Privacy Policy

1. Information We Collect

We collect information you provide directly to us when you create an account or use our services, including:

• Account details: name, email address, and profile picture provided through Google OAuth or standard email signup.
• Payment metadata: subscription status, plan, and billing identifiers received from Stripe. We never receive or store your full credit-card number.
• Usage data: basic analytics about how you interact with the platform (pages visited, lessons completed) used to improve the service.

2. How We Use Your Data

• To provide access to the Academy and your member dashboard.
• To process payments and manage subscriptions through Stripe.
• To send important operational updates regarding your account, billing, or service availability.
• To improve our educational content and platform performance based on aggregated usage patterns.

We do not use your personal data for third-party advertising.

3. Data Security

We do not store credit-card information on our servers; all payment data is handled directly by Stripe’s PCI-DSS-compliant infrastructure. Personal data is transmitted over TLS, stored encrypted at rest, and protected in our database with row-level security policies that restrict access to your own records.

4. Third-Party Sharing

We do not sell your personal data. We share information only with the service providers strictly required to operate the platform:

• Stripe, our payment processor for payments and subscription management.
• Google, authentication when you choose to sign in with Google.
• Managed cloud infrastructure, hosting, database, and serverless functions used to run the application.

5. Data Controller and Legal Basis

The data controller is Orion AI Technologies - F.Z.C, Ajman Free Zone, United Arab Emirates. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and, where applicable to users in the European Economic Area or the United Kingdom, the GDPR. Processing relies on contract performance, legitimate interest in operating and securing the service, legal obligations, and your consent where required.

6. Data Retention

Account data is kept while your account is active and deleted or anonymised within 90 days of account deletion, except billing records that must be retained to meet tax and accounting obligations. Session activity logs are purged automatically on a rolling basis.

7. Your Rights

You have the right to access, correct, export, or request the deletion of your personal data at any time. To exercise any of these rights, or to delete your account entirely, contact support@xauproacademy.com. We respond to verified requests within 30 days.

8. Age Restriction

The platform and its subscriptions are intended only for persons aged 18 or older. We do not knowingly collect data from minors and will delete any such data brought to our attention.

For information on the risks associated with using our educational content, see our Risk Disclaimer.