Data controller
The data controller is XPERYO (business being registered), Morocco. For any question about your data: contact@xperyo.com.
Our processing falls under Morocco’s Law No. 09-08. Declaration to Morocco’s data protection authority (CNDP): in progress. Where the General Data Protection Regulation (GDPR) applies, in particular to users in the European Union, we comply with it as well.
When a school or company uses XPERYO for its learners, it decides how their data is used and is responsible for it; we then act on its behalf, as a processor.
Data we collect
- Account: name, email address, hashed password, optional profile picture, language.
- Learning activity: courses and content you create, enrollments, quiz and assessment answers, scores, progress, experience points, decisions made in simulations.
- Organization: for Organization accounts, classes, programs, member roles and assignments.
- Billing: plan, purchase history, amounts, country and transaction identifiers sent by Paddle, Apple or Google. We never receive your card details.
- Technical data: IP address, device and browser type, sign-in and error logs, and, on Android, an app integrity verification token.
- Correspondence: the messages you send to support.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, provide the service | Performance of contract |
| Manage subscriptions, credits and billing | Performance of contract, legal obligation |
| Keep the service secure, prevent fraud and abuse | Legitimate interest |
| Measure and fix errors, improve the service | Legitimate interest |
| Answer your requests | Performance of contract, legitimate interest |
| Send you product news | Consent, which you can withdraw at any time |
We do not sell your data or use it for advertising.
AI processing
When you use an AI feature, what the generation needs — topic, instructions, course excerpts, an answer to grade — is sent to an AI model provider, which returns the result. We do not send your name or email address to these providers and we do not allow them to train their models on your data, to the extent their business terms allow. Avoid including personal data in your instructions.
Recipients and processors
Your data is available to authorized members of our team and, depending on your roles, to the trainers, facilitators and administrators of the courses and organizations you take part in. We use the following providers:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Switzerland (Zurich) |
| Hostinger | Hosting of the website and web app | European Union |
| Paddle | Payment, invoicing, taxes | United Kingdom, European Union, United States |
| Google (Gemini, Play Integrity) | AI generation, Android integrity checks | United States |
| OpenAI | AI generation | United States |
| OpenRouter | Routing to AI models | United States |
| DeepSeek | AI text generation | China |
| fal.ai | AI image and audio generation | United States |
| Apple, Google Play | In-app purchases on mobile | United States |
We may also disclose data when required by law or by a competent authority.
International transfers
Some providers are located outside Morocco and the European Union. These transfers comply with Law 09-08, with CNDP authorization where required, and, for data subject to the GDPR, rely on an adequacy decision or the European Commission’s standard contractual clauses. You can obtain a copy of these safeguards by writing to us.
Retention
- Account data and content: while your account is active. Deleting your account from the app erases them immediately, together with the courses, assessments and simulations you created.
- Backups: overwritten no later than 30 days after deletion.
- Invoices: kept by Paddle, our Merchant of Record, under its legal obligations. We keep no billing data after your account is deleted.
- Technical logs: 12 months at most.
- Support correspondence: 3 years after the last message.
Your rights
You can access your data, have it corrected or deleted, object to processing, ask for it to be restricted or receive it in a reusable format. You can delete your account directly from the app. To exercise your other rights, write to contact@xperyo.com; we reply within one month.
If you are a learner in an organization, first send your request to that organization; we will help it respond. You can also contact the CNDP (www.cndp.ma) or, in the European Union, the data protection authority of your country.
Cookies and local storage
The xperyo.com website uses no advertising cookies and no analytics, and its fonts are served from our own servers. The app uses your browser’s or device’s local storage to keep you signed in and remember your preferences. This storage is required for the service to work and is not used to track you.
Minors
People under 16 may only use XPERYO through a school or trainer, which is responsible for obtaining their legal guardians’ consent where the law requires it.
Security
Traffic is encrypted (HTTPS), passwords are stored hashed and access to data is controlled row by row in the database according to your roles. If a data breach is likely to affect you, we notify you and the competent authority within the legal deadlines.
Changes
We may update this policy. The effective date is shown at the top of the page; for material changes, we notify you in the app or by email. See also the Terms of Service.