Privacy Policy

Last updated: 19/12/2025

1. Who We Are

Website: https://geia.ai
GEIA.AI is operated by XLABS Europe Ltd, registered in England and Wales.

Company Number: 09428978
VAT Number: GB214046352
Registered Office: 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom

XLABS Europe Ltd is the data controller responsible for your personal data under the UK GDPR
and EU GDPR where applicable.

2. Scope of This Privacy Policy

This Privacy Policy applies to:

The GEIA.AI website
The GEIA.AI web and mobile applications (“the App”)
IoT devices and gateways connected to the GEIA.AI platform
APIs, MQTT connections, and integrations provided by GEIA.AI
Webshop, billing, and partner services

3. Personal Data We Collect

3.1 Website & Account Data

Name
Email address
Username
City, state, or country (optional)
Login and account metadata

3.2 App, IoT & Platform Data

Sensor data (e.g. temperature, humidity, light, EC, pH)
Relay and actuator states
User-defined configurations and automation rules
Plant data, journals, logs, and notes
System usage and performance data

3.3 Webshop & Billing Data

Billing name and address
Invoice details
Transaction references

3.4 Partner & Business User Data

Business contact details
Service descriptions
Optional public listings or references (with consent)

4. Separation of Data Domains

Application and IoT data are logically separated from webshop, billing, and accounting data.
A common user identifier may be used to link accounts, but each data domain is processed independently and for distinct purposes.

5. How We Use Your Data

We process data for the following purposes:

Providing and operating the GEIA.AI platform
Monitoring and controlling connected environments
Customer support and communication
Billing, invoicing, and accounting
Improving system performance and user experience
Machine learning and system optimization

6. AI and Machine Learning

GEIA.AI uses collected data to improve automation, predictions, and platform functionality.
Machine learning processes do not produce legal or similarly significant effects on users without human involvement.

Users retain control over what data is shared or used beyond core system functionality.

7. User-Controlled Data Sharing

Users can explicitly choose to mark specific data, settings, or configurations as public or shared.

Only data marked as public is visible to other users
API and MQTT access return only authorized and consented data
Sharing permissions can be changed or revoked at any time

8. Community & Knowledge Sharing

GEIA.AI may offer optional community features allowing users to share configurations,
strategies, or anonymized insights (e.g. “top grower” features). Participation is voluntary
and requires explicit user consent.

9. Cookies & Analytics

Cookies

We use essential cookies for authentication and functionality. Optional cookies may be
used for analytics and usability improvements.

Analytics & Session Tools

We use third-party tools such as analytics and session recording services (e.g. Hotjar) to understand aggregate usage patterns. These tools do not identify individual users.

10. Payments & Invoicing

Payments are processed by third-party providers such as Stripe and PayPal. GEIA.AI does not store full payment card details.

Invoice data is stored on kashflow for up to five (5) years in accordance with accounting and tax obligations.

11. Data Retention

Account data: retained while the account is active
IoT and app data: retained until deleted by the user or account removal
Invoice data: retained for legal and accounting purposes

12. Your Rights

You have the right to:

Access your personal data
Download your data
Correct inaccurate data
Request deletion or erasure of personal data (‘right to be forgotten’)
Withdraw consent for optional processing

Some data may be retained where legally required.

13. Security & Encryption

We implement industry-standard security measures, including:

Encryption in transit (TLS)
Encryption at rest where appropriate
Role-based access control
Logical isolation between users

Further details about our security practices and vulnerability reporting process are available on our Security & Responsible Disclosure page.

14. Distributed Data Processing

GEIA.AI uses a distributed data processing architecture to ensure performance, reliability, and isolation of user data. This does not affect users’ rights or control over their data.

15. Data Breach Procedures

In the event of a data breach, we will notify affected users and relevant authorities in accordance with applicable laws.

16. Third Parties

We may share data with trusted service providers strictly for providing our services, legal compliance, or security. We do not sell personal data.

17. Regulatory Compliance

XLABS Europe Ltd is registered with the UK Information Commissioner’s Office (ICO) and
complies with the UK GDPR and Data Protection Act 2018.

18. Online Dispute Resolution (ODR) & Alternative Dispute Resolution

In accordance with Article 14(1) of Regulation (EU) No 524/2013 (ODR Regulation),
the European Commission provides a platform for online dispute resolution (ODR),
which is available at:
https://ec.europa.eu/consumers/odr

XLABS Europe Ltd is not obliged and does not intend to participate in dispute
resolution proceedings before a consumer arbitration board.

19. Contact

For privacy-related questions or requests, please contact us via the website.