XOi Privacy, AI & Compliance Overview

Introduction

XOi is committed to protecting personal data and maintaining transparency regarding how personal information is collected, processed, stored, and secured within our platform. This whitepaper is intended to provide enterprise customers with a transparent overview of how XOi approaches privacy, AI and regulatory compliance. 

This document is designed to support customer risk assessments, vendor due diligence, and compliance reviews, and should be read in conjunction with XOi’s Subscription Agreement, Privacy Policy and data processing agreement.

‍

Product Overview

XOi is a data intelligence platform designed for organizations that install, maintain, service, and manage critical equipment throughout its lifecycle. XOi helps field service teams capture operational information from the jobsite, enrich that information with asset intelligence, and transform it into actionable insights for technicians, operations teams, sales teams, and business leaders.

Through its Field Solutions and Advisory Solutions offerings, XOi enables customers to collect and organize equipment data, photos, documentation, inspections, and service records, enrich that information with structured asset intelligence, and leverage analytics and AI-powered capabilities to support maintenance, operational efficiency, capital planning, and equipment lifecycle management.

Overall, XOi's platform is designed to improve visibility into asset performance, standardize field workflows, and help customers make more informed decisions based on equipment and operational data collected across the service lifecycle.

‍

XOi’s Approach to Privacy Compliance

Overview of the Personal Data XOi Processes

The personal data processed by XOi varies depending on how a customer configures and uses the services. In general, XOi may process the following categories of personal data:

• User Account Information (aka “Company Data”): This includes personal data such as names, job roles, business email addresses, and phone numbers used to validate eligibility, provision and manage user accounts, and provide support and maintenance.
• Data collected from users through their interactions with the XOi application (aka “User Data”): This includes the following categories of data: 
  
  • User-Generated Content, including photos, videos, notes, audio recordings, transcripts, work summaries, inspection responses, and other information submitted through the platform.
  • Collaboration Information, such as contact information used to facilitate communication and troubleshooting between users.
  • Application Usage and Technical Information, including device information, IP addresses, browser and operating system information, application interactions, and service usage data.
  • AI-Related Content, including information processed through AI-powered features such as work summaries, transcription capabilities, and benchmarking. This may typically include audio-visual information (such as photos/images/videos), technician notes, survey responses and other information contained within job records.

Certain content submitted by users, including photos, videos, audio recordings, and free-text responses, may contain personal information depending on how the services are used.

For a complete description of the categories of personal information processed, the purposes of processing, and applicable rights and choices, please refer to XOi's Privacy Policy.

XOi’s Data Processing Role

Under most privacy laws, there are two key parties each with a separate set of compliance responsibilities: 

• The Data Controller: The data controller decides why and how personal data is processed and is the entity that is the principal subject of the obligations imposed by the applicable data protection laws. Many of these obligations apply from the moment this entity starts to collect personal data about individuals. 
• The Data Processor: In contrast, the data processor is essentially a subcontractor to the data controller, processing personal data on behalf of and upon instruction from the data controller. 

XOi may act either as a Data Processor or an independent Data Controller, depending on the nature of the personal data and the processing activities:

• Customer is the Data Controller and XOi is the Data Processor for personal data used to validate eligibility for the services, facilitate billing, provide support and maintenance, and for additional processing requests such as analytics via automated integrations, collectively, “Company Data”, as defined under the Subscription Agreement.
• XOi is a Data Controller for all personal data collected from users through their interactions with the XOi application and services, collectively, “User Data”, as defined under the Subscription Agreement.

Data Hosting and Storage

Customer and User Data is hosted within Amazon Web Services (AWS) infrastructure located in the United States (US-East-1).

For customers located in the UK or European Economic Area (EEA), use of XOi services may result in the transfer of data outside the location in which data was initially collected.  Upon request, XOi will utilize the EU Standard Contractual Clauses (SCCs) and the UK Addendum, where appropriate for transfers from the UK, EU or onward transfers to third-countries. The SCCs and UK Addendum can be incorporated into the Data Processing Addendum XOi signs with its customers.

Third-party Risk Management

XOi maintains a third-party risk management program to evaluate vendors before they are engaged to process personal data or support product functionality. Prospective vendors undergo security and privacy reviews, including completion of due diligence assessments. Vendors that process Company and User Data in connection with the services sign DPAs which impose provisions for safeguarding data that are equivalent to those XOi executes with its customers. Our current list of subprocessors can be found on our Customer Trust Centre.

Data Retention and Deletion

Data is retained for the duration of the customer's subscription and in accordance with applicable contractual commitments and XOi’s internal procedures.

Following termination of services, customers may request an export of their data within the period specified in their Subscription Agreement. Following the expiration of that period, XOi may securely delete customer data from its systems. Customers may also submit requests for deletion of their data by emailing compliance@xoi.io, which are processed through established internal procedures, within thirty (30) days of receipt of such request.

Security measures

XOi implements administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, use, disclosure, alteration, or destruction. XOi complies with SOC 2 and undergoes an annual third party audit to evaluate the design and operating effectiveness of our controls, providing assurance that data is protected through robust operational practices.

More details about our security measures can be found on our Customer Trust Centre.

Data Subject Rights Management

We will respond to data subject rights requests we receive for User Data as an independent data controller, in accordance with our obligations under data protection laws. 

For requests related to Company Data, we will promptly notify the customer in accordance with our contractual obligations and provide reasonable assistance to enable the customer to fulfill its obligations to the data subject as the data controller.

‍

XOi’s Approach to Responsible Use of AI

Overview of AI features

Certain XOi features incorporate artificial intelligence and machine learning capabilities to improve efficiency and user experience. Below is an indicative list of the various features/functionalities that make use of AI/ML; not all features collect and process personal data:

• Work Summaries: Your organization admin may configure the application to require users to submit a work summary before completing a workflow. The summary may be provided manually or generated automatically using AI. When users complete all required workflow steps and select the auto-generate summary option, the application will create a clear and comprehensive summary based on the responses provided by users in those workflow steps. 
• Transcription: Your organization admin may build steps and features within the application to include video transcription. When available, the application creates a transcript by pulling the audio from the video that users provide/upload. 
• AI-assisted site survey and Smart Capture: This replaces manual, time-consuming site assessments with guided capture using photos, voice transcription, and OCR dataplate scanning. During a survey or service call, when a technician or salesperson points their camera at a piece of equipment, Smart Capture instantly reads the physical nameplate via Optical Character Recognition (OCR) to extract the make, model, and serial number. Once Smart Capture pulls the serial number, the broader Site Survey intelligence kicks in to auto-populate up to 100+ deep data fields (like unit age, capacity, and refrigerant type) and structure voice notes into organized reports. These features power the Quote Builder that turns the data collected on-site into a live foundation for creating fast, accurate proposals.
• Intelligent issue identification and classification: AI may assist in identifying and classifying equipment issues based on job notes, technician observations, and other operational information provided by users.
• Knowledgebase access: The system uses AI to deliver the right information to the technician at the right time. Smart Search enables rapid access to manuals, service bulletins, and previous job history right in the field. 
• AI Benchmarks: Where your organization has purchased an appropriate license, you may be able track the time users are saving using AI and compare AI adoption per user.

AI Service Provider

XOi utilizes enterprise-grade AI services through various AI enterprise offerings (including OpenAI and Gemini), to support certain AI-powered features. XOi maintains contractual agreements with its AI service provider that include appropriate confidentiality, security, and data protection commitments.

Data submitted for AI processing is used solely to provide the requested functionality. XOi does not permit its AI service provider to use data to train or improve their general-purpose AI models. AI processing is performed in accordance with XOi's security and privacy controls and applicable contractual commitments.

AI Disclosure and Transparency

AI features that may process personal data, such as Work Summaries are labeled via tooltips as AI generated with the product experience and users are prompted to review and edit, as needed, before submission.

Human Oversight

Where applicable, AI-generated outputs are subject to user review and validation. Customers remain responsible for reviewing and confirming information before relying on AI-generated outputs for operational decisions. For AI Work Summaries and Smart Capture, the user has the ability to review the output, edit it if necessary and approve it. The result of processing the photos and transcriptions results in certain fields being populated and visible within the application. The user has the ability to view and change those values.

Data Quality and Accuracy Controls

• Grounding in manufacturer specifications: Instead of letting the AI "guess" data points based on general knowledge, XOi enriches the fields with pre-verified specifications (e.g., exact refrigerant types, filter sizes, and heating capacities) from the manufacturer.
• Context-constrained AI summaries: AI-generated work summaries are based exclusively on information documented within the workflow, including completed steps, selected responses, captured photos, and technician-provided inputs. By limiting the information available to the AI to the documented job record, XOi reduces the likelihood of generating unsupported or irrelevant content.
• Human-curated classification and validation: To improve classification accuracy and reduce the likelihood of incorrect AI-generated outputs, XOi uses human-curated examples and domain-specific prompts that provide context regarding common equipment issues. These examples are periodically reviewed and updated. XOi also evaluates model performance against validated datasets and, where applicable, provides users with the ability to review and modify AI-generated outputs before they are finalized.

Customer Control Over AI Features

Customers can maintain control over the use of certain AI-enabled functionality. Available controls include:

• Disabling AI Work Summaries
• Disabling Issue Identification features
• Using manual entry workflows instead of Smart Capture
• Reviewing, editing, approving, or deleting certain AI-generated outputs

Available controls may vary depending on product configuration and feature availability.

‍