Privacy Policy

1.1 Information you provide

1.2 Information collected through use

2.1 Provide Oxaide

• Quote, bill (via Stripe), generate, and deliver per-job research packs to your email thread
• Run each paid brief in its own folder on a private build machine and wipe uploads on completion
• Track per-job status, 3-pack credits, referrals, and resend budgets to prevent double-charging and abuse
• Send transactional mail only (quotes, receipts, packs, renewals). No marketing list
• Measure funnel and latency in aggregate to keep the 2-hour SLA and fixed pricing

2.2 Operate and protect the Service

• Process subscriptions, payments, invoices, cancellations, and account administration
• Provide support and send transactional, security, billing, and usage communications
• Detect abuse, investigate incidents, debug failures, maintain reliability, and enforce our Terms
• Understand feature use and improve product quality using feedback, service telemetry, and aggregated or deidentified information where reasonably possible
• Comply with law, respond to lawful requests, and establish, exercise, or defend legal claims

The legal basis depends on the information, purpose, and jurisdiction. Where laws such as the GDPR or Singapore PDPA apply, we rely on the following bases as appropriate:

Under the Singapore PDPA, we collect, use, and disclose personal data with consent or another basis permitted by law. Withdrawing consent may limit features that require the affected data.

4.1 Service providers

We disclose information to vendors acting for us when needed to operate the Service. Their role, location, and data access depend on the feature you use. Core provider categories currently include:

Providers and subprocessors may change as the Service changes. We require providers to handle data for the relevant service purpose and subject to their applicable contractual and legal obligations.

Model and provider selection can vary by request based on task needs, availability, reliability, safety, and product changes. Default Brief runs use a US-hosted frontier model. Same pack, same source-linked standard. Oxaide does not promise a fixed model or provider.

Contributor-tier processing happens in the US. It is our automatic fallback when the primary Standard route rate-limits or fails, so the 2h SLA holds without you needing to do anything. We process Customer Content to provide, secure, support, and maintain the Service; our own product improvement uses feedback, service telemetry, and aggregated or deidentified information where reasonably possible. The contributor tier is different: per Meta's terms, it may learn from prompts and completions sent to it.

We never train on your files. What compounds is our method. Checklists, source coverage, verification. So each job runs a sharper harness on your private, isolated copy. Your brief stays yours. The one exception is outside our walls: if your job falls back to Meta's contributor API, that tier's terms allow Meta to learn from that run's prompts and outputs.

4.2 Other disclosures

• With workspace owners, members, or administrators according to their permissions
• With recipients you choose through an explicit share action or share link
• With professional advisers, auditors, insurers, and authorities where reasonably necessary or legally required
• To protect users, Oxaide, providers, or the public from fraud, abuse, security threats, or unlawful conduct
• In connection with a financing, merger, acquisition, restructuring, or sale, subject to appropriate confidentiality and notice where required

• Oxaide manages accounts, retainers, quotas, usage measurement, and pack generation.
• Model providers process your brief to generate your pack — paid Standard services first (no training use), with automatic fallback to the Meta contributor API (training use permitted under the terms of that tier) if the primary route is unavailable.
• Payment credentials, Stripe secrets, price configuration, and subscription mutation authority are not provided to assistant processing.
• The Service does not require and must not receive passwords, seed phrases, private keys, or write-enabled trading credentials.
• Oxaide does not use Customer Content to execute trades, take custody of assets, or manage an investment account.

We use administrative, technical, and organisational measures designed to protect information in light of its nature and the risks involved. Measures may include:

• Encrypted network transport and storage protections supplied by our infrastructure providers
• Authentication, workspace permissions, access restrictions, and separation of billing authority from order handling
• Logging, monitoring, backups, updates, incident handling, and provider security controls where appropriate
• Access limitation for personnel and service providers based on operational need

We retain information for as long as reasonably necessary to provide the Service, maintain job and matter history, administer an active account, meet legal and accounting obligations, resolve disputes, enforce agreements, protect security, and support legitimate business operations.

• Retention varies by data type, account status, workspace settings, provider systems, and legal requirements.
• When information is no longer required, we delete it or anonymise it according to our operational processes, subject to lawful exceptions.
• Deleted information may remain temporarily in backups, security logs, fraud-prevention records, or provider systems until ordinary deletion cycles complete.
• Aggregated or deidentified information may be retained where it no longer reasonably identifies an individual.
• You may request account or personal-data deletion at privacy@oxaide.com. We may verify identity and retain limited records where required or permitted by law.

Oxaide specifics (no account)

• Uploads are wiped within 24 hours of the job completing (delivered or failed). Jobs still awaiting payment or human review keep their inputs until resolved, then the same 24-hour wipe applies.
• Delivered packs (files + download links) auto-delete after 90 days; links stop working then.
• Quote records, answer text and job metadata stay in our database to provide history, prevent abuse and double-charging, and meet accounting and legal duties. Ask for deletion at privacy@oxaide.com. We honour it subject to lawful exceptions.
• Delivery and download links are bearer links: anyone holding the link can download until expiry. Do not forward them.

Depending on where you live, you may have rights concerning your personal data. These can include:

• Accessing personal data and information about how it is used
• Correcting inaccurate or incomplete personal data
• Requesting deletion, restriction, or objection to certain processing
• Receiving portable data where the right applies and the format is technically available
• Withdrawing consent without affecting earlier lawful processing
• Opting out of marketing communications through the message link or by contacting us
• Complaining to the relevant privacy or data protection authority

Send requests to privacy@oxaide.com. We may ask for information needed to verify your identity, authority, workspace relationship, and jurisdiction. We will respond within the period required by applicable law. Certain rights are subject to legal exceptions.

You can control cookies through browser settings and any controls we make available. Blocking essential cookies may prevent sign-in or other core features. Browser-based global privacy signals are honoured where required by applicable law and technically supported.

Oxaide is based in Singapore, and our providers may process information in Singapore and other countries. Default Brief runs are processed in the US on Meta paid Standard services; if that route is unavailable, runs fall back to Meta's contributor API, also in the US. Your isolated job computer still wipes uploads in 24h and packs auto-delete after 90 days. Those countries may have different privacy laws. Where required, we use contractual or other recognised safeguards and take steps intended to provide a standard of protection comparable to applicable requirements.

We investigate suspected personal-data breaches and take containment and remediation steps appropriate to the circumstances. When applicable law requires notification to an authority or affected person, we will provide it within the legally required period and include the information required by that law.

We may update this policy as the Service, providers, or law changes. We will post the updated policy with a new effective date and provide additional notice when required by law or when a change materially affects your rights. Your continued use after the effective date is subject to the updated policy.