Your data, for impact.

XG is an environmental-intelligence platform. We connect the people who face environmental and ESG challenges (“Seekers”) with the regulations that bind them, the vendors who can help, and the moves that matter. This policy covers personal data we process across XG Atlas and XG Hub for our ten stakeholder types: Seekers, Providers, Consultants, Investors, Academics, Implementors, Regulators, Insurers, Communities, and Data Partners.

We don’t hide behind “we collect information to improve our services.” Here is the actual map: each category, the data in it, and what it is used for. (Retention is in §8; legal basis in §4.)

Every data point exists to do one job: match you to the regulations, vendors and moves that reduce environmental harm and risk. We charge a platform fee for making that connection. We do not sell your data, and we do not build advertising profiles. The connection is the product — your data is the input, not the inventory.

For business-to-business matching, our basis is legitimate interest (connecting organisations to relevant environmental solutions), balanced against your rights and documented in an internal Legitimate Interest Assessment. For optional marketing, our basis is your consent, which you can withdraw at any time. Where the law requires consent for a specific processing activity, we ask for it separately and specifically.

XG’s matching engine (“the Brain”) performs automated profiling under GDPR Article 22: it classifies your organisation, routes jurisdictions, and ranks regulations and vendors. We disclose the logic — your industry and jurisdiction drive which regulations are retrieved; relevance and applicability drive the ranking; nothing is hidden behind a black box. You can request human review of any automated output, contest it, and get an explanation. No automated decision produces a legal effect on you without that route available.

You can, at any time and free of charge:

• Know what we hold about you and get a copy (access & portability).
• Correct anything wrong (rectification).
• Delete your data (erasure), subject to legal retention duties.
• Object to processing based on legitimate interest, and opt out of automated decisions.
• Withdraw consent for marketing with one click.
• Complain to your data protection authority (e.g. the ICO, your EU DPA, or the California Privacy Protection Agency).

We do not sell personal data. Under California’s CPRA, “sharing” is broader than “selling” — and connecting one stakeholder to another could be read that way. So we say it plainly: we share your details with another party only to make a match you are seeking, and you can opt out. To exercise a “Do Not Sell or Share My Personal Information”request, email privacy@xge.ai — and we honour it globally, not just in California.

We keep each category only as long as it serves its purpose, then delete or anonymise it. As a guide: account data for the life of your account plus 12 months; challenge and brief data for up to 24 months; security and access logs for up to 12 months; marketing data until you opt out. We review these periods regularly and shorten them wherever we can.

XG’s data is hosted with our cloud infrastructure providers (Supabase and Vercel). Where data moves across borders, we rely on appropriate safeguards (e.g. Standard Contractual Clauses, the UK addendum, and equivalent mechanisms) so your protections travel with it.

Encryption in transit and at rest, role-based access, row-level security, audited admin access, and an incident process with breach notification within the legally required window (72 hours under GDPR). No system is perfectly secure, but security is treated as foundational — XG is built to help run the energy sector, and we hold ourselves to that standard.

If we make a material change, we’ll tell you before it takes effect and update the date at the top. We won’t quietly weaken your rights.

Questions, requests, or a rights claim? Email our privacy team at privacy@xge.ai and a person will respond. This policy is governed by the laws of the jurisdiction in which XG Energy is established, and you can also complain to your local data protection authority.