Privacy Policy

XAM (“we”, “us”) provides the XAM assessment platform. We act as a data controller for the personal data of account holders (educators), and as a data processor when we handle personal data on behalf of an institution, such as student assessment data.

For any privacy question or to exercise a right, contact privacy@xam.pro.

• Account information: your name, email address, and password (stored as a hash, never in plain text).
• Usage data: records of logins and feature use, to run the service and resolve issues.
• Uploaded content: text and images extracted from the documents you upload, stored securely and tied to your account.
• Generated questions: the content of your question bank.
• Student submissions: responses submitted via the Student Panel, tied to the assessment and visible to the educator.

We process personal data on these bases under GDPR:

• Contract: processing necessary to provide the service you signed up for.
• Legitimate interests: usage data to maintain the reliability and security of the service.
• Legal obligation: processing needed to comply with applicable law, including GDPR security and breach-notification duties.

We never use your content to train AI models. Your uploaded documents, your generated questions, and student responses are never used to train, fine-tune or improve any AI model, including ours. This applies to all users, all plans, at all times.

The AI models we use to generate questions come from third-party providers, and our agreements with them explicitly prohibit using your content for training. If that ever changes, we will notify you in advance and obtain your explicit consent first.

We never sell your data, and we never share your files or content with third parties for their own purposes. To deliver the service we use a limited set of subprocessors, including cloud storage and AI inference providers. A full list of subprocessors is available on request at privacy@xam.pro.

When you submit a form on our website (for example the contact, onboarding, or institutional enquiry forms), we collect the details you provide, such as your name, email address, and message, so we can respond. Our legal basis is taking steps at your request and our legitimate interest in answering enquiries.

These enquiries are stored securely and are visible to our team. We keep them for up to 24 months and then delete them, unless they have become part of an ongoing customer relationship. You can ask us to delete your enquiry at any time at privacy@xam.pro.

Data is encrypted in transit (TLS) and at rest (AES-256), and your content is isolated to your account. Access to production systems is restricted to authorised personnel using multi-factor authentication. The technical detail is on our Security & Privacy page.

• Account data: for as long as your account is active.
• Uploaded content and generated questions: until you delete them or close your account.
• Student submissions: until the educator deletes them or closes the account.
• Website enquiries: up to 24 months, then deleted.
• Usage logs: only as long as needed for security and service reliability.

Under GDPR you have the right to:

• Access: request a copy of the personal data we hold about you.
• Erasure: request deletion of your account and associated data.
• Rectification: correct inaccurate data in your account.
• Portability: export your question bank and account data in a portable format.
• Object: object to processing for any purpose beyond delivering the service.
• Restrict: ask us to pause processing while a concern is resolved.

To exercise any of these, contact privacy@xam.pro. We respond within 30 days. If you are not satisfied with our response, you can complain to your national data protection authority, which in the EU is typically the supervisory authority where you are based.

When XAM is used to deliver assessments to students, and especially to minors, the institution acts as the data controller and is responsible for appropriate consent and data handling under GDPR and local law. XAM acts as a data processor on the institution’s behalf. Students do not need an account to take an assessment. A Data Processing Agreement is available on request at privacy@xam.pro.

We may update this policy as the service evolves. When we make material changes, we will update the date above and, where appropriate, notify you.

Privacy and data protection: privacy@xam.pro. Security concerns: security@xam.pro. General enquiries: contact@xam.pro. See also our Cookie Policy and Terms of Service.