Privacy Policy

Change log

1. Who the controller is

Data controller (owner of the personal data bank): Xeneural Technologies E.I.R.L., RUC 20606521261, Av. Cayma 612, Dpto. 401, Res. Santa María, Cayma, Arequipa, Peru. Email for privacy matters and the exercise of rights: privacy@xeneural.com.

For customers domiciled outside Latin America, the contracting entity is Xeneural LLC, United States of America, in accordance with the table of entities published at xeneural.com/legal/entidades. Xeneural LLC does not operate systems or access personal data: all processing is carried out by Xeneural Technologies E.I.R.L. in accordance with this policy, with the same contact channel.

When a business customer incorporates into XEN the data of its own customers, suppliers or employees, that customer is the controller and Xeneural acts as a data processor in accordance with the Data Processing Agreement. In that case, requests to exercise rights are addressed to the customer and Xeneural helps it handle them; if we receive one, we forward it to the customer within a maximum of two (2) business days.

2. Which data we process and where it comes from

We do not process sensitive data (health, biometrics, origin, political opinion, orientation) unless the customer incorporates it into XEN as controller, under its sole decision and with the written consent required by law.

3. Why we process it and on what basis

We do not make automated decisions with legal effects on you and we do not profile people. XENI answers what you ask and does not evaluate, score or classify natural persons.

No artificial intelligence training. Xeneural does not use your personal data or the content that you or your company upload to XEN to train, fine-tune or evaluate artificial intelligence models, its own or third parties', and prohibits its providers from doing so by contract.

4. Who we share it with

We do not sell personal data. We share it only with:

• Providers that supply us with infrastructure and services (subprocessors), under a contract that obliges them to process it only according to our instructions and with equivalent security measures. The full list, with the purpose and location of each one, is at xeneural.com/legal/subencargados and is updated with thirty (30) days' notice.
• Authorities, when a law or a valid order requires it, informing you unless legally prohibited.
• Artificial intelligence model provider (Google), contracted on paid terms, only with the content needed to answer your query to XENI, under terms that exclude the use of your data to train models.

5. Where we host the data and international transfers

We process the data in these locations, according to the purpose: hosting of the application, the database and the documents in third-party data centres in the United States of America; delivery and protection of traffic on the global network of our edge provider, which may keep temporary cached copies; and XENI answers on the global infrastructure of Google. The processing of your data therefore involves a cross-border flow from Peru to the United States, which Xeneural reports to the National Registry of Personal Data Protection in accordance with article 21 of the Regulations of Law 29733.

The safeguards we apply to that transfer are: contracts with each provider that incorporate data protection clauses and, for customers in the European Economic Area, the unmodified standard contractual clauses of the European Commission; encryption in transit and at rest; strict access control; and providers with recognised security certifications (ISO/IEC 27001 and SOC 2), verified and listed on the subprocessors page.

6. How long we keep it

For data not listed in the table, we set the period with these criteria: the time needed for the purpose for which it was collected, the periods required by law and the limitation period of any actions that may arise. When the period expires, we delete the data or anonymise it irreversibly.

7. How we protect it

We apply the measures described in our Security Summary: encryption with standard algorithms in transit (TLS 1.2 or higher) and at rest (AES-256), corporate sign-in and two-factor authentication, role- and site-based access control, logical segregation of each customer's data, access and activity logging, continuous backups with point-in-time restoration and a restoration test every quarter, and an incident management procedure with notification to customers within 24 hours and to the National Personal Data Protection Authority within the legal period.

8. Your rights

You may exercise at any time, free of charge, your rights of information, access, rectification, cancellation, objection, withdrawal of consent and portability, by writing to privacy@xeneural.com from the email associated with your account or attaching a copy of your identity document if you write from another. We answer within the periods set by Peruvian law: information within eight (8) business days, access within twenty (20), rectification, cancellation and objection within ten (10). We answer residents of the European Economic Area within the one-month period of article 12 of the GDPR, extendable in the cases that article provides for. Withdrawing consent is as simple as giving it and does not affect the lawfulness of earlier processing.

If you consider that we have not properly handled your request, you may turn to the National Personal Data Protection Authority of the Ministry of Justice and Human Rights of Peru (www.gob.pe/anpd). Residents of the European Economic Area may contact their supervisory authority.

9. Nature of the answers and consequences of not providing data

The data marked as mandatory in each form is necessary to handle the request or provide the Service; without it we cannot do so. The rest is voluntary. We do not condition any service on data that is not essential to provide it.

10. Minors

XEN is intended for people aged eighteen or over. We do not knowingly process minors' data; if we detect that a minor has created an account, we delete it.

11. Cookies

The website does not use tracking or advertising cookies. It uses two first-party technical cookies (country code and voluntary opt-out from measurement) and local storage for your interface preferences. The details are in the Cookie Policy.

12. Changes to this policy

We publish each version with its date and keep earlier ones. If a change extends the purposes or the recipients, we will let you know and, where appropriate, ask for your consent again before applying it.

13. Contact

Xeneural Technologies E.I.R.L., RUC 20606521261, Av. Cayma 612, Dpto. 401, Res. Santa María, Cayma, Arequipa, Peru. Privacy and rights: privacy@xeneural.com. Security: security@xeneural.com. Personal Data Officer: Juan Camilo Beleño Vega, Managing Owner, appointed on 21 September 2026; contact: privacy@xeneural.com.