Privacy Policy

This policy explains what personal data Xplainly collects when you use xplainly.ai and our related services (the Service), why, whom we share it with, how long we keep it, and the rights you have. It applies to visitors, account holders and anyone whose data reaches us through the Service.

The controller of your personal data is Xplainly, based in Yerevan, Armenia, reachable at [email protected]. Our registered legal entity name and postal address are published here as soon as registration is complete. Where the law requires a representative in the European Union or the United Kingdom, their details will be added to this section.

Account data. Email address, username, first and last name, a hashed password (we never see the password itself), verification status, plan, and the version and time of your acceptance of the Terms.

Signing in with Google. If you use “Continue with Google”, Google tells us your Google account's ID, email address, whether Google has verified that address, and your name. We use them only to sign you in and to fill in your account details; we do not receive your Google password, contacts, files or anything else, and we do not share this data. You can disconnect Google in your settings.

Content you create. The questions and prompts you submit, files you upload to make a lesson from (and the text and figures read from them), course descriptions, the lessons and other output generated for you, tutor questions and answers, quiz attempts, comments, reactions, and lesson sharing settings.

Voice recordings. If you choose to narrate lessons in your own voice, the short recording you make. In some places this counts as biometric data. We collect it only with your explicit consent, given when you record it, and you can delete it at any time from My voice.

Usage and billing. Credits reserved, spent, earned and bought; plan changes; unlocks of shared lessons; the questions you ask the tutor and how many; feature usage. Payments are handled by our payment processor, who sends us the transaction outcome and the last digits of the card, never the full card number.

Technical data. IP address, browser and device type, pages visited, timestamps, referring page, and error reports. We use this to run the Service, keep it secure, rate-limit abuse and fix problems.

Communications. Messages you send us through the contact form or by email, and our replies.

We do not knowingly collect data from children under 16, and we do not collect payment card numbers, government identifiers, or precise location.

Where the GDPR, the UK GDPR or a similar law applies, we rely on the following bases.

• To provide the Service you asked for (contract): making your lessons, answering tutor questions, running your account, credits, sharing and payments.
• To keep the Service safe and working (legitimate interests): security, abuse and fraud prevention, rate limits, error reporting, backups, and checking that questions comply with our Terms before a lesson is made.
• To improve the Service (legitimate interests): understanding which features are used and how lessons perform, using aggregated or de-identified data wherever possible. We do not use your content to train AI models.
• To communicate with you (contract and legitimate interests): account emails such as verification, password resets, lesson-ready notifications and important notices. Marketing emails are sent only with your consent, and every one has an unsubscribe link.
• Your voice (explicit consent): cloning your voice to narrate your lessons. You can withdraw consent at any time by deleting the recording.
• To comply with the law (legal obligation): tax and accounting records, responding to lawful requests, and handling notices about illegal content.

We do not make decisions about you by automated means that have legal or similarly significant effects. The automated check that declines questions which break our Terms can be reviewed by a person on request.

We never sell personal data and we do not share it with advertisers. We share it only with providers who process it on our behalf and under our instructions, and only what each one needs:

• AI model providers (OpenAI, Google, Anthropic): the question you asked, the files you upload to make a lesson from, the material gathered for it, scripts, scene descriptions, frames of your lesson and your tutor questions, to research, write, draw, check and answer. We use these providers’ business APIs, whose terms do not permit training on the data we send.
• Speech providers (OpenAI, Google, ElevenLabs): the script to narrate and, if you use your own voice, your recording, to synthesise narration and the temporary clone.
• Hosting and storage (DigitalOcean for the servers and database, Cloudflare for the network and for video storage): everything the Service stores.
• Email delivery (Brevo): your email address and the content of account emails.
• Error reporting (Sentry): technical details of errors, configured not to include request bodies, cookies or email addresses.
• Payments (our payment processor, once paid plans open): the details needed to take and record a payment.

We may also disclose data when the law requires it, to respond to a valid legal request, to protect the rights and safety of users or the public, or as part of a merger, acquisition or sale of the business, in which case the successor is bound by this policy.

What other users see. Your username, profile, comments, reactions and the lessons you share are public. Your name, email, private lessons, recordings, tutor conversations and billing are not.

We are based in Armenia and our providers operate in the United States and elsewhere, so your data may be processed outside the country you live in. Armenia has its own personal data protection law, which we follow, and it is not currently covered by an EU adequacy decision. Where we transfer data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK addendum) with our providers, or on an adequacy decision such as the EU–US Data Privacy Framework where the provider is certified. You can ask us for details of the safeguards in place.

• Account and content: for as long as your account exists. When you delete your account (from settings, or by asking us) your profile, private lessons, courses, recordings, tutor conversations, reactions and comments are removed at once; shared lessons you did not make private first remain, attributed to a deleted account.
• Inputs sent to AI providers: the providers we use retain API data for up to 30 days for abuse monitoring, then delete it, unless the law requires them to keep it longer.
• Uploaded files: deleted 7 days after you upload them; the text and figures read from them are kept with the lesson made from them, for as long as that lesson exists.
• Voice recordings: until you delete them or close your account; per-lesson clones are deleted from the speech provider when the lesson finishes.
• Technical logs and error reports: up to 90 days.
• Billing and tax records: as long as the law requires, typically seven years.
• Backups: deleted data may persist in encrypted backups for up to 35 days before it is overwritten.

Depending on where you live, you may have the right to access the personal data we hold about you, to receive a copy in a portable format, to correct it, to delete it, to restrict or object to how we use it, to withdraw consent, and to complain to a supervisory authority. In the EEA that is the data protection authority of your country; in the UK, the Information Commissioner’s Office.

If you live in California or another US state with a privacy law, you have the right to know what we collect and why, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal data for cross-context behavioural advertising, so there is nothing to opt out of; we honour Global Privacy Control signals as an opt-out request regardless.

To exercise a right, email [email protected] from the address on your account, or use the contact page. We may ask you to confirm your identity. We respond within 30 days (45 days for California requests), and there is no charge unless a request is manifestly unfounded or excessive. You may appoint someone to act for you; we will verify their authority.

Several things you can do yourself: change your name, username and password, or delete your account, in settings; choose which emails you receive in notifications; delete your voice recording in My voice; make any lesson private from its page.

We use one essential cookie, xplainly_session, to keep you signed in for up to 30 days, and browser storage to remember preferences such as your theme and whether captions are on. These are strictly necessary and need no consent. We do not use advertising or cross-site tracking cookies. Our error-reporting tool collects technical details of errors as described above. We count visits without cookies: on each day a visitor is recognised only by a code made from their IP address and browser with a key that is deleted when the day ends, so a visit cannot be linked to a person or to another day, and the IP address is not stored. When you are signed in, a visit also records your account, so we can see how far people get with the Service; deleting your account removes that link. Browsers that send Do Not Track or Global Privacy Control are not counted. If we ever add analytics that require consent, we will ask for it first.

We protect your data with encryption in transit, hashed passwords, access controls, rate limits, security headers, and monitoring. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the relevant authorities as the law requires. Choose a strong, unique password and tell us at once if you suspect your account has been used without your permission.

The Service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child under 16 has given us data, contact us and we will delete it.

We will update this policy as the Service and the law change. The date at the top shows when it last changed. For material changes we will tell you by email or a notice on the Service at least 14 days before they take effect.

Privacy questions and requests: [email protected], or the contact page.