Privacy Policy

BillionX AI Ltd (“BillionX AI”, “we”, “us”, “our”) is a private limited company incorporated in England and Wales (company number [UK Companies House number]), with its registered office at [Registered office address, United Kingdom]. We operate the BillionX AI platform.

BillionX AI Ltd is the controller of personal data processed through the Service. For privacy questions or to exercise your rights, contact privacy@billionx.ai.

Account data: email address, display name, and identifiers from federated login providers (e.g. Google).

Usage data: your chat messages and prompts, course progress, agent tasks, agent memory (business type, goals), and preferences (language, theme).

Technical data: IP address, user agent, device information, timestamps, real-user-monitoring performance samples (10% sample), and rate-limit event counters.

Voice data: audio you submit for transcription is processed to produce text; we do not retain raw microphone audio beyond the processing window. Generated speech (text-to-speech) is cached to keep the Service fast and to reduce costs.

To operate, secure, and improve the Service; to personalize responses to your context; to enforce our Terms and prevent abuse; and to communicate service-related notices.

We do not sell your personal data. We do not use your prompts or content to train third-party public models.

Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract (to provide the Service), legitimate interests (to secure and improve the Service and prevent abuse), consent (for optional features that request it), and legal obligation (to comply with applicable law).

Your prompts and relevant conversation context are transmitted to AI model and voice providers acting as our processors, solely to generate a response to you.

We do not authorize these providers to use your content to train their public models.

We rely on the following categories of sub-processors: cloud hosting and database (Supabase); edge, CDN, and object storage (Cloudflare, including R2); AI model gateway (Lovable AI Gateway); voice synthesis (ElevenLabs); and, when enabled, payment processing (Paddle).

An up-to-date list is available on request.

We use strictly necessary cookies and local storage to keep you signed in, remember your theme and language, and stabilize your session (including a randomly-generated performance session identifier). We do not use advertising or cross-site tracking cookies.

Chat history and agent data: retained while your account is active; deleted on account deletion.

Performance samples (RUM): up to 90 days.

Rate-limit event counters: up to 7 days.

Email suppression records (bounces, complaints, unsubscribes): retained indefinitely to protect deliverability.

Cached TTS audio: retained while the underlying content is in active use; purged on request.

Subject to applicable law, you may request access, correction, deletion, portability, or restriction of your personal data, and object to processing based on legitimate interests. You may withdraw consent where processing is based on consent.

To exercise your rights, contact privacy@billionx.ai. You can also delete your account from the in-app profile page, which triggers deletion of your personal data associated with the Service.

You have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO) — ico.org.uk. If you are in the EEA, you may complain to your local data-protection authority.

Our providers may process data in the United Kingdom, the European Economic Area, the United States, and other regions. Where required, transfers outside the UK or EEA rely on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or another lawful transfer mechanism, together with any supplementary measures required by applicable law.

The Service is not intended for children under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.

We use industry-standard safeguards, including Row-Level Security on our database, authentication-gated audio delivery via short-lived presigned URLs, application-level rate limiting, and encryption at rest and in transit provided by our infrastructure providers.

No system is perfectly secure. You are responsible for protecting your account credentials.

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO (and, where required, other supervisory authorities) within 72 hours of becoming aware of the breach, and will notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app notice. Continued use of the Service after the effective date constitutes acceptance.

Privacy inquiries: privacy@billionx.ai.

Registered office: BillionX AI Ltd, [Registered office address, United Kingdom]. Company number: [UK Companies House number].