About this policy
This policy describes how the ExOS Chat mobile app (“the app”) and the ExOS service behind it handle personal data. The app is made by ExOS Labs ehf., kt. 640626-0110, Skeiðarvogi 21, 104 Reykjavík, Iceland (“ExOS Labs”, “we”, “us”).
ExOS Chat is a business tool. Staff of organizations that use ExOS can chat with their company’s ExOS agents, approve or reject actions the agents propose, and listen to audio briefings. The app is not intended for the general public or for children. There is no public sign-up: accounts are created by each organization’s ExOS administrator.
This policy covers you as a user of the app. Your organization’s business data, such as ERP records, customers and invoices, is handled under the agreement between your organization and ExOS Labs.
Who is responsible for your data
ExOS Labs is the data controller for the app-user data described in this policy.
If you use ExOS Chat as part of your job, your employer is the controller of its business data, including the conversations and actions in its ExOS workspace. ExOS Labs processes that data on your employer’s behalf as a data processor under a data processing agreement.
The processing is governed by the EU General Data Protection Regulation (GDPR) and the Icelandic Data Protection Act no. 90/2018.
The data we collect
- Account data: your email address, full name, role and organization. Used to sign you in and show you the right workspace. Legal basis: contract (GDPR Art. 6(1)(b)).
- Phone number (optional): if you add a phone number in Settings and verify it, we store it and use it only to send you sign-in codes by SMS. You can remove it in Settings at any time, and codes then go to your email. Legal basis: consent (Art. 6(1)(a)).
- Sign-in codes and tokens: sign-in is passwordless. We send a 6-digit code to your email address, or by SMS to your verified phone number. A code is valid for 10 minutes and the server stores it only in hashed form. After you sign in, the app keeps an access token and a refresh token in your device’s secure storage (iOS Keychain or Android Keystore). Legal basis: contract.
- Device data: your push notification token, device model and operating system version, used to deliver notifications and diagnose platform issues. Legal basis: contract.
- Face ID or Touch ID (optional): the app stores only whether biometric unlock is turned on. Your device does the biometric matching, and no biometric data ever leaves it. Legal basis: consent.
- Briefing playback: when you start an audio briefing, the app records that you have started that episode, so it can show how many briefings you have not played yet. Legal basis: contract.
- Usage metadata: times of sign-ins, feature-use counts and crash events, used to fix bugs and decide what to improve. Legal basis: legitimate interests (Art. 6(1)(f)).
- Your messages and decisions: the messages you send to agents and the actions you approve or reject, with the time. These are stored on your organization’s ExOS server as part of its business data.
- Cached content: a copy of recent conversations, actions and agent responses is kept in the app’s private storage on your device, so the app works offline or on a weak connection. Legal basis: contract.
What the app does not do
- The app does not use your camera or microphone.
- The app does not access your contacts, location, photos or calendar, or your browsing outside the app.
- The app contains no advertising and uses no advertising or tracking identifiers.
- The app contains no third-party analytics or crash-reporting tools.
- The app does not track you across other companies’ apps or websites.
- We never sell personal data or share it with third parties for advertising or marketing.
How data flows and who processes it
- The app talks only to your organization’s ExOS server, over HTTPS with TLS 1.2 or newer.
- Sign-in codes sent by SMS go through Twilio, which receives your phone number and the message text. Codes sent by email go through the email service set up for your organization’s ExOS server.
- Push notifications go through Expo’s push notification service, which passes them on to Apple Push Notification service (APNs) on iOS and Firebase Cloud Messaging (FCM) on Android. These services receive your push token and the notification text, not your account or conversation history.
- When an agent handles a request, the ExOS server sends the content it needs to the AI model provider set up for your organization, by default Anthropic Claude. Providers are used under commercial API terms that do not allow them to train on your data.
- Audio briefings are written by the agents and turned into speech by ElevenLabs.
- If you cast a briefing to a Chromecast or other Google Cast device, the app uses Google’s Cast technology to send the episode audio and title to that device over your local network.
Some of these providers process data outside the European Economic Area. Where they do, transfers are protected by safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.
Where data is stored
- The ExOS service backend for your organization is hosted on infrastructure controlled by ExOS Labs, in the European Economic Area. Hosting in Iceland only is available on request.
- Your device keeps sign-in tokens in the iOS Keychain or Android Keystore, and cached content in the app’s private storage.
- Anthropic keeps API request data for up to 30 days for abuse monitoring. Zero retention is available on request.
How long we keep data
- Account data: for as long as your account is active, then deleted within 30 days of the account being closed.
- Phone number: until you remove it or your account is closed.
- Sign-in codes: valid for 10 minutes.
- Sign-in tokens: rotated continuously. Old tokens expire within minutes to days.
- Usage metadata: up to 12 months, then aggregated or deleted.
- Cached content on your device: removed when you sign out, uninstall the app, or clear it in Settings.
- Backups: database backups are kept for 30 days, then destroyed.
Your rights
Under the GDPR and the Icelandic Data Protection Act you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data deleted
- restrict or object to certain processing
- receive your data in a machine-readable format (portability)
- withdraw consent at any time for processing based on consent
- complain to Persónuvernd, the Icelandic Data Protection Authority (personuvernd.is), or to the supervisory authority in your own country
To use these rights, email [email protected]. We respond within 30 days.
Deleting your account and data
ExOS Chat accounts are managed by your organization. To have your account and the personal data tied to it deleted, either ask your organization’s ExOS administrator or email [email protected] from the email address on the account and tell us which organization you belong to. We confirm the request and delete your account data within 30 days, apart from records your organization must keep as part of its business data.
You can remove your phone number yourself in Settings at any time. Signing out or uninstalling the app removes cached content from your device.
Security
- All network traffic uses TLS 1.2 or newer.
- Sign-in tokens are kept in your device’s secure storage (iOS Keychain or Android Keystore).
- Sign-in codes are stored only in hashed form and expire after 10 minutes.
- Credentials for connected business systems, such as Business Central, never leave the server.
- Access to production systems requires multi-factor authentication and is logged.
- We notify Persónuvernd and affected users within 72 hours of confirming a personal data breach.
Children
ExOS Chat is a business product for staff of our customer organizations. It is not directed at children under 16, and we do not knowingly collect personal data from them.
Changes to this policy
We may update this policy as the service changes or as the law requires. Material changes will be announced in the app and by email at least 30 days before they take effect. The date at the top of this page shows the latest revision.
Contact
ExOS Labs ehf., kt. 640626-0110, Skeiðarvogi 21, 104 Reykjavík, Iceland.
Data protection contact: Bjarni Ingimar Auðarson, [email protected]
For help with the app, see exos.is/support or email [email protected].