible as described in section 2. Contract is used only for processing objectively necessary to the applicable contract; proportionate security or operations may rely on properly assessed legitimate interests; legal duties may support compliance processing; and optional activities require the consent or other basis that law requires. An employer’s contract does not automatically cover every use of employee or third-party data.

Applicable access, erasure, correction, portability, restriction, objection and withdrawal rights may be exercised through section 12. You may complain to a competent supervisory authority, including in your habitual residence where available. Restricted transfers require an applicable adequacy decision or other completed lawful safeguards, with information about them available on request subject to lawful redaction.

We do not use the Public Service to make solely automated employment, credit, licensing-eligibility or similarly significant decisions about people. Security controls may restrict an account; you may request human review. New consequential automated processing requires a separate assessment and notice before deployment. AI-generated responses are research assistance, not regulatory decisions.

16. Children, third-party links and changes

The Service is intended for adults with contractual capacity, not children. We do not knowingly create accounts for people under 18. Contact the Privacy Officer if children’s information is discovered; we will address it lawfully, including restriction or deletion where appropriate, without inviting additional sensitive disclosure.

Links to regulators, publishers or third-party sites do not make XCIS responsible for those parties’ independent processing. Review their notices before supplying information. XCIS remains responsible for its own disclosures, provider choices and contractual duties.

We publish a dated version and provide appropriate notice of material changes. We obtain any required new consent before a new purpose begins. We do not use a revised notice to retroactively authorize training on previously collected information. Contact hello@xcis.ai for a copy of a prior version relevant to your account.

Schedule P1. Providers and processing locations

This schedule describes the arrangements used for NuclearPath AI. Read it with sections 5, 8 and 9 and Schedule P2. Microsoft’s own documentation describes the provider’s service; XCIS remains responsible for its disclosures and applicable provider-management duties.

• Microsoft: Azure-hosted model data, privacy and security (opens in a new tab)
• Microsoft: abuse monitoring (opens in a new tab)

A new recipient or materially different transfer must be addressed before activation where required by law or an applicable contract. You may ask hello@xcis.ai for additional information about provider handling, processing locations and applicable safeguards. A general reference to a public or global service is not a nuclear export authorization.

Schedule P2. Retention and deletion

The periods and criteria below are subject to section 10 and applicable privacy rights. The 30-day active-data and twelve-month backup commitments are separate. Where a shorter period is required by law, that requirement prevails. Deletion of a record does not establish that all independently held copies have already been erased.