Loxis Privacy Policy

1. Who we are and what this policy covers

This Privacy Policy explains how Loxis.AI ("Loxis," "we," "us," or "our") collects, uses, discloses, retains, and protects personal data in connection with our websites and online pages that link to this policy, QuickPlan, our behavioral surveys, our software platform, and related products and services (together, the "Services"). References to "personal data" include "personal information" and similar terms under applicable law.

It applies to visitors to our websites and marketing pages, prospective customers and people who contact us, people who create accounts directly with Loxis (including free QuickPlan accounts), individual users who access the Services on behalf of a customer organization (such as account administrators, employees, contractors, applicants, managers, and other end users), and personal data contained in or generated from content submitted to the Services.

It does not cover third-party websites, products, or services that we link to but do not control. It also does not cover Loxis personnel or job applicants, who should receive a separate workforce or applicant privacy notice, if applicable.

2. Controller and processor: the roles we play

Loxis handles personal data in different legal roles depending on the relationship, data, and processing activity. The applicable role affects who determines the purpose of processing and who is responsible for responding to privacy requests.

As a controller (or "business" under certain U.S. privacy laws), we decide why and how personal data is processed. This generally includes data about our own business relationships and operations, such as website visitors, prospects, billing contacts, people who create accounts directly with Loxis, and limited account, authentication, security, device, and service-administration data that we process for our own legal, security, and operational purposes. This Privacy Policy governs that process.

As a processor, service provider, or contractor, we process Customer Data on the documented instructions of a business customer. Customer Data may include organization structures, employee or contractor information, survey responses, goals, assignments, feedback, behavioral profiles, vitality and momentum readings, team analyses, and recommendations submitted to or generated through a customer-managed account. For that data, the customer generally determines the purposes and means of processing, and our processing is governed by the customer agreement and Data Processing Agreement. If you use a customer-managed account and have questions or wish to exercise privacy rights regarding Customer Data, please contact the organization that gave you access.

The same person may have data processed in both roles. For example, Loxis may process a user's survey responses and resulting profile on the customer's behalf while separately processing the user's login, device, security, and support information as a controller.

3. Personal data we collect

The table below describes categories of personal data that we may collect. Our legal role depends on the context. For a direct user, a category may be controller data; for a user of a customer-managed account, the same category may be Customer Data processed on the customer's behalf.

The Services are not designed to collect medical records, government-issued identifiers, precise geolocation, or biometric identifiers unless Loxis has expressly disclosed and agreed to that processing. However, survey responses, free-text content, satisfaction or energy information, and profiles or inferences may reveal or be treated as sensitive personal data depending on their content, use, and the applicable law. Do not submit sensitive personal data unless you or your organization are authorized to do so and any required notices, consents, and safeguards are in place.

4. How and why we use personal data

Where the GDPR, UK GDPR, or similar laws apply and Loxis acts as controller, we rely on a lawful basis for each use of personal data. When Loxis acts as processor, the customer determines the applicable legal basis and instructs Loxis through the customer agreement and Data Processing Agreement.

In jurisdictions that use a different framework, such as the United States, we process personal data for the corresponding business and commercial purposes described above.

Marketing choice

You can opt out of marketing at any time using the unsubscribe link in a marketing email or by contacting us at privacy@loxis.ai. Opting out of marketing does not stop essential account, security, transaction, or service messages.

5. Automated processing, behavioral profiling, and artificial intelligence

How the features work

The Services use rule-based analytics, statistical methods, artificial intelligence, and machine-learning tools to organize and analyze inputs such as survey responses, goals, organization data, progress information, feedback, and other content. Depending on the feature and account configuration, the Services may generate goal plans, trait positions, interaction patterns, behavioral profiles, vitality and momentum readings, team fit or alignment analyses, development indicators, alerts, coaching, and recommendations.

Profile visibility and customer use

In a customer-managed account, profiles, survey-derived results, goal information, and automated outputs may be visible to the customer's account administrators, managers, team members, or other authorized users as configured or directed by the customer. The customer determines who may access the information and how it is used within the customer's organization.

Human review and employment-related use

Loxis does not itself hire, promote, compensate, discipline, or terminate workers. The Services are intended to support, not replace, informed human judgment. Unless a separate legally compliant product notice and agreement expressly provide otherwise, customers must not use an automated output as the sole basis for hiring, promotion, compensation, discipline, termination, task allocation, performance evaluation, or another decision that produces legal or similarly significant effects. Customers are responsible for providing any required notices, human review, appeal or challenge process, and anti-discrimination safeguards.

AI and model providers; training

Loxis may use third-party AI or model providers as sub-processors to provide certain features. Those providers may receive the minimum data reasonably necessary to provide the relevant feature and are identified in our sub-processor list, which is available on request by emailing privacy@loxis.ai. Unless Loxis and a customer expressly agree otherwise in writing, Loxis does not use Customer Data to train generalized AI models or to create profiles for other customers, and Loxis requires its AI and model providers to process Customer Data only to provide services to Loxis.

Accuracy and limitations

Automated outputs are estimates or inferences and may be incomplete, inaccurate, or inappropriate for a particular context. Behavioral profiles and vitality or momentum readings are not medical, mental-health, or clinical diagnoses. Users and customers should review outputs in context and correct inaccurate source data.

Rights regarding profiling and automated decisions

Where applicable law provides rights concerning profiling or solely automated decisions, you may be entitled to information about the processing and its effects, access to relevant data, correction of inaccurate data, human review, an opportunity to express your view or contest a decision, or an opt-out. See Section 12.

6. Customer Data, where we act as a processor

When a business customer uses the Services, the customer and its authorized users may submit personal data, and the Services may generate personal data from that information (together, "Customer Data"). Customer Data includes the categories described in Section 3 and may include survey responses, goals, profiles, inferences, and automated outputs. We process Customer Data only on the customer's documented instructions to provide, secure, administer, and support the Services, and as required by law.

We do not sell Customer Data, use it for cross-context behavioral advertising, or use it for our own direct marketing. Unless the customer expressly agrees otherwise in writing, we do not use Customer Data to train generalized AI models or develop profiles for other customers. We may use data that has been aggregated or deidentified to analyze and improve the Services only if we maintain it in deidentified form and do not attempt to reidentify it.

Retention, return, deletion, security, data-breach notification, international-transfer, audit, and sub-processor commitments for Customer Data are set out in the applicable customer agreement and Data Processing Agreement.

7. Cookies and similar technologies

We use cookies and similar technologies to operate and secure the Services. Today these are strictly necessary only: session cookies used for authentication and session tracking, and cookies set by our content delivery and security provider. We do not currently use analytics, advertising, or cross-site tracking cookies, and we do not currently permit third parties to set non-essential cookies through the Services.

If we introduce analytics, advertising, or other non-essential technologies in future, we will update this policy and provide any consent mechanism, preference control, and opt-out required by applicable law before those technologies are used.

You can also control cookies through your browser or device settings. Blocking strictly necessary cookies may prevent you from signing in or using parts of the Services.

8. When and with whom we disclose personal data

We disclose personal data only as described below, as directed by you or a customer, or with your consent. The categories of recipients depend on the feature and context.

• Customer organizations and authorized users: for customer-managed accounts, to the customer organization and the administrators, managers, team members, or other users authorized by the customer, including as described in Section 5.
• Service providers and sub-processors: vendors that help us provide and operate the Services, such as cloud hosting, data storage, authentication, security, analytics, email, communications, customer support, and technical-service providers. They are contractually restricted to the purposes we specify. A current list of our sub-processors is available on request by emailing privacy@loxis.ai.
• AI and model providers: providers that support automated or generative features, subject to the limitations described in Section 5 and our sub-processor terms.
• Payment processors: to process payments, prevent fraud, and maintain transaction records.
• Analytics and advertising partners: analytics or marketing providers that receive website or campaign data, but only as disclosed in this policy and subject to applicable consent and opt-out rights.
• Professional advisors: lawyers, auditors, accountants, insurers, and other advisors where reasonably necessary.
• Corporate transactions: actual or proposed financings, investments, mergers, acquisitions, reorganizations, bankruptcies, or sales of assets, subject to appropriate confidentiality protections.
• Legal and safety: to comply with law or lawful process, respond to regulators, enforce agreements, investigate fraud or security incidents, or protect rights, safety, and property.
• At your or the customer's direction: integrations, exports, invitations, or other disclosures that you or the customer enable, request, or authorize.

Sale, sharing, and targeted advertising

We do not sell personal data for money. If our practices change, we will update this policy and provide any notice and opt-out mechanism required by law.

9. International data transfers

Loxis is based in Scottsdale, Arizona, United States of America (USA) and uses service providers located in the USA. Personal data may therefore be processed in jurisdictions that have different data-protection laws from the jurisdiction where you live. When required, we use a lawful transfer mechanism, such as an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another legally recognized safeguard.

You may request additional information about applicable transfer safeguards by contacting privacy@loxis.ai.

10. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, the customer agreement, or as required by law. In setting a retention period, we consider the amount, nature, and sensitivity of the data; the purposes and operational need; the risk of harm from unauthorized use or disclosure; applicable legal, accounting, and contractual requirements; and whether the purpose can be achieved by other means. At the end of the applicable period, we delete, deidentify, or anonymize the data.

Data may remain temporarily in encrypted backups or archives until those systems are overwritten in the ordinary course. We may retain data longer where reasonably necessary for a legal hold, dispute, security investigation, or other legal obligation, and will limit use during that period.

11. How we protect personal data

We maintain administrative, technical, and organizational safeguards designed to protect personal data. Depending on the system and data, these safeguards include encryption in transit and at rest, access controls, least-privilege access, logging, vendor review, personnel training, backup and recovery measures, and an incident-response process. Our safeguards are designed to address the nature of the data and the risks of processing, but no system is perfectly secure, and we cannot guarantee absolute security.

If you believe your account or personal data has been compromised, contact us promptly at privacy@loxis.ai.

12. Your privacy rights

Depending on where you live, the law and available exceptions may give you some or all of the rights below. These rights are not absolute, and we may decline or limit a request where permitted by law.

EEA, UK, and Switzerland

Access; rectification; erasure; restriction; data portability; objection, including to processing based on legitimate interests and to direct marketing; withdrawal of consent without affecting prior lawful processing; and the right to lodge a complaint with a supervisory authority.

California and other U.S. states

The right to confirm processing; know and access; delete; correct; obtain a portable copy; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal data; appeal a denied request; and receive equal service and pricing without unlawful discrimination for exercising privacy rights.

Profiling and automated decisions

Where applicable, you may also have rights to receive information about automated processing, access or correct the data used, opt out of certain profiling, obtain human review, express your point of view, or contest a decision.

How to exercise your rights

Contact us at privacy@loxis.ai. Describe the right you wish to exercise and the data or account involved. We will verify your identity using information reasonably related to the request and respond within the time required by applicable law, subject to permitted extensions. Where allowed, an authorized agent may submit a request for you, but we may require proof of authorization and identity.

Customer-managed accounts

If your request concerns Customer Data in a customer-managed account, we may direct the request to the customer that controls the account and assist the customer in responding. We will separately address any data for which Loxis acts as controller.

Appeals

If applicable law gives you a right to appeal our refusal to act on a request, you may appeal by replying to our decision or contacting privacy@loxis.ai with "Privacy Appeal" in the subject line. We will provide instructions for contacting the appropriate regulator if the appeal is denied.

Complaints

You may contact us with concerns using the details in Section 17. You may also complain to your local data-protection authority or, where applicable, a state attorney general or privacy regulator.

13. Additional California disclosures

This section applies to California residents only to the extent the California Consumer Privacy Act, as amended (the "CCPA"), applies to Loxis as a "business" for the relevant processing.

Categories collected

Depending on how you interact with the Services, we may collect the following CCPA categories: identifiers; customer-record information; commercial information; internet or other electronic-network activity; professional or employment-related information; sensitive personal information (such as account login credentials and any sensitive information contained in submitted content); and inferences drawn to create a profile. The examples, sources, and business or commercial purposes are described in Sections 3 and 4.

Categories disclosed

We may disclose these categories for business purposes to the categories of recipients described in Section 8, including customer organizations and their authorized users, service providers and sub-processors, payment processors, analytics providers, professional advisors, transaction counterparties, government or legal recipients, and integrations authorized by you or a customer.

Sale or sharing

We do not sell personal information for money.

Retention and rights

The retention criteria and periods are described in Section 10. California residents may exercise the applicable rights described in Section 12. Loxis will process opt-out preference signals where required by law.

Notice at Collection

Loxis also provides or links to a Notice at Collection at or before the point where it collects personal information when the CCPA requires a separate just-in-time notice.

14. Children's privacy

The Services are intended for business use and are not directed to children under 18. We do not knowingly collect personal data directly from anyone under 18. If you believe a child has provided personal data to us, contact us using the information in Section 17 and we will take appropriate steps to delete it, subject to applicable law.

15. Third-party links and services

The Services may link to or integrate with third-party websites, applications, and tools that we do not control. Their privacy practices are governed by their own notices and terms. Review those materials before directing the Services to disclose data to a third party or providing data directly to that third party.

16. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate or required by law, provide additional notice by email, through the Services, or at the point of collection. We will obtain consent before applying a materially different use to previously collected personal data where applicable law requires consent.

17. How to contact us

Questions, requests, and complaints about this policy or about how Loxis handles personal data can be sent to the address below.