Supervisor Portal

RXDI Platform operates the Supervisor Portal at https://supervisor-application.lovable.app and is the controller of the personal data described in this policy. Where we process robot and task data on behalf of a customer operating its own fleet, that customer is the controller and we act as its processor under our agreement with them.

We collect the following categories of data:

• Account and identity data. When you sign in with XO Auth, we receive your name, email address, a stable user identifier and, if you have one, a profile picture. We never receive or store your XO Auth password.
• Authorisation data. The role assigned to you, the sites and robots you are permitted to access, and your account status.
• Session and security data. Sign-in and sign-out times, session expiry, IP address and browser user agent, kept so that we can secure accounts and investigate suspicious activity.
• Operational activity. Actions you take in the Portal — acknowledging an alert, scheduling or reassigning a task, issuing a robot command, exporting a report — recorded together with your user identifier and a timestamp.
• Fleet and telemetry data. Robot status, battery level, location within a site, cleaning coverage, task history and fault records. This is equipment data, and becomes personal data only where it can be connected to an identified operator.
• Technical logs. Error reports and diagnostic information generated when something in the Portal fails.

We do not collect special category data, we do not use the Portal for advertising, and we do not sell personal data.

• Authenticating you and keeping your session secure.
• Deciding what you are permitted to see and do, including which robots and sites are available to you.
• Providing the Portal's features: monitoring, alerts, reporting, scheduling and task management.
• Maintaining an audit trail of operational actions, which matters where a robot command has physical consequences.
• Diagnosing faults, investigating incidents and improving reliability and safety.
• Meeting our legal, regulatory and contractual obligations.

Our lawful bases are the performance of our contract with your organisation, our legitimate interests in operating and securing the service, and compliance with legal obligations.

Signing in is handled by XO Auth, a third-party identity provider. When you choose Continue with XO, you are taken to XO Auth to authenticate, and we receive only the openid, profile and email information you consent to share. Your credentials are entered on XO Auth's own pages and are never visible to the Portal. XO Auth's handling of your data is governed by its own privacy policy.

We store a link between your XO Auth identifier and your Portal account so that you arrive at the same account each time you sign in.

The Portal sets a strictly necessary session cookie once you sign in. It is encrypted, marked HttpOnly and Secure, and it exists solely to keep you signed in. We also use short-lived values during sign-in to protect the login exchange against interference.

We do not use advertising cookies, analytics cookies or cross-site trackers. Clearing this cookie signs you out.

Several Portal screens — Robot Overview, Remote Monitoring, Reports, Alerts, Job Scheduler, Roster Management and User Management — are delivered as separate modules embedded within the Portal. They form part of the same service, are operated under this policy, and receive only the identity and authorisation information needed to serve your request.

We disclose personal data only:

• To the organisation whose fleet you operate, including its administrators, who can see account, role and operational activity data for their users.
• To service providers who host, secure and support the Portal, bound by contract to process data only on our instructions.
• To XO Auth, as part of authenticating you.
• Where we are legally required to, or to establish, exercise or defend legal claims.
• To an acquirer, in connection with a merger, acquisition or asset sale, subject to this policy.

Account and authorisation data is kept while your account is active and for a reasonable period after it is closed. Session and security records are kept for a limited period appropriate to investigating incidents. Operational and audit records are kept for as long as the relevant customer requires them for safety, quality or regulatory purposes. When a retention period ends, data is deleted or irreversibly anonymised.

Data is encrypted in transit. Access is restricted by role, sessions expire automatically after a period of inactivity, and multi-factor authentication is available and enabled by default in production. We keep audit records of security-relevant events. No system is perfectly secure, but we work to a standard appropriate to the operational nature of this service.

Our infrastructure providers may process data in countries other than the one you are in. Where that happens, we rely on appropriate safeguards — such as standard contractual clauses or an adequacy decision — to protect your data.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and complain to your data protection authority.

Because Portal accounts are usually created and managed by your employer, the quickest route is normally to contact your administrator. You can also write to us at privacy@rxdiplatform.com and we will respond within the period the applicable law allows.

The Portal is a workplace tool intended for adults. It is not directed at children, and we do not knowingly collect data from anyone under 16.

We may update this policy as the service changes. The date at the top of this page shows when it was last revised. Where a change materially affects you, we will give notice through the Portal or by email before it takes effect.

Privacy enquiries: privacy@rxdiplatform.com. General support: support@rxdiplatform.com.