Privacy Policy

1. Who We Are

xudio ("we", "us", "our") is an AI-powered ACCA exam preparation platform. Our service is accessible at xudio.co. For privacy enquiries, contact us at hello@xudio.co.

2. Data We Collect

Students:

• Account information: name, email address (via Google OAuth)
• Usage data: practice sessions, sprint scores, topic performance, streaks
• Partner linkage: the Partner Code you enter during onboarding
• Device data: browser type, OS, screen size (for app optimisation)

Partners (training providers):

• Organisation name, contact email, and account credentials (via Google OAuth)
• Team member names and email addresses added to the portal
• Cohort names and enrolment dates you create

3. How We Use Your Data

• To provide and improve the xudio platform and AI feedback
• To generate aggregated performance analytics for Partner dashboards
• To send service-related emails (e.g. account verification, product updates)
• To detect and prevent fraud or abuse

We do not use your data to train third-party AI models or sell it to advertisers.

4. What Partners Can See

If you link to a Partner using their Partner Code, that Partner's dashboard will show:

• Your display name and the paper(s) you are studying
• Your sprint scores, topic performance, and activity trends
• Whether you are flagged as "at risk" based on score thresholds

You can unlink from a Partner at any time from your account settings. Unlinking removes you from their dashboard immediately.

5. Data Sharing

We share data with the following third-party services to operate the platform:

• Supabase — database and authentication (hosted in EU)
• Google OAuth — sign-in only; we do not access your Google account beyond basic profile info
• Vercel — web hosting and edge delivery
• OpenAI / Anthropic — AI answer feedback (questions and anonymised responses only; no personally identifiable information is sent)

We do not share data with any other third parties without your explicit consent.

6. Data Retention

• Active accounts: data retained while your account is active
• Deleted accounts: personal data removed within 30 days of deletion request
• Aggregated, anonymised analytics: may be retained indefinitely for service improvement

7. Your Rights

Under UK GDPR and applicable data protection law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and personal data
• Object to or restrict certain processing
• Data portability (export your data in a machine-readable format)

To exercise any of these rights, email hello@xudio.co. We will respond within 30 days.

8. Cookies

xudio uses only essential cookies and local/session storage required for authentication and app state. We do not use tracking cookies or third-party advertising cookies.

9. Children

xudio is intended for users aged 16 and over (the minimum age for ACCA registration). We do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will remove it promptly.

10. Changes to This Policy

We may update this policy from time to time. We will notify registered users by email of any material changes at least 14 days before they take effect.

---

Questions about your data? Email hello@xudio.co