AI Usage Policy

1. Introduction

XenoDATA uses artificial intelligence to enhance the data governance experience for our customers. AI-powered features are designed to augment human decision-making, not replace it. Every AI-generated output within our platform is subject to human review and approval before it becomes part of your organization's data governance program.

We are committed to responsible AI use, transparency in how AI processes your data, and providing you with meaningful control over AI-assisted features within your account. This policy supplements our Privacy Policy and Terms of Service.

2. AI Features

XenoDATA offers two distinct AI capabilities within the Data Workbench platform:

AI Steward

The AI Steward provides automated governance assistance to help teams build and maintain their data governance programs more efficiently. Specifically, the AI Steward can:

• Generate definitions for glossary terms based on your account's industry context and existing governance content
• Suggest reference data classifications and mappings relevant to your organization
• Analyze survey results to identify governance maturity patterns and areas for improvement
• Recommend data use cases based on industry benchmarks and your organization's data landscape

All AI Steward outputs are presented as suggestions. Results are always human-reviewable before they are applied to your governance records. Users may accept, modify, or reject any AI-generated content.

Fractional CDO (Advisory AI)

The Fractional CDO is a strategic data leadership assistant designed for data leaders and authorized users who need executive-level governance insights. This feature can:

• Analyze meeting notes and advisory session content to extract key themes and action items
• Synthesize organizational insights including wins, maturity assessments, and SWOT analyses
• Generate presentation-ready summaries of data governance progress and strategic recommendations
• Provide chat-based advisory for data governance strategy questions, informed by your organization's context

The Fractional CDO is available only to data leaders and users explicitly authorized by the account administrator. All advisory outputs are stored as supplementary analysis, not as system-of-record data.

3. Third-Party AI Providers

XenoDATA uses OpenAI's API to power its AI features. When you use an AI-powered feature, relevant data from your account is sent to OpenAI's API for processing and the generated response is returned to the XenoDATA platform.

Important details about our use of OpenAI:

• Enterprise API only: We use OpenAI's enterprise API exclusively. We do not use consumer-facing ChatGPT or any other consumer AI products to process your data.
• No model training on your data: Per OpenAI's API data usage policies, data submitted through the API is not used to train or improve OpenAI's models.
• Data processing agreement: We maintain a data processing agreement (DPA) with OpenAI that governs how your data is handled during AI processing.
• Encryption in transit: All data transmitted to and from OpenAI's API is encrypted using industry-standard TLS encryption.

For more information about OpenAI's data handling practices, please refer to OpenAI's Enterprise Privacy page.

4. Data Processing

When AI features are used, only the minimum data necessary to generate a relevant response is sent to the AI provider. All AI requests are scoped to your account's data only and are isolated from other customers' data.

Data That May Be Sent for AI Processing

• Account industry classification and organizational context
• Model names, definitions, and descriptions (e.g., glossary terms, data asset names, use case descriptions)
• Meeting notes and advisory session content (Fractional CDO feature only)
• Culture scores and organizational maturity indicators
• Survey responses and governance assessment results

Data That Is Never Sent for AI Processing

• Personally identifiable information (PII) of end users, including names, email addresses, and contact details
• Passwords, authentication tokens, session identifiers, or security credentials
• Billing data, payment information, or financial records
• Files uploaded to the platform (documents, spreadsheets, attachments)
• Data from other customers' accounts

5. Data Retention

AI-generated content that you accept and apply within the platform is stored as regular platform data within your account. This includes generated glossary definitions, analysis reports, advisory summaries, and other outputs. This data is subject to the same retention policies as all other data in your account, as described in our Privacy Policy.

Prompts sent to the AI provider and the raw responses returned are not separately logged, stored, or retained by XenoDATA beyond the duration of the immediate API call required to deliver the feature.

OpenAI retains API request data for up to 30 days solely for the purpose of monitoring and preventing abuse of their services, after which it is deleted. OpenAI does not use this data to train or improve their models. For current details on OpenAI's data retention practices, please refer to their Enterprise Privacy documentation.

6. Human Oversight

XenoDATA is designed with human oversight as a core principle. AI features are assistive tools that support human decision-making, not autonomous agents that take actions on your behalf.

• Clear labeling: All AI-generated content within the platform is clearly identified with an "AI Generated" indicator so users can distinguish between human-authored and AI-assisted content.
• Review before application: AI Steward results are presented as suggestions that must be explicitly accepted by a user before they are applied to governance records. No AI output is automatically committed to your data.
• Revert capability: AI-generated content that has been accepted can be subsequently modified or removed by authorized users at any time.
• Advisory classification: Fractional CDO analyses and recommendations are stored as advisor outputs and are clearly distinguished from system-of-record governance data.
• Full user control: Users maintain complete authority to accept, modify, or reject any AI-generated suggestion at any stage of the workflow.

7. Opt-In and Access Control

AI features within XenoDATA are not enabled by default. Access is governed by the following controls:

• Account-level enablement: AI Steward and Fractional CDO features must be explicitly enabled at the account level by an account administrator before any AI processing can occur.
• User-level authorization: Individual user access to AI features is granted by the account administrator or designated data leader. Users who have not been granted access cannot trigger AI processing.
• Feature-specific permissions: AI Steward and Fractional CDO access are controlled independently. An account may enable one feature without enabling the other.
• No passive processing: AI features are invoked only when a user explicitly initiates an AI-assisted action (e.g., clicking a "Generate" button or submitting a query). No data is sent to AI providers in the background or as part of routine platform operations.

Account administrators can disable AI features at any time. Disabling a feature immediately prevents any new AI processing requests from being initiated. Previously generated and accepted content remains in the account as regular platform data.

8. Your Rights

You have the following rights with respect to AI processing within XenoDATA:

• Right to disclosure: You may request a summary of what AI processing has occurred on your account's data, including the types of features used and the categories of data processed.
• Right to deletion: You may request deletion of AI-generated content stored within your account. Account administrators can also delete AI-generated content directly within the platform.
• Right to disable: You may request that AI features be disabled for your account at any time. Account administrators can disable AI features immediately through account settings.
• Right to human alternative: All tasks that can be performed by AI features can also be performed manually by users. AI features are supplementary and never required to use the platform.

To exercise any of these rights, please contact us at support@xenodata.com or reach out to your account administrator. We will respond to requests within the timeframes required by applicable law.

9. Limitations and Disclaimers

AI-generated outputs are advisory in nature and are provided on an "as is" basis. Please be aware of the following limitations:

• AI outputs should not be treated as definitive data governance decisions. They are intended as starting points for human review and refinement.
• XenoDATA does not guarantee the accuracy, completeness, correctness, or suitability of any AI-generated content for your specific organizational needs.
• AI-generated definitions, recommendations, and analyses may contain errors, omissions, or suggestions that are not appropriate for your context. Human review is strongly recommended before acting on any AI suggestion.
• AI features rely on third-party AI providers and may be subject to service interruptions, changes in capability, or modifications to third-party terms that are outside XenoDATA's control.
• The quality of AI outputs depends in part on the quality and completeness of the data in your account. Incomplete or inaccurate input data may result in less useful AI suggestions.

XenoDATA shall not be liable for any decisions made or actions taken based on AI-generated content. Users and organizations are solely responsible for evaluating and validating AI outputs before incorporating them into their data governance programs.

10. Changes to This Policy

We may update this AI Usage Policy from time to time to reflect changes in our AI capabilities, data processing practices, third-party providers, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and, where required by law, provide additional notice (such as by email or through a prominent notice on our website). We encourage you to review this AI Usage Policy periodically.

11. Contact Us

If you have questions, concerns, or requests regarding this AI Usage Policy or our use of artificial intelligence, please contact us: