1. Overview & Architectural Commitment
This Privacy Policy explains how XRAY Labs, Inc. (“XRAY”, “we”, “us”) collects, processes, and protects information when you use XRAY Bridge (“Service”).
Unlike conventional collaboration and recording services, XRAY Bridge is engineered with a strict Derive-and-Discard data model: we extract structured commitments, task facts, and decision outcomes in volatile container memory, and immediately discard complete conversational transcripts (rawBufferTtlDays = 0 by default). We retain each fact with a 1-2 sentence supporting quote and the speaker’s name until you clear it, correct it, or delete your workspace.
2. Information We Collect
We collect only the minimum data necessary to verify operational accomplishments and deliver leadership visibility:
- Account & Identity: Work email address, display name, organization title, and hashed passwords or federated Google Workspace OIDC profile identifiers.
- Operational Metadata: External tracker identifiers (e.g., GitHub issue #, Jira key, Linear identifier, Airtable record ID), commit hashes, pull request state, task titles, and verification timestamps.
- Commitment Excerpts: Short, attribution-scoped quotes and action items extracted from meeting bot webhooks (e.g., Zoom, Fathom, Fireflies, Teams, Meet).
- Billing Information: Payment cardholder name, billing postal code, and payment method tokens managed directly by Stripe. Card numbers never touch our servers.
What We Never Collect or Store: We do not store raw meeting audio recordings, full-length video recordings, unredacted corporate communications, private HR/legal channels, or employee direct messages.
3. How We Process Data & Zero AI Training
We process data exclusively to provide, secure, and improve the Service for your organization:
- Reconciling completed tasks with factual verification rails;
- Formatting and delivering periodic accomplishment briefs to designated email recipients;
- Enforcing outbound policy rules (secret redaction, card masking);
- Authenticating users and isolating multi-tenant data via PostgreSQL Row-Level Security.
Zero AI Model Training: Under no circumstances is Customer Data used to train, retrain, fine-tune, or benchmark any machine learning or artificial intelligence models.
4. Sub-processors & Data Residency
We use third-party sub-processors solely to provide underlying infrastructure and specialized services. All sub-processors reside and process data in the United States:
- Railway Corp. (USA: Application hosting & container edge)
- Neon, Inc. (USA: Dedicated PostgreSQL 17 database with RLS)
- OpenAI, L.L.C. (USA: AI review of task evidence, only when enabled; zero model training)
- Resend, Inc. (USA: Transactional brief & invite email delivery)
- Stripe, Inc. (USA: PCI-DSS billing and payment processing)
- Google LLC (USA: Optional Google Workspace OIDC sign-in)
For legal entities and regions, view our complete Sub-processors Table.
5. Data Subject Rights (GDPR & CCPA)
Regardless of your geographic location, we extend comprehensive privacy rights to all users:
- Right of Access & Portability: Export all organization data at any time via
GET /api/v1/organizations/export; - Right to Erasure (“Right to be Forgotten”): Permanently delete your workspace and all tenant records via
DELETE /api/v1/organizations; - Right to Rectification: Edit or correct any inaccurate personal metadata in Settings;
- Right to Object: Disconnect any third-party tool connection at any time to immediately stop data synchronization.
6. Security Measures
We maintain robust technical and organizational safeguards:
- Envelope encryption using per-tenant HKDF-SHA256 derived keys and AES-256-GCM (
hkdf_v1:); - PostgreSQL 17 kernel-level Row-Level Security (RLS) with
NOBYPASSRLS non-superuser roles; - TLS 1.3 encryption in transit for all web and API traffic with strict HSTS;
- Automated secret and credit card number masking in all outbound payloads.
7. Contact Information
For privacy inquiries, Data Processing Addendum (DPA) requests, or to exercise your privacy rights: