This policy explains what personal data XANA collects when you use studyxana.com and the XANA apps, why we need it, who else handles it, and the rights you have. We've tried to write it in plain language. If anything is unclear, email us at support@studyxana.com.
1. Who is responsible for your data
XANA is run by Riccardo. Under the EU General Data Protection Regulation (GDPR), we are the "controller" of your personal data. You can reach us about anything in this policy at support@studyxana.com.
2. What we collect
Account details: your email address, your password (we only store it in scrambled, "hashed" form), and the answers you give when you sign up — your level of study, subject, study goal, daily study time and what you find hardest. Optionally, a profile picture and your app language.
Your study material: everything you upload or paste — PDFs, Word documents, photos, audio and video recordings, text and links — the text we extract from it, and the study content we create from it (summaries, flashcards, quizzes, podcasts, slides, videos and games).
Your studying: chat messages with the tutor, quiz answers and scores, flashcard progress, streaks, essays you submit for feedback, and research challenge answers. If you answer a challenge out loud, we record that answer so it can be transcribed and graded.
Voice input: when you talk to XANA in chat, your phone or browser turns your speech into text and XANA only receives the text. That speech recognition is provided by your device or browser (for example Apple, or Google in Chrome) under their own privacy terms.
Payments: if you buy a plan, Stripe processes the payment. We never see your full card number — we receive your plan, payment status, amounts and a Stripe customer reference.
Messages: feedback you send in the app, answers to optional surveys, and emails you send us.
Activity: which days you open XANA and which features you use, stored in our own database (no cookies or outside analytics), so we can see what helps students and what to improve.
Technical data: our hosting providers automatically log technical information such as your IP address, browser type and the time of each request, to keep XANA running and secure. We also count how many things you generate each month, to apply plan limits.
We do not show ads, we do not track you across other websites, and we never sell your data.
3. Why we use it, and our legal basis
To provide XANA — your account, processing your material, creating study content, the tutor and voice features, and saving your progress. Legal basis: performing our contract with you (GDPR art. 6(1)(b)). Your sign-up answers are used to pitch explanations at your level.
To handle subscriptions and payments (contract), and to keep invoices and payment records as tax law requires (legal obligation, art. 6(1)(c)).
To keep XANA secure, prevent abuse and apply fair-use limits (our legitimate interest in a safe, affordable service, art. 6(1)(f)).
To answer your messages and improve XANA based on your feedback (legitimate interest).
You need to give us an email address and password to create an account — without them we cannot provide XANA. Everything else is optional or only needed for the features you choose to use. Where we rely on legitimate interests, you can object at any time (see section 10).
4. How XANA uses AI
XANA is powered by AI. To create study content and answer your questions, the relevant parts of your material and messages are sent to our AI providers: Anthropic (the Claude models, for text) and OpenAI (search indexing, speech-to-text and the podcast voices). They process it only to return a result to us, under contracts that do not allow them to use it to train their models. They may keep it for a short time (normally up to 30 days) to detect abuse, then delete it.
AI can make mistakes, so always check anything important. XANA does not make decisions about you that have legal or similarly significant effects — grades for challenges and essays are feedback for you alone.
5. Who else handles your data
We use a small number of trusted providers ("processors") that handle data only on our instructions, under data processing agreements:
Supabase — database, logins and file storage. Your data is stored in the EU (Ireland).
Vercel — hosts the website.
Railway — runs the servers that make podcasts, slides and videos.
Anthropic and OpenAI — AI processing, as described in section 4.
Stripe — payments. For its own legal duties, such as fraud prevention and financial regulation, Stripe acts as an independent controller under its own privacy policy.
Our email provider — to receive and answer emails you send us.
We may also disclose data where the law requires it, for example to comply with a court order.
6. Transfers outside the EU
Your account and study material are stored in the EU. Some of the providers above are based in the United States, so data may be processed there. These transfers are protected by the EU–US Data Privacy Framework (where the provider is certified) or by the European Commission's Standard Contractual Clauses. You can ask us for more information.
7. How long we keep it
Your account, material and progress: for as long as you have an account. Material you delete in the app is deleted. If you delete your account, everything in it is deleted, including uploaded files; copies in backups are overwritten within 30 days.
Recordings of spoken challenge answers: deleted as soon as they have been transcribed.
Payment and invoice records: as long as tax and accounting law requires (up to 10 years).
Technical logs: a short time, normally a few days to a few weeks.
Emails you send us: until your request is resolved, and for at most 2 years.
8. Children
You must be at least 13 years old to use XANA. If you are under 16, a parent or guardian must agree to you using XANA, and to this policy, before you sign up. If we learn that a child under 13 has an account, we delete it. Parents and guardians can contact us at support@studyxana.com to see or delete their child's data.
9. Cookies and local storage
XANA does not use advertising or analytics cookies, and our website does not load fonts or trackers from other companies. The website stores your login session and a few settings in your browser's local storage. This is strictly necessary for logging in and using the app, so it does not need your consent. When you pay, Stripe's checkout page uses its own cookies to process the payment securely and prevent fraud.
10. Your rights
Under the GDPR you have the right to:
access your data and get a copy of it;
have inaccurate data corrected;
have your data deleted — you can do this yourself in Settings → Delete account;
restrict or object to how we use your data, including anything based on legitimate interests;
receive the data you gave us in a common, machine-readable format (data portability);
withdraw any consent you have given, at any time.
To use any of these rights, email support@studyxana.com. We will reply within one month. You also have the right to complain to a data protection authority, in particular in the EU country where you live or work or where you think the problem happened.
11. Security
All connections to XANA are encrypted (HTTPS). Database rules make sure each account can only ever reach its own data, and the keys to our AI and payment providers never leave our servers. No system is perfectly secure, but if a breach ever puts your data at risk, we will tell you as the law requires.
12. Changes to this policy
If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect. The date at the top always shows the current version.