1. Introduction
At Xepho, we take your privacy seriously. This policy explains how we collect, use, and protect your personal information when you use our AI-powered adaptive learning platform.
2. Information We Collect
We collect information that you provide directly to us, such as when you create an account, as well as data generated during your learning journey:
- Account Data: Name, email, and authentication credentials.
- Learning Data: Your VARK profile, course progress, quiz results, and interaction patterns.
- Device Data: IP address, browser type, and operating system for security and optimization.
3. How We Use Your Information
Your learning data (VARK profile, course progress, quiz results, interaction patterns) is used to personalize your experience, including training and running the AI models that generate your curricula, study paths, and adaptive content. We also use it for:
- Generating personalized curricula and study paths.
- Providing customer support and security alerts.
- Analyzing platform usage to improve our technology.
This AI-training use applies only to the learning data described above. It does not apply to data obtained through Google APIs — see Section 4.
4. Google API Services User Data
If you connect a Google account — so that Xepho can send transactional email on your behalf via Gmail — we request only the scopes needed for that specific feature:
- Gmail send (gmail.send): used exclusively to send emails from your own connected Gmail account on your behalf — Xepho does not read, search, or store the contents of your inbox.
Alongside this we request only the standard sign-in scopes (openid, userinfo.email, userinfo.profile) to identify your account. Xepho requests no other Google scopes, and no restricted scopes at all.
Xepho's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely, this means:
- Data obtained via Google APIs is never sold, and is never transferred to third parties except as necessary to provide the specific feature you enabled (e.g. delivering an email you asked us to send).
- Data obtained via Google APIs is never used to train, develop, or improve any AI/ML model — including the AI features described in Section 3, which are trained only on the learning data you generate directly within Xepho, never on Google account data.
- Data obtained via Google APIs is used only for the user-facing feature it was granted for, and is retained only as long as needed to provide that feature.
5. Third-Party Service Providers
Xepho uses third-party infrastructure and AI model providers to power course content generation (text, quizzes, images, audio, and video) and workflow automation. Google account data is never shared with, or processed by, any of these providers — it is used solely for the Gmail/Calendar features described in Section 4, handled directly between Xepho and Google's APIs.
6. Data Security
We implement enterprise-grade security measures to protect your data. All communication is encrypted via SSL/TLS, and sensitive data is stored using industry-standard hashing and encryption algorithms.
7. Your Rights
You have the right to access, correct, or delete your personal data at any time. You can also export your learning data from your profile settings. You can disconnect a Google account at any time from your Integrations settings, which immediately revokes Xepho's access to it.
8. Contact Us
If you have any questions about this Privacy Policy, please contact our legal team at legal@xepho.ai.