This Privacy Policy explains how Xedu Educational Support Services LLC (“xedu,” “we,” “us,” or “our”) collects, uses, and protects personal data across our platform, including our AI system Thoth.
1. Introduction
Xedu Educational Support Services LLC (“xedu,” “we,” “us,” or “our”), a company incorporated in the United Arab Emirates, provides an AI-powered educational platform, including our AI system Thoth, to schools and individual learners across the MENA region and beyond.
This Privacy Policy explains what personal data we collect, how we use it, and the rights you have over it. It applies to two categories of users, described separately below because the way data is handled differs meaningfully between them:
- Individual Users, who create an account and use xedu directly, without going through a school (Section 2)
- School Partners and Their Users, meaning students, teachers, staff, and other stakeholders who access xedu through a school’s affiliation with our platform (Section 3)
If you are unsure which category applies to you, it depends on how your account was created and whether it is linked to a school’s affiliated domain or partnership with xedu.
Sections 4 through 15 apply to all users regardless of category and cover our general data practices, security, third-party services, and your rights.
2. For Individual Users (B2C)
This section applies if you created your own xedu account directly, not through a school.
2.1 Your data is yours
You own the data associated with your account. This includes your account information, the content you create, and your activity on the platform.
2.2 How we use your data
Unlike our school-affiliated users (see Section 3), your data is not anonymized to us. We know who you are, what features you use, and how you interact with the platform, and we use this information directly to personalize and improve your experience on xedu.
2.3 Your content, and how it powers Thoth’s responses
Your uploaded content. When you upload or input your own material, we use it in a Retrieval-Augmented Generation (RAG) system, meaning Thoth references it to generate more accurate and personalized responses for you. We retain this content so Thoth can continue referencing it across your future sessions on the platform. This is different from training: your content does not become part of Thoth’s underlying model, is never used to improve the system for other users, and is never shared beyond your own account.
Content Thoth generates. Output Thoth produces in response to your input (a rewritten piece, a study guide, practice questions) is treated as our own generated content, since it is a new creation and not a copy of what you shared. We do not currently use this output to train our AI systems. If we begin to, we will update this policy and notify you before doing so, as described in Section 14.
Exception: regardless of the above, content relating to health or medical information, counselling or safeguarding matters, or free-text personal narratives, whether uploaded by you or generated by Thoth, is never used to train or improve our systems.
2.4 Sharing with third parties
We do not sell or share your data with advertisers, data brokers, or other third parties for their own commercial benefit. Advertisers may pay to have their products featured on our platform, but they never receive your personal data to contact you directly.
We do work with service providers who help us operate the platform, such as cloud hosting, payment processing, and AI infrastructure providers. These providers process data on our behalf, under contract, and do not use it for their own purposes. They are listed in Section 6.
2.5 Users under 18
We take extra care with accounts belonging to minors.
- Under 13: a child cannot create their own xedu account. An account must be created by a parent, legal guardian, or the child’s school on their behalf.
- 13 and older: a user may create their own account. At signup, we display a clear notice encouraging the user to make sure a parent or guardian is aware they are using xedu.
- Parent-linked accounts: where a parent or guardian creates an account for a child, the two accounts are linked. The parent can view and export all of the child’s data but cannot directly edit it; edits must be made from the child’s own account.
- Transition to independence: when a young user is ready to manage their own account independently, we will present a fresh consent step at that point, asking them to review and accept our terms in their own right.
2.6 Deleting your account
If you delete your account, you may export your data beforehand. Once deleted:
- We retain your data for 90 days. During this period, we may review your account activity leading up to deletion to help us understand patterns that lead users to leave, so we can improve xedu.
- After 90 days, your personal information is permanently deleted.
- The exception is any data that already contributed to training or improving our AI systems before deletion. By that point, it has been de-identified and is no longer traceable to you personally, so it remains part of the system as a permanent improvement, but it is not retained as your personal data.
3. For School Partners and Their Users (B2B)
This section applies if you access xedu through a school’s partnership with us, whether you are a student, teacher, staff member, or other school stakeholder.
3.1 How school affiliation works
We identify you as affiliated with a school based on your account’s registered email domain. If you sign up or are enrolled using a school-affiliated email address, your account and its data are treated as connected to that school for as long as the affiliation lasts.
3.2 Data ownership while you are affiliated with a school
While you are affiliated with a school, both you and the school have rights to your data on xedu. We apply one consistent rule to determine who owns a specific piece of content:
- If you created it, and it has not been altered, worked on, or added to by anyone else, it belongs to you. This includes things like a teacher’s own unit plans or presentations, or a student’s own submitted assignments and personal performance data.
- Once a piece of content is altered, graded, commented on, or collaborated on by more than one person, it becomes jointly owned by everyone who contributed to it. For example, a teacher’s feedback and grades on a student’s assignment are jointly owned by both the teacher and the student, and a group project is jointly owned by every student who worked on it.
- You do not own content that belongs to someone else and that you have only accessed, not altered. For example, a student who views a teacher’s presentation does not gain ownership of that presentation.
The school has equal rights to all of this data for as long as you remain affiliated with it, and may retain its own copy.
3.3 Content and materials in Thoth’s responses
The same principles described in Section 2.3 apply here:
Content uploaded to the platform by you or your school (teaching materials, assignments, school-specific documents) is used in a Retrieval-Augmented Generation (RAG) system, so Thoth can reference it to generate accurate, contextually relevant responses. We retain this content to support ongoing use within your school’s environment. We do not use this content to train or improve our systems generally, and we never use a school’s own curriculum or proprietary educational materials for that purpose, regardless of anonymization.
Content Thoth generates in response to a school user’s input is treated as our own generated content. We do not use it to train or improve our AI systems unless your school has agreed to this in writing, and even then subject to the exception below.
Exception: content relating to health or medical information, counselling or safeguarding matters, or free-text personal narratives, whether uploaded by a user or generated by Thoth, is never used to train or improve our systems, regardless of anonymization.
3.4 When you leave a school
If your affiliation with a school ends, you keep the data that belongs to you or is jointly owned by you, and you can take it with you. You will lose access to content that belongs solely to someone else or to the school, and that you never altered or contributed to.
Anything you created before leaving remains available to you going forward. Anything you create after leaving is no longer connected to your former school; it belongs to you individually, or to a new school if you become affiliated with one.
3.5 xedu’s own rights over school platform data
As the platform operator, xedu has rights to certain data generated on the platform by our school partners, subject to the following limits:
- Usage and workflow data (which features are used, how often, general engagement patterns) is anonymized at the individual level and may be used to improve our platform. We know this data is connected to a particular school, but not to any specific person within it.
- School-built content and curriculum is never used to train or improve our systems, even in anonymized or aggregated form. We do not use a school’s proprietary educational materials to develop our AI.
- Content generated by Thoth is not used to train or improve our AI systems unless your school has agreed to this in writing, as described in Section 3.3.
We do not sell this data to third parties, and no third party gains rights to use it.
When we share anonymized or aggregated data externally, such as in benchmarking or research, we only do so in a form that represents at least 20 individuals, and we do not identify which school the data came from unless that school has given prior written approval.
3.6 Retention of school-connected data
We retain anonymized usage data connected to a specific school for the duration of our partnership with that school, plus 12 months after the partnership ends. After that period, the school-level connection is permanently removed, and the data becomes part of our general, fully de-identified statistics, which we may retain indefinitely since it is no longer traceable to any individual or school.
3.7 Learning pattern and literacy benchmarking
To help identify learning patterns, we measure timing data, such as how long a student takes to complete tasks, answer questions, or complete readings, across our school partners. This is used to build anonymous, aggregated benchmarks (for example, an average reading speed for a school, or eventually across many schools nationally).
This benchmarking data is currently used only in anonymized, aggregate form. We are researching whether this kind of data could eventually help identify individual students who may benefit from additional learning support, such as those showing patterns associated with dyslexia or other learning difficulties. This individual-level use is not currently active on our platform, is accessible only to our internal team for research purposes, and will not be introduced as a live feature without first obtaining separate, explicit parental consent beyond our standard account terms.
Consistent with Section 3.3, any data of this kind that relates to a student’s health or a diagnosed or suspected learning difficulty is treated as sensitive information and is never used to train our general systems, regardless of anonymization.
3.8 Users under 18 in a school setting
Where your school enrolls you or your child onto xedu, your school is responsible for obtaining any necessary parental or guardian consent for the use of xedu as part of its educational services. We rely on the arrangements your school already has in place with parents and guardians at the time of enrollment, such as its general enrollment agreements or school policies, to cover this, rather than requiring a separate consent process specific to xedu.
xedu does not have a direct relationship with parents in this context and does not independently seek parental consent for school-enrolled students. Schools are responsible for ensuring their own enrollment and consent processes are sufficient to cover their students’ use of our platform, including any AI-powered features.
The protections described in Section 2.5 regarding minors, including the exclusion of sensitive data categories from training, still apply to school-enrolled students in the same way, regardless of who obtained consent for their account.
4. Data We Collect
Depending on how you use xedu, we collect:
- Account information: name, email address, role (student, teacher, parent, staff), and school affiliation, if applicable
- Content you provide: documents, assignments, submissions, and other materials you upload or input into the platform
- Usage and activity data: which features you use, how you interact with the platform, and timing data such as how long you take to complete tasks, answer questions, or complete readings
- Device and technical data: IP address, browser and device type, and similar log information generated when you access xedu
- Payment information: where applicable, processed through our third-party payment providers; we do not store your full card or bank details ourselves
5. How We Use AI (Thoth)
Thoth, our AI system, is powered by AI models provided by Anthropic. When you interact with Thoth, relevant content, including material referenced through the RAG system described in Sections 2.3 and 3.3, is sent to Anthropic’s systems to generate a response.
To make uploaded content searchable for the RAG system, the text extracted from uploaded files, and the questions and messages used to search it, are sent to OpenAI to create embeddings (numerical representations of text used only for search). OpenAI does not generate Thoth’s responses.
Anthropic and OpenAI act as data processors on our behalf. Under their commercial terms, which govern our use of their APIs, data submitted through the API is not used to train their models.
6. Subprocessors and Third-Party Services
We work with the following third-party providers to operate xedu:
- Supabase, for data hosting and storage
- Vercel, for hosting the xedu web application and for anonymous, cookie-free page-view analytics
- Anthropic, for AI processing that powers Thoth
- OpenAI, for creating search embeddings of uploaded content (see Section 5)
- Sentry, for error monitoring and diagnostics
- Resend, for sending platform emails
- Google, for “Sign in with Google” and, where you choose to connect your account, exporting to Google Drive
- Microsoft, whose Office Online viewer displays Word, PowerPoint, and Excel files in the browser
- Stripe, for payment processing
- Slash, for user payouts (planned)
Where your school integrates its own systems with xedu, such as a student information system, productivity or collaboration tools, HR or finance systems, or access control systems, data may sync between xedu and those systems as configured by your school. Your school’s own privacy practices govern how it uses those systems.
We do not permit any of these providers to use your data for their own independent purposes, and we do not sell or share your data with them beyond what is necessary for them to provide their service to us.
7. International Data Transfers
Your data is stored with Supabase in data centres in the European Union (Frankfurt, Germany), India (Mumbai), and the United States. Each partner school’s data is kept in its own separate database, and the location of that database is available from us on request. Some of our other service providers, including Vercel, Anthropic, and OpenAI, may also process data in other countries, including the United States, as part of delivering their services to us. Where your data is transferred internationally, we require our providers to maintain appropriate contractual protections, such as data processing agreements, and to handle your data securely regardless of where it is processed.
8. Data Security
We take reasonable technical and organizational measures to protect your data, including access controls limiting who can view data based on role, and encryption of data in transit.
From time to time, we may replicate data into secured, access-restricted test or development environments, for example to diagnose a reported issue or validate a new release before it goes live. When we do this, information relating to health, counselling, or safeguarding matters is masked or excluded, access is limited to authorized personnel, and the replicated data is deleted within 30 days.
While we take security seriously, no system is completely secure, and we cannot guarantee absolute protection of your data.
9. Data Retention Summary
Retention periods vary depending on the type of data and how you use xedu:
- Individual (B2C) account data: retained while your account is active. If you delete your account, retained for 90 days for churn analysis, then permanently deleted, except for de-identified contributions already incorporated into our AI systems (see Section 2.6)
- School-connected (B2B) usage data: retained in a form connected to your school for the duration of our partnership with that school, plus 12 months after the partnership ends, after which it is folded into our fully de-identified, non-school-specific statistics and may be retained indefinitely (see Section 3.6)
- Uploaded content used in RAG: retained to support ongoing use of the platform, as described in Sections 2.3 and 3.3
10. Your Rights
Depending on applicable law, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your data, subject to the retention terms described in this policy
- Object to or request restriction of certain processing of your data
- Request a copy of your data in a portable format
To exercise any of these rights, contact us at admin@xedu.app. We will respond to your request within 30 days. Where you are a minor, a parent or guardian may exercise these rights on your behalf. Where you access xedu through a school, some requests may need to be coordinated with your school, particularly where data is jointly held under Section 3.2.
11. Cookies and Tracking
We do not use advertising or cross-site tracking cookies. We use Vercel Web Analytics, which counts anonymous page views without cookies, and Sentry, which records technical details when an error occurs so we can fix it. Where a teacher embeds third-party content, such as a YouTube or Vimeo video, that content is served by its provider and is subject to that provider’s own cookie policy. If we introduce other cookies or analytics tools in the future, we will update this policy accordingly and, where required by law, seek your consent before doing so.
12. Children’s Privacy
xedu takes the privacy of minors seriously. A summary of the protections described in detail elsewhere in this policy:
- Individual users under 13 cannot create their own account; an adult must create it on their behalf (Section 2.5)
- Users 13 and older may create their own account, with a notice encouraging parental awareness
- Where a school enrolls a student, the school is responsible for obtaining any necessary parental consent as part of its own enrollment process (Section 3.8)
- Sensitive categories of data, including health, medical, counselling, safeguarding, and free-text personal narrative content, are never used to train our systems, regardless of anonymization or user age (Sections 2.3, 3.3, 3.7)
13. Breach Notification
If we become aware of a data breach affecting your personal data, we will notify affected parties within the following timeframes:
- School partners and their affiliated users (B2B): initial notification within 24 hours of confirming the breach
- Individual users (B2C): initial notification within 72 hours of confirming the breach
Some of our school partners have specific contractual notification requirements; those agreements govern for that partner where they impose stricter terms than the above.
14. Changes to This Policy
We may update this policy from time to time. If we make material changes, we will notify you by email or through a notice on the platform before the changes take effect. The date at the top of this policy reflects the last update. Continued use of xedu after changes take effect constitutes acceptance of the updated policy.
15. Governing Law and Contact
This policy is governed by the laws of the United Arab Emirates.
If you have questions about this policy or how we handle your data, contact us at:
Xedu Educational Support Services LLC
Office 101-015, Building B312, Al Garhoud, Deira, Dubai, United Arab Emirates
admin@xedu.app