Privacy Policy

Effective Date: October 19, 2026

AAA Gigerl FlexKapG takes the protection of your personal data very seriously. This Privacy Policy explains how we collect, use, and process personal data when you visit our website https://x-agent.app/, when you use the xAgent mobile app for iPhone, including its CarPlay voice mode, and when you use the services and integrations provided through xAgent.

This Privacy Policy is intended to comply with the EU General Data Protection Regulation (“GDPR”) and applies to users in the European Union as well as international users where applicable.

1. Data Controller

The responsible entity (data controller) for the processing of personal data described in this Privacy Policy is:

AAA Gigerl FlexKapG
Kaltenbrunn 78
8200 Gleisdorf
Austria

Phone: +43 664 5501185
Email for privacy requests: office@aaa-gigerl.com
Website: https://x-agent.app/

Website Hosting

Our public website is hosted by IONOS SE on servers located in Germany.

IONOS hosts the website only. The xAgent application backend, application database and application server logs are hosted separately on Microsoft Azure as described in Section 9 below.

2. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR:

If you wish to exercise any of these rights, please contact us at:

office@aaa-gigerl.com

xAgent users can also delete their xAgent account and associated application data directly in the app under:

Profile → Account → Delete account

Consent to sharing data with AI services can be reviewed and withdrawn in the app under:

Profile → AI data sharing

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You also have the right to lodge a complaint with a competent supervisory authority. In Austria, the competent supervisory authority is the Austrian Data Protection Authority (“Datenschutzbehörde”).

3. Data We Collect Through the Website

When you visit our website, certain technical information may automatically be collected in server log files, including:

Purpose: Operation, security, stability and technical provision of the website.

Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in operating a secure and reliable website.

Contact Form

When you use our contact form, we may collect:

Purpose: Responding to inquiries, arranging demonstrations, communicating with potential customers and providing requested information or services.

Legal basis: Art. 6(1)(b) GDPR where processing is necessary to take steps at your request before entering into a contract, and Art. 6(1)(f) GDPR based on our legitimate interest in processing business inquiries. Your contact-form data will not be disclosed to third parties unless this is necessary to process your inquiry, provide a requested service or comply with a legal obligation.

4. Cookies and Tracking on the Website

Our website may use cookies and similar technologies to provide website functionality, remember preferences and, where consent has been given, provide additional functions or measure website usage.

Essential Cookies

Essential cookies are required for basic website functions, such as displaying the cookie banner and storing your consent preferences.

Example: cookies used by the Real Cookie Banner consent-management solution.

Legal basis: Art. 6(1)(f) GDPR where technically necessary and applicable law permits processing without consent.

Functional Cookies

Functional cookies may enable optional website features such as embedded media.

Where such services require consent, they are activated only after consent has been given.

Legal basis: Art. 6(1)(a) GDPR.

Statistical Cookies

Statistical cookies may be used to measure website usage and performance where you have consented to such processing.

Legal basis: Art. 6(1)(a) GDPR.

Marketing Cookies

Marketing cookies may be used to measure campaigns or display personalized content or advertising where you have consented.

Legal basis: Art. 6(1)(a) GDPR.

You can manage your cookie preferences through our cookie banner and through your browser settings.

Further information is available in our Cookie Policy at:

https://x-agent.app/cookie-policy/

5. Website Hosting and Data Security

Our website is hosted by IONOS SE on servers located in Germany within the European Union.

We use appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure and unauthorized access.

Measures include, where applicable:

Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in maintaining the security and availability of our services. Additional information about security measures applicable to the xAgent app is provided in Section 9.

6. LinkedIn

Our website may include LinkedIn functionality or links that allow visitors to interact with our LinkedIn presence.

When LinkedIn functionality is activated or used, information such as your IP address, browser information and browsing activity may be transmitted to LinkedIn. If you are logged into LinkedIn, LinkedIn may associate the interaction with your LinkedIn account.

Where consent is legally required before data is transferred to LinkedIn, the relevant functionality is activated only after you provide consent.

Legal basis: Art. 6(1)(a) GDPR where consent is required.

Further information is available in LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by applicable law.

Unless another retention period is specified below:

Data that must be retained for legal, accounting, tax or commercial-law purposes may be stored for the applicable statutory retention period. Under Austrian law, this may in particular include retention periods of up to seven years for certain business records.

8. Updates to This Privacy Policy

We may update this Privacy Policy where our services, processing activities or applicable legal requirements change.

If material changes affect processing based on your consent, we will obtain new consent where required by law.

If you have questions, concerns or requests concerning privacy or this Privacy Policy, please contact:

Email: office@aaa-gigerl.com
Phone: +43 664 5501185

9. xAgent App

This Section 9 applies specifically to the xAgent mobile app for iPhone, including its CarPlay voice mode.

xAgent is a voice-first assistant designed for sales representatives and business users. Among other functions, it can prepare customer meetings and briefings, convert meeting notes and voice input into structured debriefings and CRM updates, create reports and notes, help draft communications, and answer questions based on data from services connected by the user.

9.1 Data the App Collects and How

Account Data

When you register for an xAgent account, we process information you provide, including:

Passwords are not stored in plain text. We store passwords only in cryptographically hashed form using bcrypt or an equivalent secure password-hashing mechanism.

You may optionally provide:

Content You Create

We process content that you type, upload, create or speak while using the app, which may include:

Depending on the information you enter or retrieve through connected business systems, this content may contain personal data relating to customers, prospects, employees, business partners or other individuals.

Voice Input

Voice is recorded by the xAgent app only while a voice conversation or voice-input feature is active and microphone access is enabled.

For standard in-app voice input, the audio recording is transmitted to our backend using encrypted transport. Speech recognition is performed using the open-source Whisper speech-recognition model operated on infrastructure controlled by us.

The audio recording is deleted immediately after transcription.

Audio recordings processed in this way are not sent to OpenAI, Google Gemini or other generative-AI providers.

CarPlay Voice Mode

When you use xAgent through CarPlay, speech recognition is provided using Apple’s speech-recognition technologies.

Speech recognition may take place on the device where supported. Depending on the device, operating-system configuration and Apple service, speech recognition may otherwise involve processing by Apple.

xAgent receives and processes the resulting text for the purpose of providing the requested xAgent functionality.

Only the resulting text, rather than the original CarPlay audio recording, is transmitted to the xAgent backend.

Spoken responses generated by xAgent are produced on our infrastructure using the open-source Kokoro text-to-speech model.

Data From Services You Connect

xAgent can connect to external business services only when you or your organization intentionally connects the relevant service and authorizes xAgent to access it through login credentials, OAuth or another supported authorization mechanism.

Depending on the integrations enabled for your account, these services may include:

CRM systems

Productivity services

This may include access to:

Meeting recorder services

Where meeting-recorder integrations are supported, access is generally read-only unless explicitly stated otherwise.

xAgent accesses connected-service data only when required for a feature you use.

Depending on the integration and feature, xAgent may read data and may write information back to the connected service on your behalf. Where a feature causes material information such as CRM updates to be written to an external system, xAgent requests your confirmation where this is part of the relevant workflow.

Access tokens, refresh tokens and passwords required for connected services are stored encrypted.

xAgent does not create a complete mirror of your CRM database.

However, we may store information that you intentionally create or retain through xAgent, including:

Settings and Technical Data

We may process technical and configuration data including:

No Advertising, Tracking or Sale of Personal Data

The xAgent app does not use third-party advertising SDKs.

The xAgent app does not use third-party behavioral tracking SDKs.

The xAgent app does not sell personal data.

We do not sell or rent user content, CRM data, emails, calendar data, voice transcripts or customer information to advertisers or data brokers.

9.2 Purposes and Legal Bases

We process account data and application content where necessary to provide the xAgent service and the functions requested by the user, including:

For processing relating directly to the contractual relationship with the user or customer, the legal basis is:

Art. 6(1)(b) GDPR – performance of a contract or steps prior to entering into a contract.

Where data concerning customers, prospects, contacts or other third parties is processed in a business context, processing may also be based on the legitimate interests of the relevant xAgent customer and/or AAA Gigerl FlexKapG in efficiently managing business relationships, customer interactions and sales processes, subject to the requirements of:

Art. 6(1)(f) GDPR.

Where an organization using xAgent determines the purposes and means of processing personal data contained in its CRM, email, calendar or other connected business systems, that organization generally acts as the data controller, and AAA Gigerl FlexKapG processes such data on its behalf as a data processor in accordance with the applicable agreement and data-processing terms.

AI Processing

Where personal data is transmitted to external AI providers described in Section 9.3 based on a user’s consent, the relevant legal basis for that transmission is:

Art. 6(1)(a) GDPR – consent.

The app asks for this permission before information is transmitted to the AI providers covered by this consent mechanism.

Server Logs and Security

Technical server logs and security-related information are processed for:

The legal basis is:

Art. 6(1)(f) GDPR – our legitimate interest in securely and reliably operating the service.

9.3 Third-Party AI Services

To provide certain AI-powered responses and results, xAgent may transmit data to the following external AI providers.

This occurs only after the user has accepted the in-app notice titled or substantially corresponding to:

“Share data with AI services?”

OpenAI

Provider: OpenAI, including the applicable OpenAI contracting entity for our business/API account.

Depending on the xAgent feature and the user’s request, data sent to OpenAI may include:

The purpose of this processing may include:

Google Gemini API

Provider: Google LLC and/or the applicable Google contracting entity for the Gemini API service used by xAgent.

Depending on the feature, information sent to Google’s Gemini API may include:

The purpose may include:

Information Never Intentionally Sent to Generative-AI Providers

The following information is not intentionally transmitted by xAgent to OpenAI or Google Gemini as AI-model input:

Business API Terms and Model Training

We use paid/business API services rather than consumer AI accounts for this processing.

According to the applicable business/API terms and configurations, data submitted through these services is not used by the providers to train their general models by default.

The providers may nevertheless process or temporarily retain information where necessary to provide and secure their services, detect abuse, comply with law or provide features whose operation requires temporary storage.

For OpenAI API services, standard abuse-monitoring logs may generally be retained for up to 30 days unless a different retention control, such as an eligible zero-data-retention configuration, applies or longer retention is legally required.

Google’s paid Gemini API similarly provides contractual restrictions on use of submitted content for product/model improvement, while limited processing or retention may apply for security, abuse-monitoring or specific optional features.

Protection by AI Providers

Where an AI provider acts as our processor, we use contractual data-protection arrangements designed to require processing only for the agreed purposes and appropriate technical and organizational protection of personal data.

We require service providers processing personal data on our behalf to provide a level of data protection consistent with applicable data-protection law and our contractual obligations.

9.4 Other Service Providers and Processors

Microsoft Azure

The xAgent backend, application database and application server logs are hosted using Microsoft Azure, provided by Microsoft Corporation and/or Microsoft Ireland Operations Limited.

The primary Azure region used for the xAgent application is:

Austria East

This infrastructure is used for:

Apple

Apple provides speech-recognition functionality used in connection with CarPlay as described in Section 9.1.

The precise technical processing may depend on the iPhone model, iOS version, user settings and availability of on-device speech recognition.

Connected Services

If you connect third-party services such as HubSpot, Salesforce, Odoo, Creatio, Attio, Microsoft 365, Google Workspace, Plaud or another supported integration, data is exchanged with that provider only as necessary to perform the action or feature requested by you.

The provider’s own privacy terms also apply to data held within your account with that provider.

Contractual Protection

Where a service provider processes personal data on our behalf as a processor, we use data-processing agreements or equivalent contractual protections where required by applicable data-protection law.

These arrangements require service providers to apply appropriate technical and organizational security measures and to process personal data only in accordance with the applicable contractual terms and instructions.

9.5 International Data Transfers

The primary xAgent application backend and database are hosted in the Microsoft Azure Austria East region within the European Union.

However, some external service providers, including AI providers and providers involved in connected services, may process personal data outside Austria or outside the European Economic Area.

Where personal data is transferred to a country outside the European Economic Area and no adequacy decision under Art. 45 GDPR applies, we use an appropriate transfer mechanism as required by Chapter V GDPR.

Depending on the recipient and circumstances, this may include:

Where an EU-based contracting entity or EU-hosted service processes the relevant data without a third-country transfer, no separate Chapter V transfer mechanism is required for that processing.

We periodically review the transfer mechanisms and certifications applicable to our service providers.

9.6 Retention and Deletion

Voice Recordings

Audio recorded for xAgent’s own Whisper-based speech transcription is deleted immediately after transcription.

The resulting text may be stored as part of the relevant chat, note, debriefing or other user-created content.

Account Data and User Content

Account data and content stored within xAgent are generally retained for as long as the user’s account remains active or until the relevant content is deleted.

Users can delete their account directly in the app under:

Profile → Account → Delete account

Account deletion initiates deletion of the xAgent account and xAgent-controlled application content associated with the account, including, where applicable:

Deletion is subject to information that we are legally required to retain and to limited technical backup or security retention periods where applicable.

Data in Connected Services

Deleting your xAgent account does not automatically delete information that already exists in systems controlled by you or your organization, including:

You or your organization must manage such information directly in the relevant connected service.

App Server Logs

xAgent application server logs are generally retained for 30 days and are then deleted or anonymized unless longer retention is required to investigate a security incident, prevent abuse, establish or defend legal claims or comply with a legal obligation.

AI Providers

Information processed by external AI providers is subject to the applicable contractual and technical retention rules described in Section 9.3.

OpenAI API data may under standard configurations be retained in abuse-monitoring logs for up to 30 days, subject to applicable endpoint-specific rules, zero-data-retention configurations and legal exceptions.

Google Gemini API processing is subject to the retention rules applicable to the paid API service and the specific features used.

9.7 Permissions on Your Device

xAgent may request access to certain iPhone functions only when required for a feature you choose to use.

Microphone

Used for voice input and voice conversations.

Speech Recognition

Used for voice functionality, including CarPlay voice mode.

Camera

Used where you choose to photograph business cards or other supported documents.

Photo Library

Used where you choose to select a business-card image, profile photo or other supported image from your device.

Permissions are requested by iOS and can be changed or revoked at any time through the iPhone’s system settings.

Revoking a permission may prevent features that depend on that permission from working.

9.8 AI Data-Sharing Consent

Before xAgent sends personal data to the external AI services described in Section 9.3, the app presents an AI data-sharing notice and requests the user’s permission.

You can review this information and withdraw your consent at any time under:

Profile → AI data sharing

If consent is withdrawn:

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Withdrawal also does not automatically delete information already processed by an external provider where that provider must temporarily retain information under its applicable security, abuse-prevention or legal-retention rules.

9.9 Processing of Business Customer Data

xAgent is primarily a B2B service.

When an employer, company or other organization provides xAgent to its employees or connects its CRM, email, calendar or other business systems to xAgent, that organization may determine the purposes and means of processing personal data contained in those systems.

In such circumstances:

The customer organization is responsible for ensuring that it has an appropriate legal basis for personal data it places in, connects to or processes through xAgent.

This may include personal data relating to:

Where AAA Gigerl FlexKapG independently determines the purposes and means of processing, for example for account administration, security or compliance with our own legal obligations, AAA Gigerl FlexKapG acts as the controller for that processing.

9.10 Automated AI Outputs

xAgent uses AI systems to assist users with tasks such as summaries, briefings, debriefings, reports, extraction of information, notes and draft communications.

AI-generated results may contain inaccuracies and should be reviewed by the user where appropriate before they are relied upon or transferred to a connected system.

xAgent is designed as an assistive tool. It does not use AI output to make solely automated decisions that produce legal effects concerning individuals or similarly significantly affect them within the meaning of Art. 22 GDPR, unless such processing is separately introduced, disclosed and provided with an appropriate legal basis.