1. Overview

This notice explains the rights available to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA/CPRA”), with respect to Xheight () and its product Aion, available at xheight.ai.

We take a privacy-protective approach by design. Aion is built for a sensitive user population, and we treat personal information, and in particular biometric information, accordingly.

2. We Do Not Sell Your Personal Information

Xheight does not sell personal information, and we do not sell biometric information, for monetary or other valuable consideration. We have not sold personal information in the preceding twelve months, and we do not intend to do so.

• We do not sell biometric identifiers or biometric information, including face or voice embeddings. Biometrics are encrypted and are never sold, licensed, or disclosed for value.
• We do not sell precise geolocation, audio, visual, or other personal information collected through Aion.
• We do not operate an advertising business model that depends on monetizing your personal information.

3. We Do Not Share Your Personal Information for Cross-Context Behavioral Advertising

Under the CCPA/CPRA, “sharing” refers to disclosing personal information to a third party for cross-context behavioral advertising, whether or not for money. Xheight does not share personal information for cross-context behavioral advertising.

• Aion does not run behavioral or targeted advertising, and we do not build advertising profiles about you.
• We do not use advertising trackers or advertising identifiers to follow you across other websites, apps, or services.

4. Analytics Are Opt-In and Off by Default

Product analytics are strictly opt-in and are turned off by default. We collect user-facing product analytics only where you have affirmatively enabled them in your privacy settings.

• Analytics are not used for advertising, ad targeting, or cross-context behavioral advertising.
• Analytics events are sanitized to exclude personal identifiers such as email, name, phone, precise location, raw transcripts, recognized text, and biometric properties.
• We do not conduct session replay or in-product surveys, in order to protect the privacy of blind and low-vision users.

5. Global Privacy Control (GPC) Signals

We honor opt-out preference signals, including the Global Privacy Control (GPC). When your browser or device transmits a recognized GPC signal, we treat it as a valid request to opt out of the sale and sharing of personal information for the relevant browser or device, without requiring you to submit a separate request.

Because we do not sell or share personal information for cross-context behavioral advertising, honoring a GPC signal does not change how your data is treated; your information is already excluded from sale and sharing.

6. Limits on the Use of Sensitive Personal Information

The CCPA/CPRA gives you the right to limit the use and disclosure of sensitive personal information. For Aion, sensitive personal information includes biometric information processed to uniquely identify a person and precise geolocation.

• We use sensitive personal information only to provide and secure the features you request, and for purposes permitted under the CCPA/CPRA that do not require the right to limit.
• We do not use or disclose sensitive personal information to infer characteristics about you for advertising or profiling.
• Biometric information is encrypted, pseudonymized, and never sold or shared.

7. How to Exercise Your Rights

Even though we do not sell or share personal information, you may confirm your preferences or submit a request at any time.

• Email support@xheight.com with the subject line “Do Not Sell or Share.”
• Enable the Global Privacy Control (GPC) in a supported browser or extension.
• Review and adjust the privacy controls available within the Aion product settings.

You may use an authorized agent to submit a request on your behalf. We will not discriminate against you for exercising any of your privacy rights.

8. Related Notices and Contact

For more detail, please review our Privacy Policy, our Data Rights notice, and our Biometric Policy.