Privacy Policy

Version 2026-09 · Effective September 1, 2026 · Supersedes the version dated April 6, 2026

The short version (the full policy below is what binds):

Your workspace content is yours. We process it only to run the service for you — never to train AI models, never for advertising, and we never sell it.
For content in your workspace, you are the controller and we are your processor. A data-processing agreement is available for business customers.
Data is hosted on Google Cloud in the United States. AI processing uses third-party model providers under contract with us.
If you delete your account, everything is gone within 30 days — including from backups.
If a data breach affects you, we tell you without undue delay.

Anycast is a product of EXCOM AI L.L.C-FZ (Meydan Free Zone, Dubai, United Arab Emirates — "ExCom.ai", "we"). This policy explains what we process and why when you use Anycast at anycast.excom.ai and its related applications, and it should be read with our Terms of Service.

1. Our two roles

We process two kinds of data, in two different roles:

Account and service data — who you are, your workspace membership, billing and usage records. For this data, ExCom.ai is the controller.
Workspace content — the messages, files, documents, records and outputs inside your workspace. This is your data: where it contains personal data subject to GDPR, LGPD, the UAE Personal Data Protection Law or similar law, you (or your organization) are the controller and we are your processor, handling it only on your instructions to provide the service. For business customers a data-processing agreement is available on request at privacy@excom.ai and prevails over this policy for the matters it covers. If your workspace was provided through a partner, the processing chain runs through your contract with that partner.

2. What we collect

Account information: when you sign in with Google or Microsoft, we receive your name, email address, and profile picture from the identity provider. We never receive or store your password.

Workspace content: messages you send, files you upload, documents and records you create, and content the AI assistant produces are stored to provide the service. Each workspace is stored in its own isolated environment.

Connected systems and credentials: if you connect external systems (mailboxes, databases, repositories, APIs), we store the credentials you provide, inside your workspace's isolated environment, and use them only as your workspace's assistant acts on your instructions. You can disconnect at any time, which invalidates our copy of the credential.

Usage and performance data: how much AI work ran, how long it took, whether it failed, and basic request metadata (timestamps, response times). We use this to operate, secure, meter and improve the service. It does not include the content of your work.

Support communications: messages you send to our support addresses.

3. How we use it, and on what basis

To provide and operate the service, including AI processing of your instructions — performance of our contract with you.
To authenticate you and manage workspace access — performance of contract.
To meter usage, bill, and enforce plan limits — performance of contract.
To secure and monitor the service and prevent abuse — legitimate interest.
To communicate with you about your account, service changes, and security — performance of contract / legitimate interest.
To comply with law — legal obligation.

We do not use your data for advertising, we do not sell it, and we do not use workspace content to train AI models — ours or anyone else's. No customer's content is used to build another customer's workspace.

4. AI processing

Messages and content you direct at the assistant are processed by third-party large-language-model providers (currently Anthropic's Claude) under contract with us, solely to generate the responses and work you request. Your content is not used to train models. Each workspace's AI context is isolated — conversations in one workspace are never visible to another. Details of provider retention and safeguards are set out in the data-processing agreement for business customers.

5. Who we share data with

We share data only with the providers we need to run the service, each only for its function:

Provider	Purpose	What they handle
Google Cloud (US)	Hosting, storage, backups	All service data, encrypted at rest
Anthropic (US)	AI model processing	Content sent to the assistant, to generate responses
Stripe (US)	Payment processing	Billing and payment metadata only — never workspace content
Resend (US)	Email delivery	Transactional email, and email your workspace sends at your direction
Google / Microsoft	Sign-in	Your identity assertion at login; they act as independent controllers of your account with them

Messaging networks: if your workspace uses a chat surface on a third-party network (for example Telegram), messages you exchange with the assistant on that surface are transmitted through that network and are also subject to its own terms and privacy policy. Workspaces using only the web and desktop apps do not involve messaging networks.

Legal requirements: we disclose data where required by law or to protect our rights, and — unless legally prohibited — we notify you before disclosing your workspace content in response to a legal demand.

6. Where your data lives — international transfers

The service is hosted on Google Cloud in the United States (region us-central1); AI processing occurs in the United States; ExCom.ai is established in the United Arab Emirates. Where personal data subject to GDPR, LGPD or similar law is transferred internationally, we rely on appropriate safeguards — contractual clauses with our providers, and, for business customers, the transfer mechanisms in the data-processing agreement (EU standard contractual clauses; ANPD standard clauses for Brazil).

7. Security, and if something goes wrong

Encryption in transit (TLS 1.2+) and at rest (AES-256, via our hosting infrastructure)
Per-workspace container isolation — no shared databases or file systems between customers
OAuth 2.0 sign-in, signed sessions, and workspace-membership checks on every request
Production access limited to named administrators, logged, and used only for support and incident response
Daily automated backups

If we become aware of a personal-data breach affecting your data, we notify you without undue delay, with what we know about its nature, scope and the measures taken, and we cooperate with your own notifications to regulators and data subjects where you are the controller.

8. Retention and deletion

While your account is active: we keep your account data and workspace content so the service works.
If you delete your account or a workspace: its content — files, messages, records, AI memory and stored credentials — is permanently deleted within 30 days of your request. That window includes expiry from our backups: nothing remains after it.
If your subscription ends: your data remains exportable for the 30-day export window described in the Terms of Service, and is then deleted on the same 30-day basis.
Usage and billing records: retained up to 12 months after account closure, or longer only where tax or accounting law requires.

9. Your rights

You can ask us to: access a copy of your personal data; correct it; delete it; export your workspace data (also available self-service); restrict or object to processing; and withdraw consent where processing is based on it. Write to privacy@excom.ai; we respond within 30 days. If your data sits inside a workspace whose controller is your employer or a business you deal with, we may refer your request to them — for that data we act on the controller's instructions. You may also complain to the data-protection authority that applies to you.

10. Cookies and local storage

We use browser localStorage (not cookies) to keep you signed in and store your preferences. We use no third-party tracking cookies and no advertising or analytics trackers.

11. Age

Anycast is for business use and not intended for anyone under 18. We do not knowingly collect personal information from children; if you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

The current version always lives at this address and each version is dated. For material changes we give at least 30 days' notice by email or in the app before they take effect, consistent with the change process in our Terms of Service. We do not treat silence as agreement to a materially reduced level of protection.

13. Contact

Privacy questions and requests:

EXCOM AI L.L.C-FZ (ExCom.ai)
Meydan Free Zone, Dubai, United Arab Emirates
Email: privacy@excom.ai
Website: excom.ai

Anycast is a product of ExCom.ai (EXCOM AI L.L.C-FZ, Meydan Free Zone, Dubai). See also our Terms of Service and Acceptable Use Policy.