1. Who We Are (Data Fiduciary)

xSpecies AI is the data fiduciary responsible for personal data collected through this Website. We determine the purposes and means of processing your data. We build general-purpose humanoid robots and operate at www.xspecies.ai.

Grievance Officer / Privacy Contact:

• Name: Srikanth Vidapanakal
• Email: srikanth@xspecies.ai
• Website: www.xspecies.ai

2. What Personal Data We Collect

2.1 Data You Provide Directly

Currently, we collect only the following personal data through our waitlist and contact forms:

• Full Name — to address you appropriately in communications.
• Email Address — to send you waitlist updates, product announcements, and responses to your enquiries.

We do not currently collect payment information, Aadhaar or PAN numbers, biometric data, health information, location data, or any other sensitive personal data through this Website.

2.2 Data Collected Automatically (Technical Data)

When you visit our Website, we may automatically collect limited technical information:

• IP address (used for security and fraud prevention only)
• Browser type and version
• Pages visited and session duration (via basic analytics)
• Referring URL

This technical data is not linked to your name or email and is used solely for Website security and performance monitoring.

2.3 What We Do NOT Collect (at this stage)

We do not collect:

• Payment or financial data
• Government-issued ID numbers (Aadhaar, PAN, Passport)
• Biometric data
• Robot operational or telemetry data (this will apply only to future product users, under separate agreements)
• Data from children under 18 years of age

3. How We Use Your Data (Purpose Limitation)

We use the personal data you provide only for the following specific purposes:

• To manage your waitlist registration and notify you of product updates and launch timelines.
• To respond to enquiries or contact form submissions.
• To send you relevant communications about xSpecies AI products, partnerships, or events that you have expressed interest in.
• To maintain the security and integrity of our Website and systems.
• To comply with applicable legal obligations.

We will not use your personal data for automated profiling, algorithmic decision-making, or any purpose not listed above without first obtaining your fresh, informed consent.

4. Legal Basis for Processing (DPDPA 2023 — Section 4)

Under the DPDPA 2023, we process your personal data on the following lawful bases:

• Consent (Section 6): When you voluntarily submit your name and email through our waitlist or contact form, you provide free, specific, informed, and unambiguous consent. Our consent mechanism is separate from other terms and is presented clearly.
• Legitimate Interests: For Website security, fraud prevention, and IT infrastructure maintenance, where these interests are not overridden by your privacy rights.

Your consent is granular and specific — submitting a waitlist form consents only to waitlist communications. You may withdraw consent at any time with no detriment to you. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.

To withdraw consent, email: srikanth@xspecies.ai with the subject line "Withdraw Consent — [Your Email Address]".

5. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We never will. We may share data only in the following limited, controlled circumstances:

• Service Providers (Data Processors): Trusted third-party vendors who help us operate our Website or send emails (e.g., email delivery platforms, cloud hosting). They are bound by strict data processing agreements, confidentiality obligations, and are permitted only to process data for the specific purpose we direct.
• Legal Compliance: When required by law, court order, or a lawful directive from an Indian government authority or the Data Protection Board of India.
• Business Transfers: In the event of a merger, acquisition, or asset sale, your data may be transferred. We will notify you in advance where required by law, and any acquirer will be bound by privacy obligations equivalent to this Policy.

We do not transfer your personal data outside India at this time. If international transfers become necessary in the future (e.g., for cloud services), we will ensure appropriate safeguards as per DPDPA requirements and notify you.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the stated purposes or as required by applicable law:

• Waitlist data (name and email): Retained until you request removal, or until we have completed the purpose (e.g., post-launch communication cycle concludes), whichever comes first.
• Contact form data: Retained for up to 12 months from receipt, to allow follow-up and maintain correspondence records.
• Technical/analytics data: Retained for up to 6 months on a rolling basis.

Once data is no longer required, it is securely deleted or anonymised. We do not retain data indefinitely. You may request earlier deletion — see Section 7.

7. Your Rights as a Data Principal (DPDPA 2023)

Under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to Access (Section 11): Request a summary of the personal data we hold about you and how it is being processed.
• Right to Correction & Erasure (Section 12): Request correction of inaccurate or incomplete data, or erasure of data that is no longer necessary for the purpose it was collected, subject to legal retention requirements.
• Right to Withdraw Consent (Section 6): Withdraw your consent at any time, without affecting prior processing.
• Right to Grievance Redressal (Section 13): Raise a grievance with us, which we will address within 48 hours (acknowledgement) and 30 days (resolution).
• Right to Nominate (Section 14): Nominate another individual to exercise your rights in the event of your incapacitation or death.

How to Exercise Your Rights: Email srikanth@xspecies.ai with the subject line 'Data Rights Request — [Your Name]'. Please include your registered email address. We will verify your identity and respond within 30 days as required by the DPDPA.

Complaint to the Data Protection Board of India

If you are not satisfied with our response to a grievance, you have the right to file a complaint with the Data Protection Board of India (DPBI). The Board is currently operational and can be reached through the official MEITY/DPBI portal. We will cooperate fully with any investigation by the Board.

8. Data Security

We implement reasonable and appropriate technical and organisational security measures to protect your data, including:

• Encrypted data storage with role-based access controls.
• Secure HTTPS connections for all Website traffic.
• Access to personal data restricted to authorised personnel only, on a need-to-know basis.
• Regular review of our security practices as our product and team scales.

In the event of a personal data breach that is likely to result in risk to your rights or interests, we will notify the Data Protection Board of India and, where required, affected individuals, as mandated by the DPDPA 2023 and DPDP Rules 2025.

9. Cookies & Tracking

Our Website currently uses only essential cookies required for basic functionality and security. We do not use tracking, advertising, or third-party analytics cookies at this time.

If we introduce non-essential cookies in the future, we will:

• Display a clear cookie consent banner.
• Obtain your explicit, informed consent before deploying any non-essential cookies.
• Update this Privacy Policy with details of all cookies in use.

You may configure your browser to refuse cookies; however, some parts of the Website may not function correctly as a result.

10. Children's Privacy

Our Website is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. As required under the DPDPA 2023, processing of children's data requires verifiable parental consent.

If you believe a child has submitted personal data to us, please contact srikanth@xspecies.ai immediately and we will delete it without delay.

11. Forward-Looking: Future Product Data

As xSpecies AI launches physical products (HANDY, DexteraX), they may collect operational and telemetry data (e.g., motion logs, task completion data) to improve our AI models. This data will be governed by separate product-specific data agreements. Any such data involving identifiable individuals will be subject to full DPDPA protections and explicit consent. Our data licensing business model applies only to anonymised, non-personal operational data.

12. Changes to This Privacy Policy

We will update this Policy to reflect changes in our practices, products, or applicable law. Material changes will be:

• Reflected with an updated "Effective Date" and version number at the top of this page.
• Communicated to registered waitlist members by email, where feasible.

We encourage you to review this Policy periodically. Continued use of the Website after changes constitutes acceptance of the revised Policy.

13. Contact & Grievance Officer

For all privacy-related queries, data rights requests, or grievances, contact our designated Grievance Officer as required under the IT Act, 2000 and DPDPA 2023:

Grievance Officer:

Srikanth Vidapanakal, Co-Founder

Email: srikanth@xspecies.ai

Website: www.xspecies.ai

Secondary Contact: Puneet Panwar | puneet@xspecies.ai

We acknowledge all grievances within 48 hours and aim to resolve them within 30 days. If unresolved, you may escalate to the Data Protection Board of India.

‍