NuClear Path AI — TERMS AND CONDITIONS OF USE AND PRIVACY POLICY

Last Updated: September 10, 2026

Please read these Terms and Conditions ("Terms") carefully before requesting access to, or using, NuClear Path AI (the "Service," "System," or "Platform"), operated by XCIS AI ("XCIS AI," "we," "us," or "our").

NuClear Path AI is an agentic AI assistant for the nuclear and energy industry. It does not merely answer questions: it autonomously decides which tools to use — searching a curated regulatory knowledge base, performing live web searches, fetching public web pages, and analyzing documents you upload — and chains those steps together to produce a response.

By requesting access to, creating an account on, or using the Service, you agree to be bound by these Terms, including the Privacy Policy in Part B. If you do not agree with any part of these Terms, you must not use the Service.

PLAIN-LANGUAGE SUMMARY

This summary is for convenience only. The full Terms below govern.

NuClear Path AI is a research assistant for nuclear licensing and regulation. It helps you find, read, and understand material from regulators such as the CNSC (Canada) and the NRC/DOE (United States), and related industry standards.
It is not a regulator, a lawyer, or a licensed engineer. Its answers can be wrong, incomplete, or out of date. Verify everything against official sources and qualified professionals before relying on it.
It is an autonomous agent. It chooses its own path — which searches to run, which documents to read — and that path is not fully predictable.
The Service is free of charge, but access is not automatic. You request access, we review the request manually, and we may approve or decline it at our discretion.
Never upload sensitive nuclear information. No prescribed information, safeguards information, security-sensitive information, export-controlled technical data, classified material, or anything you are not authorized to share.
Your data is used to run the Service for you — not to train AI models. Your questions and uploaded documents are processed by third-party cloud and AI providers to generate answers, under terms that prohibit them from training on your data.
You can ask us to delete your account and data at any time.

PART A — TERMS AND CONDITIONS OF USE

1. DEFINITIONS

"System," "Service," "Platform," or "Agent" means NuClear Path AI: the hosted conversational application, its autonomous AI workflows, orchestration layers, models, tools, knowledge base, and APIs made available by XCIS AI.
"User" or "You" means any individual or entity that requests access to, or uses, the System. If you use the System on behalf of an organization, "You" includes that organization, and you confirm you are authorized to bind it to these Terms.
"Actions" or "Tool Calls" means any autonomous steps the Agent takes to answer your request, including knowledge base queries, live web searches, retrieval of public web pages, retrieval and analysis of your uploaded documents, and any other tool the Agent invokes.
"Your Content" means the prompts, questions, instructions, documents, and other material you submit to the System.
"Output" means any content, summaries, citations, analyses, or other results generated by the System in response to Your Content.
"Regulator" means any governmental or statutory body with authority over nuclear activities, including the Canadian Nuclear Safety Commission (CNSC), the U.S. Nuclear Regulatory Commission (NRC), and the U.S. Department of Energy (DOE).

2. DESCRIPTION OF SERVICE AND "AS-IS" NATURE

2.1 What the Service does

NuClear Path AI is an AI-powered assistant designed to help nuclear industry professionals navigate licensing and regulatory frameworks. Its capabilities include:

Regulatory navigation across publicly available material from the CNSC (including REGDOCs and the Nuclear Safety and Control Act and its regulations), the NRC (including Regulatory Guides and 10 CFR), the DOE, and references to industry standards such as those published by the CSA Group.
Search and summarization of a curated knowledge base, plus live web search when the knowledge base does not contain an answer.
Analysis of documents you upload (for example, a draft licence application or a technical report) so you can ask questions about them in context.
Mapping of regulatory requirements to related standards, guidance, and supplier categories.

The Service is intended for utilities, reactor developers (including SMR and advanced reactor projects), nuclear vendors and suppliers, nuclear medicine organizations, technical and engineering partners, regulators, and other organizations subject to CNSC or NRC/DOE oversight.

2.2 Free access

The Service is currently provided entirely free of charge. We do not charge fees and collect no payment information. Because it is free, the Platform is provided on an "AS IS" and "AS AVAILABLE" basis without warranties of any kind (see Section 11). We may introduce paid tiers or features in the future; if we do, we will give you notice and the choice to continue on a free tier where one is offered, or to stop using the Service.

2.3 No Service Level Agreements (SLAs)

We do not guarantee continuous uptime, error-free operation, response times, or the perpetual availability of any specific agentic capability, tool, knowledge base source, or third-party connector. The Service is under active development; features may change, break, or be withdrawn without notice.

2.4 Open-source components

Portions of NuClear Path AI may be released by XCIS AI under an open-source licence. Where that is the case, the applicable open-source licence governs the code as published in the relevant repository; these Terms govern your use of the hosted Service.

3. WHAT THE SERVICE IS NOT — REGULATORY, LEGAL, AND ENGINEERING DISCLAIMER

This section is important. Please read it carefully.

3.1 Not regulatory, legal, or engineering advice

The Service provides general information and research assistance only. Nothing it produces constitutes:

legal advice or a legal opinion;
regulatory advice, a regulatory determination, or a statement of a Regulator's position;
professional engineering advice, a safety analysis, or a safety case;
a licensing basis, a compliance certification, or evidence of compliance;
an interpretation of any licence condition, regulatory document, standard, or law that you may rely on with a Regulator.

Only the relevant Regulator can interpret and apply its own requirements to your project. Only a qualified professional — a licensed professional engineer, a nuclear safety specialist, regulatory affairs counsel — can advise you on your specific situation.

3.2 AI outputs may be inaccurate

The Service uses large language models (LLMs). LLMs can and do:

generate statements that sound authoritative but are false, fabricated, or unsupported ("hallucinations");
misquote, misnumber, or misattribute regulatory clauses, document versions, effective dates, and citations;
rely on material that is outdated, superseded, withdrawn, or in draft;
miss applicable requirements entirely;
conflate Canadian and U.S. frameworks, or different reactor technologies and licence classes.

Regulatory frameworks change frequently. The knowledge base is refreshed periodically but is not guaranteed to reflect the current version of any document.

3.3 Your verification obligation

You are solely responsible for independently verifying any Output before using it for any purpose, and in particular before:

making any decision affecting nuclear safety, security, safeguards, environmental protection, or radiation protection;
preparing or submitting any licence application, licence amendment, regulatory filing, event report, or correspondence to a Regulator;
designing, procuring, constructing, commissioning, operating, modifying, or decommissioning any nuclear facility, system, structure, or component;
making any procurement, contractual, or supplier-qualification decision.

Always check the official, current source document on the Regulator's or standards body's website, and always involve qualified professionals.

3.4 No relationship with Regulators

NuClear Path AI is an independent product of XCIS AI. It is not affiliated with, endorsed by, sponsored by, or operated on behalf of the CNSC, the NRC, the DOE, the CSA Group, the IAEA, or any other Regulator, government body, or standards organization. References to those bodies are for identification and informational purposes only.

4. AUTONOMOUS AGENCY AND AGENT BEHAVIOR

4.1 Execution of multi-step tasks

You acknowledge that the System does not merely suggest text. To answer your request, the Agent autonomously plans and executes multi-step workflows, which may include querying the knowledge base, running live web searches, fetching content from public websites, retrieving and reading portions of your uploaded documents, and combining the results. These Actions are triggered by your request but chosen and sequenced by the Agent.

4.2 Unpredictability of generative workflows

Due to the probabilistic nature of LLMs and agentic loops, the specific path, tools, sources, or search terms the Agent chooses to achieve a given goal may be non-deterministic and unpredictable. The same question may produce different Outputs, drawn from different sources, on different occasions. You accept all risks associated with autonomous execution pathways, including the risk that the Agent consults an unreliable web source or fails to consult a relevant one.

4.3 Scope of autonomy

At present, the Agent's Actions are limited to reading, searching, and analyzing. The Agent does not write to external systems, send communications, execute transactions, or act on your behalf with any third-party service using your credentials. If we expand the Agent's capabilities in the future (for example, integrations with project management or document management systems), we will update these Terms, and any additional Actions will be governed by Section 5.

5. USER RESPONSIBILITIES AND "HUMAN-IN-THE-LOOP"

5.1 Ultimate responsibility for actions and outputs

The Agent operates strictly under your delegation and authority. Any Action the Agent takes in response to your request, and any use you make of an Output, is legally attributed to you as if you had performed it manually. This includes any downstream use of an Output in a regulatory submission, design decision, or safety-related activity.

5.2 Monitoring and oversight

You must keep a qualified human in the loop. You are responsible for reviewing the Agent's Outputs, checking the sources it cites, and confirming its conclusions before acting on them. The Service is a tool to assist experts, not a substitute for them.

5.3 Credentials and third-party services

The Service does not currently ask for, or accept, your API keys, tokens, or credentials for external services, and you must not submit them. If future versions offer integrations that use your credentials, you will be solely responsible for any costs, resource consumption, or data modifications made by the Agent using those credentials.

5.4 Accurate information and account security

You must provide accurate, current, and complete information in your access request and keep it up to date. You are responsible for keeping your password confidential and for all activity under your account. Accounts are personal and non-transferable: do not share your credentials or let others use your account. Notify us immediately at hello@xcis.ai if you suspect unauthorized access.

5.5 Eligibility

You must be at least 18 years old and legally able to enter into these Terms. The Service is a professional tool and is not directed at minors or consumers.

6. ACCESS REQUESTS AND MANUAL APPROVAL

6.1 Access is by request only

You cannot simply sign up. To use the Service, you must:

Submit an access request with your first name, last name, work email address, and company or organization.
Wait while we review the request. Review is manual and performed by XCIS AI personnel. We may consider, among other things, whether your organization operates in or serves the nuclear or energy sector, whether your email domain matches your stated organization, and any other information reasonably relevant to the request.
If approved, you will receive an email containing a single-use, time-limited link to create your account and password.

6.2 Discretion

We may approve or decline any request at our sole discretion, without giving reasons. Approval does not create any ongoing entitlement; we may later suspend or revoke access as described in Section 13. Requesting access using a false identity, a false organization, or someone else's email address is a material breach of these Terms.

7. PROHIBITED UPLOADS — SENSITIVE NUCLEAR INFORMATION

You must not upload, paste, or otherwise submit to the Service any of the following, regardless of jurisdiction:

Prescribed information as defined under the Nuclear Safety and Control Act (Canada) and the General Nuclear Safety and Control Regulations, including non-public information about nuclear substances, nuclear facilities, or security arrangements;
Safeguards Information (SGI) or Safeguards Information–Modified Handling (SGI-M) under 10 CFR 73.21–73.23 (United States);
Classified information of any government, including Restricted Data or Formerly Restricted Data under the U.S. Atomic Energy Act;
Security-sensitive information, such as physical protection plans, security force details, vulnerability assessments, cyber security architectures, or non-public emergency response plans;
Export-controlled technical data, including information controlled under Canada's Export and Import Permits Act and the Nuclear Non-proliferation Import and Export Control Regulations, or under U.S. 10 CFR Part 810, the Export Administration Regulations (EAR), or the International Traffic in Arms Regulations (ITAR);
Controlled Unclassified Information (CUI) or Official Use Only (OUO) material;
Proprietary, confidential, or trade-secret information belonging to a third party (including a vendor, licensee, or Regulator) that you are not authorized to disclose;
Personal information about other individuals beyond what is strictly necessary, and never health, biometric, or security-clearance information;
Any information whose disclosure to XCIS AI or to our third-party processors would breach a law, licence condition, non-disclosure agreement, or security clearance obligation.

Treat everything you submit as if it will be transmitted to and processed by cloud services operated by third parties in Canada and/or the United States — because it will be (see Part B). If you are unsure whether material is sensitive, do not upload it.

8. PROHIBITED CONDUCT

You agree not to use the System to:

plan, facilitate, or carry out any act that endangers nuclear safety or security, or attempt to obtain information that would assist in the theft, diversion, or sabotage of nuclear material or facilities;
deploy malicious code, self-replicating bots, or automated cyber-attack routines;
automate deceptive practices, financial scams, or mass-scale disinformation campaigns;
bypass, probe, or disable rate limits, security guardrails, authentication, access controls, or safety filtering mechanisms;
intentionally delete, corrupt, or alter data or infrastructure belonging to third parties without explicit authorization;
reverse-engineer, scrape, crawl, or bulk-extract the Service, its knowledge base, or its Outputs, whether manually or by automated means;
build a competing product, or train, fine-tune, or benchmark a machine learning model, without our written permission;
misrepresent an Output as an official statement of any Regulator, standards body, or XCIS AI;
resell, sublicense, or provide the Service to third parties as a bureau or managed service;
execute workflows or take actions that violate any local, provincial, state, national, or international law, regulation, licence condition, or sanctions regime.

9. INTELLECTUAL PROPERTY AND DATA

9.1 Your Content

You retain all rights to the prompts, instructions, documents, data, and context you supply to the System. You grant XCIS AI a worldwide, non-exclusive, royalty-free licence to host, store, copy, process, transmit, index (including by creating text chunks and vector embeddings), and display Your Content solely to the extent necessary to provide, secure, maintain, and improve the Service for you and as described in the Privacy Policy. This licence ends when Your Content is deleted from our systems, subject to the backup retention periods in Part B.

9.2 No model training

We do not use Your Content to train or fine-tune large language models, and our AI providers are contractually prohibited from doing so.

9.3 Output ownership

To the maximum extent permitted by applicable law, we claim no ownership over the Outputs generated for you, and you may use them for your internal professional purposes. Because Outputs are machine-generated and may be similar or identical to Outputs generated for other Users, we do not grant you exclusive rights in any Output. You are responsible for ensuring that your use of an Output does not violate third-party copyright or proprietary rights.

9.4 Third-party material in Outputs

Outputs frequently quote, summarize, or link to material owned by third parties — for example, CNSC regulatory documents (Crown copyright, Canada), NRC documents (largely U.S. public domain), and CSA standards, which are copyrighted and licensed commercially by the CSA Group. The Service may describe or reference a standard, but it does not give you a licence to the standard itself. You are responsible for obtaining any licence required to use third-party material and for complying with the terms of the original source. If you reproduce an Output externally, you must not present it as reviewed, approved, or issued by any Regulator, standards body, or XCIS AI.

9.5 Our intellectual property

The Service — including its software, user interface, prompt designs, agent orchestration, knowledge base structure, indexes, embeddings, trademarks, and branding — is owned by XCIS AI or its licensors and is protected by copyright, trademark, and other laws. Except for the limited right to use the Service under these Terms, no rights are granted to you. "NuClear Path AI" and "XCIS AI" are trademarks or trade names of XCIS AI and may not be used without our prior written consent.

9.6 Open-source contributions

Any modification or distribution of the underlying open-source software core must adhere to the specific open-source licence associated with the relevant repository.

10. THIRD-PARTY SERVICES

The Service is built on, and transmits data to, third-party services, including cloud hosting, AI model inference, search indexing, database, email delivery, and web search providers. Part B describes what categories of data each type of provider receives. We may change, add, or remove providers as the Service evolves.

Our AI providers process your prompts and relevant portions of your uploaded documents to generate Outputs. We use these providers under enterprise or API terms that do not permit them to use your data to train their models. We do not control those providers' infrastructure and are not responsible for their acts or omissions beyond what applicable law requires.

Outputs and the Service may contain links to external websites. We do not control and are not responsible for those sites or their content. Live web search results are drawn from the open internet and may include material that is inaccurate, biased, out of date, or unrelated to the nuclear sector.

11. DISCLAIMER OF WARRANTIES

THE SERVICE AND ALL OUTPUTS ARE PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND. To the maximum extent permitted by law, XCIS AI disclaims all warranties, express, implied, or statutory, including any warranty of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, completeness, currency, or reliability, and any warranty that the Service will be uninterrupted, timely, secure, or error-free.

Without limiting the above, XCIS AI does not warrant that:

any Output is correct, complete, current, or applicable to your project or facility;
any Output reflects the current position, interpretation, or requirements of any Regulator;
the knowledge base contains every document relevant to your question, or the latest version of any document;
the Agent will choose the most appropriate tools or sources for a given request;
use of the Service will result in regulatory compliance, licence approval, or any particular outcome.

12. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL XCIS AI, ITS PARTNERS, DIRECTORS, EMPLOYEES, CONTRACTORS, LICENSORS, OPEN-SOURCE CONTRIBUTORS, OR DEVELOPERS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES. THIS INCLUDES, WITHOUT LIMITATION, LOSS OF PROFITS, REVENUE, BUSINESS, GOODWILL, DATA, OR OPPORTUNITY; SYSTEM CORRUPTION; THE COST OF SUBSTITUTE SERVICES; SECURITY BREACHES ARISING FROM THE AGENT'S AUTONOMOUS TOOL USE; OR ANY LOSS, DAMAGE, INJURY, REGULATORY ACTION, LICENCE DELAY OR DENIAL, ENFORCEMENT ACTION, OR PENALTY ARISING FROM ANY DECISION, SUBMISSION, DESIGN, OPERATION, OR OTHER ACTION TAKEN IN RELIANCE ON THE SERVICE OR ANY OUTPUT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

XCIS AI's total aggregate liability arising out of or relating to the Service or these Terms will not exceed the greater of (a) the amount you paid to XCIS AI for the Service in the twelve months preceding the claim (which, while the Service is free, is zero), and (b) one hundred Canadian dollars (CAD $100).

Nothing in these Terms excludes or limits liability that cannot be excluded or limited under applicable law, including liability for fraud or for death or personal injury caused by negligence. Some jurisdictions do not allow certain exclusions or limitations; in those jurisdictions, the above applies to the fullest extent permitted.

13. INDEMNIFICATION

You agree to defend, indemnify, and hold harmless XCIS AI and its partners, directors, employees, contractors, licensors, open-source contributors, and affiliates from and against any claims, damages, obligations, losses, liabilities, costs, or debt (including reasonable legal fees) arising from:

Your Content, including any breach of Section 7 (Prohibited Uploads);
Actions or Tool Calls executed by the Agent in response to your requests, and any use you make of an Output;
your violation of these Terms, any third-party right, or applicable law.

14. AMENDMENTS, SUSPENSION, AND TERMINATION

14.1 Amendments

We reserve the right to modify the Service and these Terms at any time. For material changes, we will notify you by email to your registered address or by a notice in the Service at least fourteen (14) days before they take effect, except where a change is required by law or needed to address a security issue, in which case it may take effect immediately. Continued use of the System after an update constitutes acceptance of the new Terms. If you do not agree, stop using the Service and request account deletion.

14.2 Termination by you

You may stop using the Service at any time and may request deletion of your account by contacting us (Part B, Section 10).

14.3 Suspension and termination by us

We reserve the right to restrict, suspend, or terminate your access at any time, with or without prior notice, if we reasonably believe you have violated these Terms; if we receive a lawful request from a Regulator, law-enforcement agency, or court; if continued access poses a security, legal, or reputational risk; if your organization no longer meets our access criteria; or if we discontinue the Service in whole or in part. Because the Service is free and access is discretionary, we may also revoke access for any reason on reasonable notice.

14.4 Survival

On termination, your right to use the Service ends immediately. Sections 3, 5.1, 7, 9, 10, 11, 12, 13, 14.4, 15, and 16, and Part B, survive termination.

15. GOVERNING LAW AND DISPUTES

These Terms shall be governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict-of-law provisions. You agree to the exclusive jurisdiction of the courts located in Oshawa, Ontario for any dispute arising out of or relating to these Terms or the Service, except that either party may seek injunctive relief in any court of competent jurisdiction to protect its intellectual property or confidential information.

Before starting formal proceedings, you agree to first contact us at hello@xcis.ai and make a good-faith attempt to resolve the dispute informally for at least thirty (30) days.

16. GENERAL

Entire agreement. These Terms (including Part B) are the entire agreement between you and XCIS AI regarding the Service and supersede all prior agreements on that subject.
Severability. If any provision is held unenforceable, the remaining provisions remain in full effect.
No waiver. Our failure to enforce any provision is not a waiver of it.
Assignment. You may not assign these Terms without our written consent. We may assign them in connection with a merger, acquisition, or sale of assets.
Export compliance. You represent that you are not located in, and are not a national of, a country subject to comprehensive Canadian or U.S. sanctions, and that you are not on any Canadian or U.S. restricted-party list.
Force majeure. We are not liable for any delay or failure caused by events beyond our reasonable control.
Language. These Terms are drafted in English. Any translation is for convenience; the English version controls.
Contact. Questions about these Terms: hello@xcis.ai.

PART B — PRIVACY POLICY

This Privacy Policy explains what personal information XCIS AI collects through NuClear Path AI, how we use it, who we share it with, and the choices you have. It is written to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, and to be transparent for users in the United States and elsewhere.

1. WHO IS RESPONSIBLE

XCIS AI is the organization responsible for personal information collected through the Service. Our privacy contact is listed in Section 10.

2. INFORMATION WE COLLECT

2.1 Information you give us

Category	Details	When
Access request details	First name, last name, work email address, company or organization name	When you request access
Account credentials	Password (stored only as a salted cryptographic hash — we never see or store the plain-text password)	When you create your account after approval
Chat content	Your questions, prompts, and messages, and the Outputs generated in response	When you use the assistant
Uploaded documents	Files you attach to a chat, their extracted text, text chunks, and vector embeddings derived from them	When you upload a document
Correspondence	Emails or messages you send us, including support and privacy requests	When you contact us

2.2 Information collected automatically

Category	Details
Account and session data	Login timestamps, session tokens, role and approval status
Usage data	Chats created, tools invoked by the Agent (for example, knowledge base search, web search, document analysis), timestamps
Technical data	IP address, browser type, device type, and standard server logs
Email delivery data	Whether transactional emails were delivered, bounced, or opened (via our email provider)

2.3 Information we do not collect

We do not collect payment or financial information (the Service is free). We do not intentionally collect health, biometric, security-clearance, or other sensitive personal information, and you must not submit it (Terms, Section 7).

2.4 Cookies and similar technologies

The Service uses strictly necessary cookies and browser storage to keep you signed in and to secure your session. We do not currently use advertising cookies or third-party tracking pixels in the application. If we add analytics tooling, we will update this Policy.

3. HOW WE USE YOUR INFORMATION

Purpose	Examples	Basis
Reviewing your access request	Assessing whether you and your organization meet our access criteria; contacting you about the outcome	Your consent (by submitting the request); our legitimate interest in controlling access to a nuclear-sector tool
Providing the Service	Authenticating you, storing your chats, generating Outputs, indexing your uploaded documents so the Agent can answer questions about them	Performance of our agreement with you
Sending transactional emails	Access received, approved, or declined; account and security notices; material changes to these Terms	Performance of our agreement; legal obligation
Security and abuse prevention	Detecting unauthorized access, enforcing the Terms, investigating misuse, protecting the integrity of the Service	Legitimate interest; legal obligation
Improving the Service	Reviewing aggregated or de-identified usage patterns, diagnosing errors, evaluating quality of responses	Legitimate interest
Legal compliance	Responding to lawful requests from Regulators, courts, or law enforcement; meeting record-keeping obligations	Legal obligation

We do not sell your personal information. We do not use your chats or uploaded documents to train AI models. We do not use your personal information for third-party advertising.

Where we review individual chats for quality or safety purposes, access is restricted to authorized XCIS AI personnel bound by confidentiality obligations.

4. HOW YOUR INFORMATION FLOWS THROUGH THE SERVICE

Because the Service relies on third-party AI and cloud infrastructure, it is important that you understand where your information goes.

Access request. Your name, email, and company are stored in our database and sent to XCIS AI administrators for manual review. Notifications are delivered through a third-party transactional email provider.
Account creation. Your password is hashed before storage. A single-use signup token is stored as a hash and expires after use or after a limited period.
Chat. When you send a message, the message and relevant context from your current chat are transmitted to one or more third-party AI model providers to generate a response. Depending on the question, the Agent may also:
- query our curated knowledge base, hosted on a third-party cloud search service (this sends your query text, not your documents, to that service);
- perform a live web search through a third-party search provider and fetch pages from the public websites returned (your query terms are sent to the search provider; your documents are not);
- retrieve relevant chunks of your uploaded documents and include them in the request to the AI model provider so it can answer about your document.
Document upload. Uploaded files are stored in our database, parsed into text, split into chunks, and converted into vector embeddings by an AI provider's embedding model. The embeddings are stored in our database and used only to find relevant passages for your questions.
Logging. Server logs record technical events and errors. We take reasonable steps to avoid writing chat content and document content to logs, but fragments may appear in error traces, which are retained per Section 6.

5. SHARING AND DISCLOSURE

We share personal information only as follows:

Service providers (processors). Third-party providers of cloud hosting, AI model inference, search indexing, database, email delivery, and web search process data on our behalf to host, secure, and operate the Service. Each is bound by contractual terms that restrict them to processing data for our purposes and require appropriate security. AI providers are contractually prohibited from using your data to train their models.
Within XCIS AI. Authorized personnel who need access to perform their roles (for example, reviewing access requests, providing support, maintaining security).
Legal and safety. When required by law, subpoena, court order, or a lawful request from a Regulator or law-enforcement agency; or when we believe in good faith that disclosure is necessary to protect the safety or security of any person, nuclear facility, or the public, to enforce our Terms, or to protect our rights.
Business transfers. If XCIS AI is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.
With your direction. Where you ask us to share information with someone else.

We do not share your personal information with Regulators or other users as part of normal operation of the Service.

6. DATA RETENTION

Data	Retention
Access requests that are declined	12 months after the decision, then deleted, unless needed for abuse prevention
Access requests that are approved but never converted to an account	12 months after the invitation expires, then deleted
Account information	For the life of your account, then deleted within 30 days of deletion request or account closure
Chats and Outputs	For the life of your account, or until you delete the chat. Deleted chats are hidden immediately (soft delete) and permanently removed within 12 months
Uploaded documents, chunks, and embeddings	For the life of your account, or until you delete the associated chat. Deleted documents are hidden immediately (soft delete) and permanently removed within 12 months
Server and security logs	90 days, longer if needed for an ongoing security investigation
Backups	Encrypted backups are retained for up to 35 days and then overwritten; deleted data may persist in backups until that time
Transactional email records	As retained by our email provider, currently 90 days

We may retain information longer where required by law or where reasonably necessary to resolve disputes or enforce our agreements, in which case it is isolated and protected until deletion.

7. WHERE YOUR INFORMATION IS STORED AND PROCESSED

Our primary infrastructure is hosted with a major cloud provider in Canada Central, Canada East and US East. Some of our providers — including AI inference and email delivery — may process data in the United States or other countries where they or their sub-processors operate.

When your personal information is processed outside Canada, it is subject to the laws of that jurisdiction, including laws that may permit access by government authorities. We use contractual and technical safeguards to protect information transferred abroad. By using the Service you acknowledge these transfers.

This is another reason not to submit sensitive nuclear information (Terms, Section 7): cross-border transfer of prescribed information, safeguards information, or export-controlled technical data may itself be unlawful.

8. SECURITY

We take security seriously, and more so because of the sector we serve. Our measures include:

encryption of data in transit (TLS) and at rest on our cloud infrastructure;
passwords stored only as salted cryptographic hashes; single-use, hashed signup tokens;
access to the Service restricted to manually approved users; role-based access control within the application;
access to production systems limited to authorized XCIS AI personnel, with credentials and secrets managed outside source code;
network isolation of database and search infrastructure from the public internet;
monitoring, logging, and periodic review of security posture.

No system is perfectly secure. If we become aware of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will notify you and the relevant privacy authority as required by law.

9. YOUR RIGHTS AND CHOICES

Subject to applicable law, you may:

Access the personal information we hold about you and receive a copy;
Correct inaccurate or incomplete information;
Delete individual chats and uploaded documents within the Service, or ask us to delete your account and all associated data;
Withdraw consent to processing that is based on consent (this may mean we can no longer provide the Service);
Object to or ask us to restrict certain processing;
Port your chats and documents in a machine-readable format on request;
Complain to a privacy regulator — in Canada, the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or your provincial commissioner.

To exercise any of these rights, contact us using the details in Section 10. We may need to verify your identity before acting. We will respond within thirty (30) days, or tell you if we need longer and why.

Users in the United States. Depending on your state of residence, you may have additional rights (for example under the California Consumer Privacy Act). We do not sell or share personal information for cross-context behavioral advertising. You may exercise applicable rights by contacting us.

Users in the EU/UK. If you access the Service from the European Economic Area or the United Kingdom, XCIS AI is the controller. In addition to the rights above, you have the right to lodge a complaint with your local supervisory authority. Transfers out of the EEA/UK rely on standard contractual clauses or other approved mechanisms.

10. CONTACT US

Privacy questions, rights requests, and complaints:

XCIS AI — Privacy
Email: hello@xcis.ai

Security concerns or suspected vulnerabilities: hello@xcis.ai

11. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date and, for material changes, notify you by email or through the Service before the changes take effect. Your continued use after the effective date constitutes acceptance of the updated Policy.

© 2026 XCIS AI. All rights reserved. NuClear Path AI is not affiliated with, endorsed by, or acting on behalf of the Canadian Nuclear Safety Commission, the U.S. Nuclear Regulatory Commission, the U.S. Department of Energy, the CSA Group, or any other regulator or standards body.