Privacy Policy
1. Data we process
We process account details (name, email), authentication data (Argon2 password hashes, session tokens), learning records, consent records, and audit logs. For each customer organization we also keep business details and a main contact, described in section 2. We do not collect biometric or facial data.
2. Customer organizations and their contacts
For each organization that uses XZYLEARN we record its name and logo, its industry, its country and how it came to us, and the name, work email and phone number of its main contact. We use these to run the organization’s account and to understand which industries and countries use the platform. We send news and offers to the contact’s email only if the contact has agreed, and we record when they agreed; the contact can withdraw at any time by telling us, and we then stop. These details are visible only to XZYLEARN platform administrators.
3. Tenant isolation
Each organization’s data lives in its own dedicated database. Isolation is enforced at the connection layer on every request — never by frontend filtering. Only platform Super Admins can cross tenant boundaries, and every such action is written to the immutable audit log.
4. Retention
Consent and audit records are append-only and never hard-deleted; they are retained per policy. Other records are retained for the lifetime of your organization’s account unless deletion is requested.
5. Your rights
You can access and correct your personal information and request deletion subject to legal retention requirements. Contact XZYLEARN, or the organization that provided your access, to exercise these rights.
6. Security
We enforce Argon2 hashing, JWT rotation with revocable refresh tokens, RBAC, rate limiting, TLS everywhere, and encryption of sensitive data at rest.