Account and billing
Email address, account identifiers, subscription status, billing interval, payment references and support/refund records. PayPal processes payment credentials; XYSHIMA does not receive your PayPal password.
PRIVACY NOTICE
How XYSHIMA uses student and account data.
This notice explains what information XYSHIMA processes, why it is needed, and the choices and rights available to users.
1. Who is responsible
XYSHIMA is provided by Masoud Elahian, trading as Xynara Analytics, currently operating as a sole-trader / individual online business. For the consumer XYSHIMA service, Masoud Elahian is the data controller unless a specific processing activity identifies another controller.
Address: Masoud Elahian, trading as Xynara Analytics, Vasileos Evagorou 3, P.O. Box 6023, Larnaca, Cyprus. Email: support@xyshima.com. Current trader details are also available on the Trader Information page.
2. Information we process
Learning data
Selected curriculum, subjects, notes, uploaded study materials, quiz attempts, confidence, timing, mistakes, flashcard reviews, planner activity, tutor conversations and learning-model outputs.
Safety and support
Issue reports, troubleshooting context, browser/device information, timestamps and the specific content a user chooses to report.
Legal preferences
Age band, country, guardian-authorisation details, versions of Terms/notices acknowledged, checkout acknowledgements and optional marketing preference.
3. Why we use the information
We use account and learning data to provide the service, authenticate users, personalise study guidance, maintain the learner model, operate subscriptions, prevent abuse, secure the platform, respond to support requests and comply with legal obligations. Optional marketing is used only when the user has chosen it.
4. Legal bases
Depending on the processing and jurisdiction, we rely on performance of the service contract, compliance with legal obligations, legitimate interests such as security and service reliability, and consent where consent is specifically required — for example optional direct marketing. A Privacy Notice is not itself a request for marketing consent.
5. Children and teenagers
XYSHIMA does not currently permit an independent account for users under 14. Users aged 14–17 must have parent or legal guardian authorisation, and a paid subscription for a user under 18 must also be parent/guardian authorised. Additional protections may apply depending on the user's country. See the Child & Teen Safety Policy.
6. AI processing and profiling
XYSHIMA uses AI to generate tutoring and study content and to interpret learning evidence. The platform may create probabilistic estimates of mastery, retention, misconceptions and readiness to personalise study actions. These estimates are study guidance, not official school grades, admissions decisions or legally significant automated decisions. See the AI Transparency Notice.
7. Service providers
XYSHIMA uses specialist service providers to operate the platform. These can include Supabase for authentication/database services, Cloudflare for hosting/security, OpenAI for AI functionality and PayPal for payments. Providers process information according to their role, contractual terms and applicable privacy requirements.
8. International processing
Some service providers may process data in countries outside the user's country of residence. Where required, appropriate legal transfer mechanisms and provider safeguards are used. Users can contact support for more information relevant to their account.
9. Retention
We keep data for as long as reasonably necessary to provide the account and learning service, maintain security and support records, and meet accounting or legal obligations. Different records can have different retention periods. Users may request account deletion subject to records that must be retained by law or for legitimate dispute/security purposes.
10. Your rights
Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive portable data, withdraw consent where processing is based on consent, and complain to a competent data-protection authority. Contact support@xyshima.com to exercise a privacy right.
11. Marketing choices
Marketing consent is optional and is not required to create an account or buy a subscription. Marketing boxes are not pre-selected. Transactional messages such as account verification, payment, security and service notices are separate from promotional marketing.
12. Security
XYSHIMA uses technical and organisational measures designed to protect account and learning data, including authenticated access, server-side controls and restricted database permissions. No online service can guarantee absolute security, so users should also protect their credentials and report suspicious activity.
13. Changes
We may update this notice as the service changes. Material changes may be highlighted in the product, and where a new consent or contractual acceptance is legally required, XYSHIMA will request it separately.