Vendor record · x.ai
What xAI promises about your data.
Where xAI publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
We watch x.ai/legal/subprocessor-list for xAI's sub-processor list, but our latest reading found 1 named sub-processors where an earlier reading of the same page found 24, so we are holding it back for a person.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
When it adds a sub-processor, its clause at x.ai/legal/data-processing-addendum (read October 12, 2026) gives you 15 days to object.
- Window
- 15
- Pages
- 6
- Copies
- 54
days to object when it adds a sub-processor
pages we watch
dated copies of all its pages, since August 31, 2026
xAI DPA
xAI's data processing agreement is at x.ai/legal/data-processing-addendum; we last read it on October 13, 2026, and a later attempt returned HTTP 429. xAI's data processing agreement gives 15 days to object to a new sub-processor. Here is the clause, from our October 12, 2026 copy:
15
days to object
“You may object on reasonable grounds relating to data protection to our engagement of any new or replacement Subprocessor by informing us in writing within fifteen (15) days after receiving notice.”
Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that xAI published it.
x.ai/legal/data-processing-addendum · read 2026-10-12 · fingerprint 2af5328469400f1b…
xAI sub-processors
We watch x.ai/legal/subprocessor-list for xAI's sub-processor list, and our latest reading found 1 named sub-processors where an earlier reading of the same page found 24, so we are holding it back for a person.
Every public change we have recorded · Where vendors publish their lists
How long xAI keeps your data
Two statements on retention, quoted from its own pages. xAI's privacy policy (x.ai/privacy-policy, in the copy read October 11, 2026) says: “For example, when Private Chat is turned on, conversations will not appear in your conversation history and your conversations will be deleted from SpaceXSI systems within 30 days unless it is necessary that they be kept longer for legal, compliance, or safety purposes.”
Retention
“Private Chat and User Content that you request to be deleted will be queued for deletion, which may take up to 30 days, except as required by law.”
x.ai/terms-of-service · read 2026-10-14
Training on customer data
“For details about our use of cookies, please read our Cookie Policy. * Google Apps Using Google OAuth: For users who opt to connect to Google Apps via Google OAuth, SpaceXSI shall not use any Google Apps content for any of its internal AI or other training purposes (such as training its machine learning models), including developing new products or services…”
x.ai/privacy-policy · read 2026-10-11
Training on customer data
“How we may disclose it: To our contracted service providers; in connection with business transfers, for legal purposes; to our related companies; and to third-parties with which you interact or share information. * Publicly Available Data: We use information that is publicly available on the internet to train our models and provide resulting Output.”
x.ai/privacy-policy · read 2026-10-11
Training on customer data
“(ii) improve our products and the Service and for our other business purposes, such as data analysis, customer and market research, developing new products or features, or identifying or displaying usage or User Content trends; and (iii) perform such other actions to enforce these Terms, comply with our Privacy Policy, comply with applicable law or governmental, court, and law enforcement request…”
x.ai/terms-of-service · read 2026-10-14
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Laws the trust page names · GDPR · HIPAA
Retirements announced · every vendor's retirements
2026-09-21
Models shows a rate-limits unlock banner, and the old Settings rate limits page is retired
2026-09-21
Realtime voice rate display updated after retiring the think-fast-1.0 floor
The pages' own stamps: Last updated 2026-09-30 · previous version · previous version · previous version · Updated 2026-10-12
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What xAI does not publish where we can read it
Of the 6 public pages we watch for xAI, these give us nothing right now.
Model or system card
the page at that URL is not that document
x.ai/docs/modelsSub-processor list
our latest reading found 1 named sub-processors where an earlier reading of the same page found 24, so we are holding it back for a person
x.ai/legal/subprocessor-listBefore you conclude anything
This only means we couldn’t read it on a public page. xAI may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates xAI. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at xAI? With an email at x.ai you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is xAI in your product? Hear the morning we read a change.
You get the lines that moved, in xAI’s own words, and the date any window closes. No card. Nothing to cancel.