Privacy Policy

Effective Date: September 21, 2026

Quikcharge LLC ("QuikCharge," "we," "us," or "our") operates XIBA, a security assurance platform that monitors infrastructure, identities, domains, and other security-related signals on behalf of organizations.

This Privacy Policy explains what personal information XIBA collects, how we use it, when we share it, how long we retain it, and the rights available to individuals.

1. Who This Policy Applies To

XIBA is operated by Quikcharge LLC.

Depending on how you interact with XIBA, QuikCharge may act in different roles.

Account Holders

Account holders are individuals who create an XIBA account, sign in to XIBA, or otherwise use the service directly.

For personal information that QuikCharge collects and uses to operate and administer an individual's XIBA account, QuikCharge generally acts as the controller or equivalent business under applicable privacy laws.

Monitored Individuals

Monitored individuals are employees, contractors, or other individuals whose accounts or security information appear in a directory or system that a customer connects to XIBA.

For personal information relating to monitored individuals that XIBA processes on behalf of a customer, QuikCharge generally acts as a processor, service provider, or similar role, while the customer organization determines the purposes and means of processing.

If you are a monitored individual and have a request concerning information provided to XIBA by your organization, you should generally contact that organization first. We will assist the organization as required by applicable law and our agreement with the customer.

2. Information We Collect About Account Holders

Depending on how you use XIBA, we may collect:

• Name, email address, and organizational role.
• Account credentials and authentication information.
• A password hash where password-based authentication is enabled. We do not store passwords in plaintext or in a form intended to be readable by us.
• Two-factor authentication secrets and single-use recovery codes where an account holder enables those features.
• Sign-in records, including the date and time of an attempted sign-in, authentication method, and whether the attempt succeeded.
• IP addresses associated with actions recorded in the audit log.
• Records of administrative actions performed in XIBA, such as connecting or disconnecting an integration, changing a security rule, adding or removing a user, changing account settings, or modifying a subscription.
• Communications submitted to us, including information provided when contacting support.

We do not use an IP address collected through XIBA to independently determine an individual's physical location unless expressly described elsewhere in this Privacy Policy.

3. Information We Collect About Monitored Individuals

When a customer connects an identity provider or other supported system, XIBA may receive information made available by that system based on the permissions and configuration selected by the customer.

Depending on the integration, this may include:

• Directory identifiers.
• User principal names or similar account identifiers.
• Display name.
• Account type.
• Account status, including whether an account is enabled or disabled.
• Multi-factor authentication information, such as registered authentication methods, available authentication capabilities, or whether stronger authentication is required.
• Sign-in and authentication events supplied by the customer's identity provider, which may include source IP address and, where provided by that identity provider, associated city, region, or country information.

Where location information is supplied by an identity provider, XIBA stores and displays the information supplied by that provider. XIBA does not independently perform a geolocation lookup to determine that location.

Information We Do Not Access

XIBA is designed to monitor security posture rather than the contents of an organization's communications or files.

Unless a customer separately enables a feature that expressly requires such access, XIBA does not access:

• Email or mailbox contents.
• Files or document contents.
• Private messages.
• Browsing history.
• The contents of communications stored within an organization's systems.

We request only the permissions reasonably necessary to provide the applicable XIBA functionality.

4. Other Information XIBA Handles

Depending on the services and integrations enabled by a customer, XIBA may process:

Monitored Assets

Information about assets that a customer asks XIBA to monitor, including domain names, web application addresses, network endpoints, device identifiers, configuration information, and the results of security or availability checks.

Support and Helpdesk Information

Where a customer connects a ticketing or helpdesk system, XIBA may receive ticket information submitted through that system.

Ticket content is provided by the customer's system and may contain information entered by the customer or its users. Customers are responsible for determining what information is submitted to XIBA through such integrations.

Integration Credentials

Credentials, tokens, API keys, or similar authentication information supplied by customers to connect supported integrations.

Integration credentials are encrypted using AES-256-GCM before being stored by XIBA. Once stored, credentials are not returned to the customer's browser in plaintext.

Billing Information

We may receive information about a customer's plan, subscription status, billing status, and monitored-user count.

Payment card information is submitted directly to our payment processor and is not received or stored by XIBA except for information necessary to identify and administer the associated transaction or subscription.

Operational and Technical Information

We collect operational logs and technical information generated through use and operation of the service. This may include timestamps, system events, error information, authentication events, diagnostic information, and similar information needed to operate, secure, troubleshoot, and improve the service.

5. Artificial Intelligence

XIBA may offer optional artificial intelligence functionality, including AI-assisted triage of helpdesk or support information.

When a customer enables an AI feature, information necessary to provide that feature may be transmitted to the AI provider selected or configured by the customer.

For example, where AI triage is enabled for a helpdesk integration, the content of a relevant support ticket, including information entered by the ticket's author, may be sent to the configured AI provider to generate a summary, classification, or suggested troubleshooting steps.

The applicable AI provider may process that information outside XIBA's systems. Customers are responsible for selecting and configuring the AI provider and should review the applicable provider's terms, privacy practices, security controls, and data-processing terms.

Where supported, customers may configure AI processing using a model hosted within their own environment. In that configuration, the applicable information may remain within the customer's environment rather than being transmitted to a third-party hosted AI provider.

QuikCharge does not use Customer Data submitted to XIBA to train its own artificial intelligence models. QuikCharge does not operate a general-purpose AI model trained on Customer Data.

AI-generated information is provided as an assistive output. It is not intended to constitute a determination about an individual, and XIBA does not use AI output to make automated decisions that produce legal or similarly significant effects about individuals.

6. Why We Process Personal Information

We process personal information for purposes including:

• Providing, maintaining, and administering XIBA.
• Authenticating users and managing accounts.
• Monitoring security posture, infrastructure, identities, domains, and other customer-configured assets.
• Detecting abuse, unauthorized activity, security incidents, and threats.
• Investigating and responding to security events.
• Providing customer support.
• Processing subscriptions and payments.
• Communicating with customers about service operation, security, account administration, and material changes.
• Troubleshooting, maintaining, and improving the reliability and security of the service.
• Complying with applicable legal and regulatory obligations.
• Establishing, exercising, or defending legal claims and protecting our rights, property, and safety.

Depending on the circumstances and applicable law, our legal bases may include performance of a contract, compliance with a legal obligation, legitimate interests, consent, or another lawful basis recognized by applicable law.

We do not sell personal information.

We do not share personal information for cross-context behavioral advertising and do not use personal information to create advertising profiles.

7. Who We Share Personal Information With

We may share personal information with service providers that help us operate XIBA, such as providers supporting:

• Cloud hosting and infrastructure.
• Databases and data storage.
• Payment processing.
• Email delivery.
• Error monitoring and application diagnostics.
• Customer support.
• Security and operational services.
• Artificial intelligence functionality, where enabled by the customer.

Our service providers are contractually required, as applicable, to protect personal information and process it only for authorized purposes.

We do not publish a complete public inventory of our infrastructure and service providers.

Customers and prospective customers conducting a legitimate security or privacy review may request information regarding applicable service providers, their roles, and relevant processing locations.

We may also disclose information:

• When required by applicable law, regulation, legal process, or valid governmental request.
• When necessary to protect the rights, property, security, or safety of QuikCharge, XIBA, our customers, users, or others.
• To professional advisers, such as attorneys, auditors, accountants, and insurers, where reasonably necessary.
• In connection with a merger, acquisition, financing, restructuring, sale of assets, or other corporate transaction.

We do not disclose personal information to third parties for their independent marketing purposes.

8. International Data Transfers

XIBA may be operated using infrastructure and service providers located in different countries.

Depending on the customer's deployment and applicable service configuration, personal information may therefore be processed or transferred outside the country where it was originally collected.

Where applicable law requires a transfer mechanism, QuikCharge will use an appropriate lawful mechanism, which may include:

• An adequacy decision.
• Standard Contractual Clauses or equivalent contractual safeguards.
• Another lawful transfer mechanism recognized by applicable privacy law.

Additional information concerning applicable international transfers and safeguards may be provided to customers and individuals upon request.

9. Data Retention

We retain personal information for as long as reasonably necessary to provide the service, maintain security and audit history, comply with legal obligations, resolve disputes, enforce agreements, and protect our rights.

For active customer accounts, certain security information, including incident history, audit records, and security posture information, may be retained for the duration of the account because maintaining historical security information is an important part of the service.

When a customer closes an account or requests deletion, QuikCharge will delete or de-identify applicable customer information from active production systems, subject to:

• Legal or regulatory retention requirements.
• Information necessary to establish or defend legal claims.
• Security and fraud-prevention requirements.
• Backup and disaster-recovery processes.

Deleted information may remain temporarily in encrypted backups until those backups are automatically overwritten or securely deleted according to our backup lifecycle.

We do not retain personal information longer than reasonably necessary for the purposes described in this Privacy Policy unless a longer retention period is required or permitted by applicable law.

10. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, alteration, disclosure, loss, or destruction.

Depending on the applicable service and configuration, these safeguards include:

• Logical separation of customer organizations.
• Encryption of integration credentials using AES-256-GCM.
• Encryption of data in transit.
• Authentication and access controls.
• Support for single sign-on and multi-factor authentication.
• Audit logging of administrative activity.
• Restricted access to production systems and customer data based on business need.
• Security monitoring and incident-response processes.
• Backup and disaster-recovery controls.

No internet-connected service can guarantee absolute security. We continuously evaluate and improve our security controls based on the nature of the information we process and the risks associated with operating the service.

If we determine that a security incident has affected personal information, we will provide notifications as required by applicable law and our contractual obligations.

11. Your Privacy Rights

Depending on where you live and the laws that apply to you, you may have rights concerning your personal information, including the right to:

• Know or access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of personal information.
• Request restriction of certain processing.
• Object to certain processing.
• Request portability of certain information.
• Withdraw consent where processing is based on consent.
• Appeal certain decisions concerning a privacy request.
• Lodge a complaint with an applicable data protection or privacy authority.

Additional rights may apply to residents of particular jurisdictions, including certain U.S. states and the European Economic Area, United Kingdom, or Switzerland.

Account Holders

If you are an XIBA account holder, you may submit a privacy request directly to us using the contact information below.

Monitored Individuals

If your personal information was provided to XIBA by an organization that uses the service, that organization generally determines why your information is processed and acts as the controller or equivalent business.

You should generally submit your request to that organization first. QuikCharge will provide reasonable assistance to the customer as required by applicable law and the applicable agreement.

Verification

To protect personal information, we may need to verify your identity before completing certain requests. We may request information reasonably necessary to verify that the person making a request is authorized to do so.

You may authorize another individual or agent to submit a request on your behalf. We may require reasonable documentation confirming that authorization.

We do not discriminate against individuals for exercising privacy rights available to them under applicable law.

We generally do not charge a fee for exercising a privacy right unless permitted by applicable law and the request is manifestly unfounded, excessive, or repetitive.

We will respond within the timeframe required by applicable law.

12. Children

XIBA is a business-to-business security platform and is not directed to children.

We do not knowingly collect personal information directly from children under 16 through the XIBA service for purposes unrelated to providing the service to a customer organization.

If you believe that a child has provided personal information directly to us without appropriate authorization, please contact us using the information below so that we can evaluate and, where appropriate, delete the information.

13. Cookies and Similar Technologies

XIBA uses cookies and similar technologies that are reasonably necessary to operate and secure the service.

These may include technologies used to:

• Keep users authenticated.
• Maintain security and protect against unauthorized activity.
• Protect forms against cross-site request forgery.
• Maintain session information.
• Remember user interface preferences.
• Understand technical errors and service performance.

We do not use advertising cookies within the authenticated XIBA product and do not use third-party advertising trackers within the signed-in product.

If we introduce non-essential analytics, advertising, or similar technologies in the future, we will update this Privacy Policy and, where required, provide appropriate choices or consent mechanisms.

14. Changes to This Privacy Policy

We may update this Privacy Policy when our services, data practices, legal obligations, or security practices change.

When we make material changes, we will update the Effective Date and, where required by applicable law, provide additional notice.

We encourage users and customers to periodically review this Privacy Policy to understand our current privacy practices.

15. Contact Us

Quikcharge LLC
Operator of XIBA

Contact: hello@xiba.ai
Website: https://xiba.ai

For security vulnerabilities, suspected security incidents, and privacy rights requests, please write to hello@xiba.ai and include sufficient information for us to understand and respond to your request.