xray — Privacy Policy

Effective Date: 2026-07-08
Operator: LLM Works LLC, a Tennessee limited liability company
Contact: support@llm-works.ai

1. Overview

This Privacy Policy describes how LLM Works LLC ("we") collects, uses, retains, and shares information in connection with the xray research service ("the Service"). We designed xray with the discipline of collecting only what the Service needs to operate. This document explains what that is.

By using xray, you consent to the practices described here. If you do not agree, do not use the Service.

2. Information We Collect

a) Account information. When you create an account we collect:

• Your email address.
• Your name and profile picture, if provided by your sign-in provider (see Subprocessors for the current list of supported providers).
• A user identifier assigned by our authentication provider.

b) Research content. When you use the Service we collect and store:

• Research questions you submit.
• Session parameters (e.g., budget).
• Findings, entities, sources, and confidence data returned by the Service.
• Your persistent per-user knowledge graph (isolated from other users).

c) Billing information. When you purchase credits:

• Payment records (amount, timestamp, order ID).
• Payment-method details are handled by a third-party payment processor (see Subprocessors) and are not stored by us.

d) Operational data. We collect standard operational logs including request timestamps, IP addresses (for security and abuse detection), user-agent strings, and error events. These are retained on a short, rolling basis.

We do not collect:

• Precise geolocation.
• Sensitive personal information such as health data, government-issued IDs, or financial credentials, except payment card details which are handled by our payment processor under its own terms (see Subprocessors).
• Third-party analytics fingerprints or advertising identifiers.

3. How We Use Information

We use collected information only to:

• Operate the Service (execute research sessions, deliver results, maintain your knowledge graph)
• Manage your account, sessions, and credit balance
• Process purchases and refunds
• Detect and prevent abuse, fraud, and security incidents
• Communicate service-critical notices (billing, security, terms changes)
• Improve reliability and quality of the Service via aggregated operational metrics

We do not:

• Use your queries or research outputs to train machine-learning models
• Sell, rent, or share your information with data brokers or advertisers
• Serve advertising, whether first- or third-party
• Combine your information with data from external tracking sources for profiling

4. Third-Party Service Providers

xray operates on infrastructure and services provided by third parties (for example, large-language-model inference, web-search infrastructure, authentication, payment processing, and application hosting). Information necessary for their function passes through them.

The current list of providers, what each is used for, and what data reaches each is published at xray.llm-works.ai/subprocessors and updated when providers are added, removed, or replaced. Each provider processes data under its own privacy terms; we select providers whose terms are consistent with the practices described in this Policy.

We will notify registered account holders by email at least thirty (30) days before adding, replacing, or materially expanding the scope of a subprocessor that processes personal data. You may terminate your account before the change takes effect if you do not agree.

5. Data Retention

• Account records are retained for the life of your account
• Session content, findings, and knowledge graph are retained for the life of your account so you can return to prior research
• Operational logs are retained on a short rolling window (typically thirty days) for security, abuse detection, and reliability
• Payment records are retained as required by applicable financial and tax law

On account termination, session content and your knowledge graph are deleted within thirty (30) days unless a longer retention period is required by law. Payment records may be retained per applicable law.

6. Data Sharing

We do not sell your information. We share information only:

• With the third-party providers listed in §4, only to the extent necessary for the Service to function
• With law enforcement or regulators, if required by valid legal process
• In connection with a merger, acquisition, or asset sale, in which case successor obligations to this Policy apply
• With your explicit consent for any other purpose

7. Your Rights

You may exercise the following actions by the means provided by the Service, or by contacting support@llm-works.ai:

• Access the account information and research content associated with your account.
• Export your research content.
• Delete your account and associated content; deletion is completed within thirty (30) days.
• Correct inaccurate account information.
• Object to specific processing activities where applicable law provides such rights.

For users in jurisdictions with additional statutory rights (including but not limited to the EU/UK GDPR and California CCPA/CPRA), you may exercise those rights by contacting privacy@llm-works.ai.

A data-processing agreement (DPA) is available on request for enterprise customers processing personal data through xray.

8. Security

We employ commercially reasonable safeguards to protect account and session data, including:

• Transport encryption (TLS) for all network traffic
• Per-user data isolation in the knowledge graph
• Access controls on internal systems
• Authentication managed by a specialized identity provider.
• Restricted secrets handling for third-party integrations

No system is fully secure. If we become aware of a security incident that materially affects your data, we will notify affected users as required by applicable law.

9. Cookies and Tracking

We use only the cookies necessary to operate the Service: authentication session cookies and account-preference storage. We do not use advertising cookies, cross-site tracking pixels, or third-party analytics that fingerprint users.

10. Children

The Service is not intended for and may not be used by individuals under 18 years of age. We do not knowingly collect information from users under 18. If you believe we have collected such information, contact support@llm-works.ai and we will delete it.

11. International Users

The Service is operated from the United States. If you access the Service from another country, you understand that your information may be processed in the United States and other jurisdictions where our providers operate.

For users in the EU/UK/EEA, processing may include transfers governed by standard contractual clauses or equivalent transfer mechanisms operated by our providers.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted at this URL and communicated to registered account holders by email. The Effective Date at the top of this document reflects the most recent revision.

13. Contact

Privacy-related questions or requests (access, export, deletion, correction, DPA inquiries): - Email: privacy@llm-works.ai - Postal:

You may also use support@llm-works.ai for any privacy-related inquiry; we will route it accordingly.

This Policy covers xray specifically. Other services operated by LLM Works LLC are governed by their own privacy terms.