Account and subscription
Email, user ID, authentication metadata, plan, subscription status, payment references, amounts, currency, refunds and support history. PayPal processes payment credentials; XYSHIMA does not receive your PayPal password.
PRIVACY NOTICE
Clear information and practical control over your data.
This notice explains what XYSHIMA processes, why, for how long, who helps provide the service, and how students and account holders can exercise their rights.
1. Controller and contact
XYSHIMA is provided by Masoud Elahian, trading as Xynara Analytics, Vasileos Evagorou 3, P.O. Box 6023, Larnaca, Cyprus. For the consumer service, Masoud Elahian is the data controller unless a specific activity says otherwise. Privacy questions and requests: support@xyshima.com.
2. Data we process
Learning
Curriculum selections, subjects, notes, uploads, quiz attempts, confidence, timing, mistakes, flashcard reviews, planner activity, tutor conversations and learning-model estimates.
Age, guardian and legal records
Age band, country, guardian email and authorisation status, notice and terms versions, checkout acknowledgements, and optional marketing preference.
Safety, support, feedback and optional analytics
Issue reports and chosen troubleshooting context; optional product-feedback rating, category and comment; survey timing and review status; and limited account, plan, age-band and usage context needed to interpret feedback. If accepted, first-party analytics can include a pseudonymous visitor ID, event, path, country and limited technical properties.
Study Groups
Group name and subject, invitation email and status, member display name, role and age category, guardian/classroom verification records, AI-consent choices, text messages, blocks, reports and membership events. There is no private-message recipient data because the service does not provide private messaging.
3. Purposes and legal bases
Provide the requested service
Account, tutoring, learning personalisation, uploads, subscription and support processing is generally necessary to perform the service contract or take requested pre-contract steps.
Legal responsibilities
Legal, guardian, tax, accounting, refund and privacy-rights records may be processed to comply with legal obligations.
Security, reliability and improvement
Abuse prevention, rate limiting, incident investigation, voluntary product feedback and limited operational records rely on legitimate interests in protecting users and improving a reliable service, balanced against user rights. Feedback is private operational data and is not published as a testimonial without a separate, explicit agreement.
Consent
Optional first-party analytics and optional marketing operate only after a relevant choice. Consent can be withdrawn without affecting earlier lawful processing.
4. Children and teenagers
XYSHIMA does not permit independent accounts for users under 14. Users aged 14–17 require parent or legal-guardian authorisation, including for paid subscriptions. Study Groups require an additional feature-specific guardian approval. Any new adult or teacher in a minor's group requires a verified classroom context and fresh guardian approval of the roster change. Country-specific rules may require additional safeguards. See Child & Teen Safety.
5. AI and learning profiles
XYSHIMA uses AI to provide tutoring and generate or evaluate study content. It may estimate mastery, retention, misconceptions and readiness to suggest study actions. These probabilistic estimates are guidance, not official grades, admissions decisions or other legally significant automated decisions. Read the AI Transparency Notice.
6. Recipients and international transfers
Service providers include Supabase for authentication/database services, Cloudflare for hosting/security, OpenAI for AI functionality and PayPal for payments. See the Service Providers page. Some processing may occur outside Cyprus or the EEA. Where GDPR requires it, XYSHIMA relies on an applicable adequacy decision, Standard Contractual Clauses or another lawful safeguard and reviews provider protections.
7. Retention and account deletion
We keep personal data only for the service, legal, security and dispute purposes that apply. Current operational targets, subject to legal holds and required records, are: optional analytics up to 13 months; rate-limit counters 2 days; expired or rejected guardian requests 90 days after expiry; submitted product feedback and its review history up to 24 months; resolved issue reports 24 months; and closed privacy-request case records 3 years.
When you delete your account
Settings → Data & privacy includes a permanent Delete account control. After a fresh password check, XYSHIMA first cancels active XYSHIMA and XYSHIMA Uni subscription renewals linked to that sign-in, removes the account's private learning data and uploaded school study files, and then deletes the authentication account. The same sign-in is shared by the school and university workspaces, so both are deleted together.
Shared Study Groups
Your own Study Group messages are deleted with the account. If you own a group that still has another active member, ownership is transferred before your account is removed so the other members do not lose their shared group. If no other active member remains, the group can be removed with the owner.
Limited records that may remain
Payment or accounting records, a completed deletion record, or information needed for a legal hold, fraud prevention, safety investigation or dispute may be kept where there is a valid reason. Where possible, these records are separated from the deleted account rather than kept as an active user profile.
Preventing repeated free trials
After self-service deletion, XYSHIMA keeps a one-way coded marker derived from the former account email. The marker is not the readable email address and is used to record that deletion occurred and to prevent repeated free trials by deleting and recreating the same account.
8. Your GDPR rights
Where applicable, you may request access, correction, erasure, restriction, objection and portability; withdraw consent; and complain to a supervisory authority. Signed-in users can download an account-data export, permanently delete their account, or submit another tracked privacy request under Settings → Data & privacy. You can also email support@xyshima.com. We may need proportionate identity verification and normally respond within one month. Complex or numerous requests may lawfully take longer, in which case we will explain the extension.
In Cyprus, the supervisory authority is the Office of the Commissioner for Personal Data Protection.
9. Optional analytics and marketing
Optional analytics is off until accepted and rejecting it does not prevent use of the service. Withdrawing the choice removes XYSHIMA's local analytics visitor identifier and stops future optional events. Marketing is optional, not preselected, and separate from verification, payment, security and service communications.
10. Security and incidents
XYSHIMA uses measures designed to protect data, including authenticated access, server-side authorization, restricted database permissions, transport encryption and provider-managed encryption at rest. No online service can guarantee absolute security. Read the Security Overview or report suspected incidents to support.
11. Changes
We update this notice when processing changes. Material changes may be highlighted in the product. If new consent or contractual acceptance is required, it will be requested separately rather than assumed from use of the service.