Privacy Policy

1. Who is responsible

Mountain Inc CommV, Anjerstraat 9, 2340 Beerse, Belgium, enterprise number BE 0793.753.572, is the controller responsible for XAME's processing of personal data. Privacy contact: xame @ xame .ai.

This policy covers xame.ai, the public library and app.xame.ai, including the PWA. Website demonstrations run locally in your browser; demonstration answers are not stored on our server. There is no tester application form or website intake database.

2. Personal data we process

We process account and profile data needed for your account, such as email address and user identifier. For your learning environment we process education choices you provide, such as country, level, year, track, subjects and learning goals, together with planning, progress, practice answers and results.

We also process necessary session and connection data, technical errors, security information, notification preferences and technical push subscription details where applicable. If you contact us, we process information in your message. Active paid subscriptions also require subscription, transaction and invoice information.

Questions and necessary learning context are processed to answer AI Coach requests. We do not currently store personal Coach conversation histories. The current scope does not include student uploads of photos or documents or public publication of personal learning results.

3. Purposes and legal bases

Where necessary to perform a valid contract, we use data to provide your account, learning activities, planning, progress and requested AI answers. Processing that is not necessary for that contract cannot rely solely on that basis.

For necessary security and abuse prevention we may rely on legitimate interests after balancing your rights and interests, with particular attention to minors. Legally required records rely on a legal obligation. Optional website analytics rely on consent. We request consent for optional push notifications where required.

We handle contact and privacy requests on the basis of the contract, a legal obligation or an appropriate legitimate interest, depending on the request. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.

We use learning context for the learning support you request, not to build a personal marketing profile from Coach questions. Producing genuinely anonymous material itself requires a valid legal basis while the information remains identifiable; calling it anonymous does not replace that requirement.

4. AI Coach and anonymous content improvement

We currently use OpenAI to generate AI answers. Your question, necessary context and relevant learning content may be sent to OpenAI for this purpose. Do not share passwords, payment details or unnecessary sensitive information about yourself or others. We remain responsible for careful processing.

We retain questions, answers and feedback for improving XAME learning content only as genuinely anonymous material. No identifiable account link or recognisable personal information may remain in the text. While identification remains reasonably possible, we treat the material as personal data and applicable privacy rights remain available.

Genuinely anonymous material may remain after an account is deleted. We do not try to reconnect it to individual learners. There is no 90-day retention period for personal Coach conversations: such conversation histories are not currently stored.

Using XAME does not grant general permission to train external AI models with personal data. We do not promise that every AI processing operation takes place only in Europe or that every provider retains nothing. Changes to providers or storage of personal conversations will be reflected in the information and necessary safeguards beforehand; where required, we request consent.

5. Minors

Accounts are intended for users aged 13 and over. When consent is the legal basis for an online service offered directly to children, local age thresholds apply: 13 in Belgium and 16 in the Netherlands. This is separate from capacity to enter into every contract independently.

Where parental consent is mandatory, it must be obtained appropriately. Inviting a parent alone is not enough. Parents do not automatically receive access to conversations, answers or progress. Any future parent feature will have its own clear explanation of access and data sharing.

6. Providers and international processing

We use Supabase for account and database services, Vercel for hosting and OpenAI for AI answers. The selected region for the XAME database is Frankfurt, Germany. This does not mean that all processing by every provider takes place only in Germany or Europe.

Google Analytics may be used on the website after consent. Mollie and Stripe may process payments once paid subscriptions are actually offered; the method and provider are identified at checkout. A provider's role and independent legal obligations depend on the processing activity.

We share data only where necessary and lawful for the relevant task. Transfers outside the European Economic Area require applicable safeguards, such as a valid adequacy decision or standard contractual clauses with supplementary measures where necessary. You can ask us about applicable safeguards using our contact address.

We may disclose data where a legal obligation or another valid legal ground requires it. A library link does not give the external source owner access to your XAME account. The external website has its own privacy terms.

7. Website cookies and statistics

Necessary technologies support sessions, security and choices. A necessary cookie remembers your choice of Flanders, the Netherlands or USA for up to one year; USA opens the English website. This choice is not used for advertising.

If enabled, Google Analytics loads only after you allow analytics. Google receives technical connection data, a random cookie identifier, public page paths and selected button events. We do not send demonstration answers, student profiles, search terms or URL query parameters to website analytics. Advertising consent remains denied.

Your cookie preference is stored for up to 180 days. You can change or withdraw consent using Cookie preferences at the bottom of the website. Refusing leaves the website usable. This cookie period is not the same as retention of data within Google Analytics. Our scope uses website analytics only on the website, not in the learning app; necessary progress and security records are separate.

Website photographs and lesson illustrations may be AI-generated; the sample video uses an AI voice. These images do not depict actual users or customer testimonials.

8. Notifications

You can disable optional learning notifications. Push notifications also depend on permission and settings on your device or browser. Permission for these notifications does not automatically cover marketing newsletters, which we do not currently send.

9. Retention periods

Account data and learning history remain available while you use your account. After 24 months without logging in, and only without an ongoing paid subscription, we issue a warning allowing 30 days to respond before deletion. Logging in again prevents that deletion.

On account deletion, personal data is removed from active systems within 30 days unless a valid exception applies. A profile deletion button is planned and is not presented as available until it works. You can always exercise statutory privacy rights through our contact address.

Technical error logs are retained for up to 30 days and security logs for up to 90 days. For a specific incident only, relevant records may be kept longer where necessary for investigation, resolution or legal claims; this does not extend retention of all logs.

Genuinely anonymous questions, answers and feedback may remain for content improvement while that purpose remains relevant. This does not apply to text containing identifiable personal information. We do not currently store personal Coach conversation histories.

We retain contact information only as necessary for handling the matter and demonstrably necessary follow-up or a dispute. Financial records follow applicable statutory obligations. Backups follow the necessary recovery cycle and must not make deleted data available again for ordinary use. You can ask about the applicable cycle and exceptions.

10. Your privacy rights

Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests and withdraw consent. An exception, such as mandatory record retention, may affect what we can do; we explain this.

Send privacy questions or requests to xame @ xame .ai. We verify identity appropriately without requesting unnecessary evidence. We normally respond to GDPR requests within one month. Where legally permitted for complex or multiple requests, this can be extended by up to two additional months; we notify you within the first month and explain why.

11. Security and complaints

We take appropriate technical and organisational measures, including access restrictions, secure connections and data minimisation. No system is completely risk-free. Report suspected misuse without sending passwords or other secret access codes.

Contact us with complaints. You can also complain to the Belgian Data Protection Authority, the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority, including where you live or work as applicable.

12. Changes

We update this policy when the service or processing changes and appropriately notify you of important changes. Where new processing requires consent, we request it before starting that processing.