xAI Privacy Policy

Effective: January 2, 2024 (previous version)

At x.AI, L.L.C. ("xAI", "our", "us" or "we"), we value your privacy and are committed to being fair, accountable, and transparent in how we handle your personal information. Our Privacy Policy outlines how we collect and use your personal information when you use our websites, applications, and other xAI services (our "Service"). It also describes your privacy rights.

This Privacy Policy does not apply to data that we process on behalf of customers of our business offerings, such as our API. Our use of that data is governed by customer agreements covering access to and use of those business offerings. This Privacy Policy also does not apply if you access our Service through a third-party’s service. In that case, the third-party’s privacy policy would apply, and you would contact that third-party regarding the processing of your personal information. For example, your use of X (previously Twitter), including use of Grok on X, is governed by the X Privacy Policy and X Terms, not this xAI Privacy Policy.

1. About xAI and Grok

xAI is a US-based company working on building artificial intelligence tools to accelerate human scientific discovery. We are guided by our mission to advance our collective understanding of the universe. As part of our mission, we have developed “Grok,” a conversational generative AI powered by xAI’s large language models. More information about xAI’s development and training of Grok, is available on the xAI website. xAI is a separate company from X Corp ("X", previously Twitter).

2. Personal information we collect

2.1 Personal information you provide:

When you use our Service or communicate with us, you provide certain personal information, including:

Account Data: When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, date of birth, and Payment Data. If you log into our Service using a third-party service, that third-party will send your information to us at your direction. For example, if you use your existing X credentials to log into an xAI mobile app or website, you may choose to direct X to share the following information with us: your X public profile, X username; numeric X ID; whether you are subscribed to X Premium, and your Grok on X conversation history.
Payment Data: Where payment is required to access the Service, we may collect payment information (such as payment card information) directly from you and details regarding your transactions with us.
Communication Data: If you communicate with us, such as by email, by our webpages, or on social media sites, we may collect personal information including your name, email address, any other contact details you voluntarily choose to provide us, and the contents of messages you send.
User Content: We collect personal information that you provide to our Service, including your prompts and other content you upload, such as files, images, and other material (“Input”). Outputs of the Service (“Output”), including responses Grok generates, are based on your Input (together, "User Content"). If you include personal information in Inputs you provide to the Service, this information may be reproduced in the Output. Please do not share any personal information (including any sensitive information) in your Input to the Service.
Feedback Data: Where applicable, we will collect your Feedback (as defined in our Terms of Service). This might arise if, for example, in a given conversation with Grok, you rate an Output using the thumbs-up/thumbs-down icons.
Social Media Information: We have pages on social media sites like Instagram, Facebook, Medium, X, YouTube and LinkedIn. When you interact with our social media pages, we collect personal information that you choose to provide to us, such as your contact details (collectively, “Social Data”). In addition, the companies that host our social media pages may provide us with aggregate information and analytics about our social media activity.
Applicant Data: If you apply for a job with xAI, we will collect your personal information such as your contact details, resume/CV, education and work history, visa status, and other information (including interview recordings and screenshots, where permissible). You also may choose to provide your gender, ethnicity, veteran status, disability status, and links to your website, blog, portfolio, LinkedIn or other public profiles. We may also receive personal information about you from our affiliated companies and third parties, such as recruitment agencies, social media platforms, and individuals who refer you.

With the exception of our recruitment activities, we do not aim to collect sensitive personal information (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometric data, criminal background, or trade union membership) and ask that you do not provide us with any such information.

2.2 Personal information we collect automatically

We automatically collect certain device and usage information when you use or interact with our Service (collectively, "Technical Usage Data"). This may include:

Device data: Technical information such as your IP address, device type, country from which you access, browser type and version, browser plug-in types and versions, operating system.
Usage data: Information about your use of the Service, types of content you view or engage with, the features you use, pages you view, date and time of your visit, duration of visits, pages visited, browsing history, search history, traffic data, standard server log information, your time zone, version, dates and times of access, and other communication data.
Location data: We may determine the general area from which your device accesses our Services based on information like its IP address for security reasons and to make your product experience better. Also, you may choose to provide more precise location information, such as your device’s GPS location or from third-party services that you use.
Cookies: We use cookies and similar technologies to operate and administer our Services, and improve your experience. If you use our Services without creating an account, we may store some of the information described in this Privacy Policy with cookies, for example to help maintain your preferences across browsing sessions. For details about our use of cookies, please read our Cookie Policy.

2.3 Personal information we receive from other sources

The personal information we receive from other sources may include:

Publicly available data: We use information that is publicly available on the internet to train our models. Information on the internet may include personal information (for example, information about politicians, celebrities, published authors or other public figures) and sensitive information (for example, political opinions, religious or philosophical beliefs, or information concerning sexual orientation, among others). For more information on the sources of information used to develop our large language models, see our consumer FAQs.
Public X posts and internet search data: The Service uses public posts shared on X, engagement data such as number of followers, and number of views, likes, reposts, shares, and replies. In response to search queries, the Service may conduct real-time information that is publicly available on the internet. In some instances, this data may include personal information.
Third-party datasets: The Service may use datasets from third-party businesses and partners, including from security partners to protect against fraud, abuse, and other security threats to our Services.

3. How we use your personal information (our purposes)

We use your personal information for a variety of purposes, including:

To provide, analyze, and maintain our Service: for example, to respond to your Inputs for Grok.
To provide support and assistance in relation to our Service: for example, to troubleshoot problems and to provide customer support.
To develop and improve our Service and to conduct research: for example to develop new product features and to train our models.
For our business or commercial purposes: for example, to identify usage trends, operating and expanding our business activities, identify new customers, and data analysis.
To communicate with you: for example, to send you information about our Service, events, or changes to the Service.
To process payments for our Service, as applicable.
To ensure the security and integrity of our Service: for example, to protect the security of our Services and to detect and prevent fraud, unauthorized use, unlawful activity, and other misuses of our Service.
To comply with our legal obligations and to protect the rights, privacy, safety, or property of our users, xAI, or third parties.
To process job applications at xAI: for example, to evaluate your application to xAI, make hiring decisions, and conduct reference checks.

We may also aggregate or de-identify your personal information so that it no longer identifies you and use this information for the purposes described above, such as to analyze the way our Service is being used, to improve and add features to them, and to conduct research. We will maintain and use de-identified information in de-identified form and will not attempt to reidentify the information, unless required by law.

We may share your your personal information with others in the following circumstances:

With our contracted service providers: To assist in providing the Service to you or performing business operations, we provide your personal information to service providers including providers of hosting, cloud, web analytics, content delivery, support and safety monitoring, payment and transaction, and other technology services, for the purposes described above.
In connection with business transfers: In connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction, or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets to another company. If required by applicable laws, we will use reasonable efforts to notify you of any transfer of personal information to an unaffiliated third party.
To comply with our legal obligations: To (i) comply with laws or to respond to lawful requests and legal process, (ii) protect the rights and property of xAI and our agents, customers, and others, including to enforce our agreements, policies, and terms of service, (iii) to protect against legal liability, or (iv) to protect the personal safety of xAI, its customers, or any person.
With our related companies: We may disclose personal information to our related companies to the extent such sharing is necessary to fulfill a request you have submitted via our Service or for customer management, customer support, technical operations, or the purposes described above.
Other users and third-parties you interact with or share information with: Certain features may allow you to share information with third-parties, including through the X platform. Information you share on X is governed by X’s terms and policies. Any information you voluntarily share in communities, forums, blogs, or chat rooms on our Service or third-party websites may be read, collected, and used by others.

We may also create and share aggregated and de-identified usage data with our related companies and also with third parties to help us perform analysis and make improvements.

Except as detailed above, we do not share, sell, or rent any of your personal information to any third party. We will notify you if this changes.

5. Marketing

We do not collect and use your personal information for marketing purposes and do not share your personal information with third parties for the purpose of marketing.

6. Security of your personal information

xAI implements commercially reasonable technical, administrative, and organizational measures designed to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no security measure or method of data transmission over the internet is 100% secure. Therefore, you should take special care in deciding what information you provide to the Services. In addition, you are solely responsible for protecting your password, limiting access to your devices, and signing out of websites and accounts after your sessions.

7. Retention of your personal information

We retain your personal information where we have an ongoing legitimate business need to do so. In certain circumstances, we will need to keep your information for legal reasons after our contractual relationship has ended. The specific retention periods depend on the nature of the information and why it is collected and processed and the nature of the legal requirement. For example, we may retain your personal information:

when we have a legal obligation to do so (e.g., if we receive a court order, we would retain your information for longer than our usual retention periods);
to deal with and resolve requests and complaints (e.g., if there is an ongoing complaint about you);
to protect the safety, security, and integrity of our business and the Service, as well as to protect our rights and property and those of others (e.g., if we detect misuse of our Service or otherwise detect unusual activity on your account or in your interactions with us); and
for litigation or regulatory matters (e.g., we would retain your information if there was an ongoing legal claim and the information was relevant to the claim).

The length of time we retain data may depend on the features or settings you use. For example, Grok Temporary Chats will not show in your conversation history but will be kept in xAI’s systems for up to 30 days for safety purposes.

To request your data be deleted, follow the instructions in our FAQ -Consumer.

Our Service may contain links to websites or plugins of social media platforms that are not operated by us. Third-party websites have their own terms and conditions and privacy policies, and you should read these carefully before you submit any personal information to these websites.

9. Children's privacy

As noted in the Terms of Service, our Service is not directed at children or minors under the age of 13 and we do not knowingly collect any personal information from them. While we have taken measures to limit undesirable training data and outputs, Grok could produce output that is not appropriate for all ages. Parents of teenagers between the ages of 13 and 18 years old must agree to the Terms of Service and are urged to exercise care in monitoring the use of this Service by their teenagers. Depending on how a user interacts with the Service, the Service may have content such as some suggestive dialogue, coarse language, crude humor, sexual situations, or violence.

If you are a child under the age of 13, please do not attempt to register for or otherwise use our Service. If we learn that we have inadvertently obtained personal information about a child under the age of 13, we will delete that information. Please contact us at privacy@x.ai if you are aware that we may have inadvertently collected personal information from a child under the age of 13.

10. Your rights and choices

Depending on where you are located and subject to applicable legal exceptions, you may have certain rights in relation to your personal information. For more information on the rights that apply under European and US privacy laws, please see Sections 11 and 12 below.

11. Additional information for individuals located in Europe

If you are located in the European Economic Area ("EEA"), United Kingdom ("UK") or Switzerland (collectively, "Europe") the following disclosures apply:

11.1 Data controller

x.AI, L.L.C. is the controller of your personal information as described in this Privacy Policy, unless otherwise specified.

11.2 Legal basis

When we process your personal information, we will only do so in the following situations:

Contract: Where we need it to perform a contract with you, including where necessary to provide you our Service under our consumer Terms of Service (such as processing user prompts to provide a response).
Legitimate interests: Where it is necessary for our legitimate interests (or those of a third party) and your interests and rights do not override our interests. Our legitimate interests include:
- protecting our Service from abuse, fraud, or other misuses;
- maintaining and improving our Service, including to train and improve the models that power our Service;
- research and development, including developing new products and features;
- ensuring the safety and security of our Service;
- detecting, preventing, and enforcing violations of our terms including misuse of services, fraud, abuse, and other trust and safety protocols;
- processing job applications and managing, improving, and safeguarding our recruiting and hiring processes; and
- protecting our rights and the rights of others.
Consent: Where you have given us your consent. When we process personal information based on your consent, it will be expressly indicated to you at the point and time of collection. You have the right to withdraw your consent at any time.
Legal obligation: From time to time, we may also need to process personal information to comply with a legal obligation, if it is necessary to protect the vital interests of you or others, or if it is necessary for a task carried out in the public interest.

The following table provides more details on our purposes for processing your personal information and the related legal bases. The legal basis under which your personal information is processed will depend on the data concerned and the specific context in which we use it.

| Purpose | Type of Data | Legal Basis | | :---- | :---- | :---- | | To process payments for our Service | Account Data Contact and Communications Data Payment Data | Contract | | To provide our Service (including to provide Output in response to Input) | Account Data Payment Data Contact and Communications Data User Content Public X Posts Internet Search Data Technical Usage Data | Contract Otherwise as necessary for our legitimate interests (to provide and maintain our Service) | | To provide support and assistance in relation to our Service | Account Data Contact and Communications Data Technical Usage Data User Content Feedback Data | Contract Otherwise as necessary for our legitimate interests (to operate, provide and improve our business and to communicate with you) | | To develop and improve our Service | Contact and Communications Data User Content Feedback Data Interaction Data Technical Usage Data | Legitimate interests (to improve and develop our Service) Consent | | To train and improve our models | Publicly Available Data User Content X Public Posts Feedback Data Interaction Data | Legitimate interests (for example, to improve the accuracy and performance of our models used to power the Services and to train more advanced models) Consent | | To ensure the security and integrity of our Service | Account Data Payment Data Contact and Communications Data User Content Feedback Data Technical Usage Data | Necessary for our and our third parties' legitimate interests (to detect or prevent illegal activities and/or to manage the security of our IT infrastructure, and the safety and security of our employees, customers and vendors) | | To comply with our legal obligations | Account Data Payment Data Contact and Communications Data User Content Feedback Data Technical Usage Data | Legal obligation Legitimate Interests (in protecting against misuse or abuse of our Service, protecting personal property or safety, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes, or to respond to lawful requests) | | To process job applications | Applicant Data | Legal obligations Legitimate interests (in assessing the suitability of our candidates and managing, improving, and safeguarding our recruiting process) Consent | | For our business or commercial purposes | Account Data Contact and Communications Data Social Data User Content Feedback Data Interaction Data Technical Usage Data | Legitimate interests (to identify new customers, data analysis, developing new products, identifying usage trends, and operating and expanding our business activities) |

11.3 Automated decision-making

xAI does not make decisions or take actions against individuals in ways that could have a legal or significant impact on them.

In addition, in relation to Grok's training, xAI does not process training data for the purposes of inferring or deriving any sensitive or special category data about individuals and we do not actively seek out data sources that include sensitive or special category data.

11.4 International transfers

By using our Service, you understand and acknowledge that your personal information will be used, stored and/or accessed by us in the United States and disclosed to our service providers in other jurisdictions. We maintain primary data centers in the United States. We take steps designed to ensure that the personal information we collect under this Privacy Policy is processed as described in this Policy and according to applicable law.

When we provide any personal information about you to any non-UK and non-EEA third-party, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this Privacy Policy. These measures may include the following:

Ensuring that there is an adequacy decision by the UK Government in the case of transfers out of the UK, or by the European Commission in the case of transfers out of the EEA, which means that the recipient country is deemed to provide adequate protection for such personal information; or
Having in place standard contractual clauses with the recipient which have been approved by the UK Government for transfers out of the UK or by European Commission for transfers outside the EEA.

Further details on the steps we take to protect your personal information, in these cases, are available upon request by contacting us by email at privacy@x.ai at any time.

11.5 Your rights

You may access, correct, update or request deletion of your personal information, subject to certain exceptions.
Please note that we cannot guarantee the factual accuracy of Output from our models. If Output contains factually inaccurate personal information relating to you, you can submit a correction request and we will make every effort to correct this information — but due to the technical complexity of our models, it may not always be possible for us to do so.
You can object to processing of your personal information when our processing is based on our legitimate interests, ask us to restrict processing of your personal information or request portability of your personal information, (i.e., your data to be transferred in a readable and standardized format).
Please note you can opt-out of our use of your information to train our models in your settings. See FAQ - Consumer.
If we send you any marketing communications, you have the right to opt-out of marketing communications at any time. We may still send you non-promotional emails, such as emails about your Grok access, legally required notices, or our ongoing business relations.
If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
You have the right to complain to a supervisory authority about our collection and use of your personal information. For more information, please contact your local supervisory authority. Contact details for supervisory authorities in the EEA and the UK are available here. Certain supervisory authorities may require that you exhaust our own internal complaints process before looking into your complaint.

If you have an xAI account to access the Service, some of these rights may be exercised through your account. You can also exercise your rights by contacting us at privacy@x.ai.

Please note, however, that your personal information may be exempt from such requests in certain circumstances, for example if we need to keep using your information to comply with our own legal obligations or to establish, exercise or defend legal claims. If an exception applies, we will inform you when responding to your request. We may request that you provide us with information necessary to confirm your identity before responding to any request you make.

For more information on your rights with respect to data we use train out models, please read these FAQs.

12. Additional U.S. state disclosures

You can find a list of the categories of personal information that we collect in Section 2 “Collection of your personal information” above.

12.1 Additional details regarding categories of personal information

The chart below provides additional details regarding the categories of personal information that we collect and have collected over the past 12 months. Please refer to the Sections above regarding how we collect your personal information, how we use your personal information, and how we disclose your personal information for further detail.

| Category of Personal Information We Collect | Categories of Third Parties With Whom We Share this Personal Information | | :---- | :---- | | Identifiers, including Account Data, we receive when you log into our platform and Contact and Communications Data you provide to us | Service providers, analytics partners, and parties you authorize, access, or authenticate | | Payment Data, to facilitate your transactions with us | Service providers | | Commercial information, such as records of your transaction history | Service providers, analytics partners, and parties you authorize, access, or authenticate | | Internet or other electronic network activity information, including your Technical Usage Data | Service providers, analytics partners, and parties you authorize, access, or authenticate | | User Content (such as photos and images), including as provided in the Account Data we receive when you log into our platform | Service providers, analytics partners, and parties you authorize, access, or authenticate | | Other identifying information that you voluntarily choose to provide, including in the form of User Content, Feedback Data, Social Media Information | Service providers, analytics partners, and parties you authorize, access, or authenticate | | Geolocation data, including country or city information based on the IP address, or if you manually provide location information | Service providers, analytics partners, and parties you authorize, access, or authenticate | | Professional or employment-related information, to process your job application | Service providers |

Some of the personal information described above may be deemed sensitive personal information under certain state privacy laws. We only collect such information for the purposes allowed by law or with your consent. We do not collect or process sensitive personal information with the purpose of inferring any characteristics about you and have not "sold" or "shared" (as those terms are defined under U.S. privacy laws) personal information. We also do not knowingly sell or share the personal information of individuals under the age of 13.

For more information on how your information is disclosed, please see Section 4 “Sharing of your personal information” above. As stated in Section 5 “Marketing” above, we do not share your personal information with third parties for their direct marketing purposes.

As stated in Section 7 “Retention of your personal information” above, we typically retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

For details regarding the sources from which we obtain personal information, please see Section 2 “Collection of your personal information” above. We collect and use personal information for the business or commercial purposes described in Section 3 “How we use your personal information (our purposes)” above.

12.2 Your rights

In addition to the rights detailed above in Sections 10 and 11 (e.g., your right to access, correct, or update your personal information), depending on what U.S. privacy law applies to you and subject to certain exceptions, you may also have the following rights:

The right to submit certain privacy requests through an Authorized Agent.
The right to request deletion of your personal information.
The right to be free from discrimination for exercising the rights afforded to you under applicable privacy laws.
The right to appeal a decision we make about your rights request.

Exercising your rights: Some of these rights may be exercised in the xAI service but others you will need to submit a request to privacy@x.ai. Once you have submitted your request, we will respond within the time frame permitted by applicable privacy laws.

Verification: In order to protect your personal information, your ability to exercise some of the rights detailed in this Privacy Policy may be subject to your ability to verify that you are the person about whom your request pertains. For example, we may require you to verify your identity by validating your account credentials. If we suspect fraudulent or malicious activity, we may ask you to supply additional information to allow us to verify your identity.

Authorized Agents: To exercise your rights using an Authorized Agent (as defined under applicable law), you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf. We reserve the right to deny a request from an Authorized Agent that does not submit proof that they have been authorized by you to act on your behalf.

Appeals: If we refuse to take action on a request within a reasonable period of time after receiving your request, you may appeal our decision by emailing us at privacy@x.ai. In such an appeal, you must (1) provide sufficient information to allow us to verify that you are the person about whom the original request pertains and to identify the original request, and (2) provide a description of the basis of your appeal. Please note that your appeal will be subject to your rights and obligations afforded to you under applicable law. We respond to all appeal requests as soon as we reasonably can, and no later than legally required.

Do Not Track: Please note that because the effect of "Do Not Track" signals remains unclear, and because there continues to be no consistent industry understanding of how to respond to such a signal, we do not alter our privacy practices when we detect a "Do Not Track" signal from your browser.

13. Changes to this Privacy Policy

We may update our Privacy Policy from time to time. When we do, we will publish an updated version and effective date on this page, unless another type of notice is required by applicable law. If you use the Service after any changes to the Privacy Policy have been posted, that means you agree to all the changes.

14. How to contact us

If you have any queries or complaints about our collection, use or storage of your personal information, or if you wish to exercise any of your rights in relation to your personal information, please contact privacy@x.ai or by mail using the following contact details:

| Attn: Privacy Team Name: x.AI LLC Email: privacy@x.ai Post: 1450 Page Mill Road, Palo Alto, CA 94304 | In the EU: Name: Lionheart Squared (Europe) Ltd Email: xai@lionheartsquared.eu Post: Lionheart Squared (Europe) Ltd FAO x.ai, 2 Pembroke House, Upper Pembroke Street 28-32 Dublin, D02 EK84, Republic of Ireland | | :---- | :---- | | In the UK: Name: Lionheart Squared Limited Email: xai@lionheartsquared.co.uk Post: Lionheart Squared Limited FAO x.ai, 17 Glasshouse Studios, Fryern Court Road, Fordingbridge Hampshire, SP6 1QX United Kingdom | In Switzerland: Name: Lionheart Squared Switzerland SarL Email: xai@lionheartsquared.ch Post: Lionheart Squared Switzerland SarL FAO x.ai, Blvd George Favon 43 CH-1204 Geneva |