Security and privacy
How we protect your data
Teachers, schools and families trust us with information about children. Here is how we handle it, in plain words, and what we do not claim.
- Payments by Stripe
- Data in Supabase
- 27 years of experience
In short
- We ask for as little as possible, and say why.
- Card numbers go to Stripe. We never see them.
- Every page is delivered over HTTPS. Access codes and IP addresses are stored in scrambled form.
- You can download your data or delete your account yourself at account.xaglobal.app.
- We hold no security certification (such as ISO 27001 or SOC 2), and we do not claim to meet children's privacy laws such as COPPA or FERPA. We would rather say that than overpromise.
Students and children
Our apps are used by teachers, schools and families, and some are used by children. The person who subscribes must be an adult (18 or over), and that adult accepts our Terms for any child who uses the app.
- The school or the individual owns and controls student data. We process it to run the service for you. We do not sell it.
- Children's screens ask for no names, apart from one form on the education website that a parent fills in about their own child.
- Secure IEP: we encourage teachers to use initials rather than full names. Drafts are mostly kept in the teacher's browser, and the AI step goes through our servers to the AI provider.
- StudyWatch: the camera check is optional, runs on the device, and no pictures are sent to us. We do not use face recognition on children.
- A teacher should check what an AI app produces before using it. AI can be wrong.
The principles we work by
XAG is a small business based in Thailand. Our Privacy Policy is written with Thailand's Personal Data Protection Act (PDPA) in mind, and with the general principles found in laws such as the EU's GDPR. In everyday terms:
- Only what is needed. A form asks for the details it needs to reply to you, and no more.
- Clear purpose. We tell you what we use your details for, at the place where you give them.
- Limited time. We keep form messages and teacher information for 24 months and then delete them with a daily job. Database backups are kept for 30 days, server logs for up to 12 months, and our support mailbox for up to 2 years.
- Your rights. You can ask to see, correct, export or delete your data, and to object to how we use it.
- Safe handling. See "How we keep it safe" below.
- Providers abroad. The companies in the next section may process data in other countries. The Privacy Policy explains this.
These are working principles, not a certification, and following them is not the same as a legal audit.
Where your data lives
| Provider | What it does for us | What is held there |
|---|---|---|
| Supabase | Our database and sign-in | Account emails and plan status, form messages (name, email, message), practice results in MAP Trainer, and the other things you save in an app. Access codes are stored only as a scrambled (hashed) value. |
| Cloudflare | Hosting and delivery of our websites and the small server functions behind them | The pages you load and the traffic that passes through. Secret keys for our services are kept in Cloudflare settings, not in the pages. |
| Stripe | Payments | Your card details. You type them on Stripe, not on our pages, so we never see or store your card number. We keep your customer reference and plan status, and, to keep to one free trial per customer, a scrambled form of a card identifier. |
| Resend | Sending email | The text of emails the system sends, such as a notice that a form was received, and the addresses they go to. |
| An AI provider (today Google Gemini) | The AI features in most apps | What you type or upload to an AI feature is sent to the provider to produce a reply. The apps can switch provider. See the note on AI below. |
| Your own device | Some data never leaves your browser or computer | StudyWatch sessions and its optional camera check stay in your browser. Secure IEP drafts are mostly kept in the teacher's browser. Chalkline classroom data stays on the teacher's computer. |
We also use GitHub to keep our code (it should hold no customer data) and to store encrypted copies of our database. The full list of providers is in the Privacy Policy, and it will change as our hosting moves to Cloudflare.
How we keep it safe
Encryption in transit
Our websites are served over HTTPS, and browsers are told to always use it (HSTS).
Scrambled values
Access codes are stored only as a one-way hash. IP addresses in our forms are stored hashed, to prevent abuse.
Encrypted backups
A nightly copy of the database is encrypted (AES-256) and kept for 30 days.
Keys stay on servers
Secret keys for payments, email, AI and the database are used only on servers. They are not placed in web pages.
Access rules
The database uses row-level security, and admin access is limited to the owner. Payment events from Stripe are checked for a valid signature.
Limits against abuse
AI features need an access code, have request limits, and lock out repeated wrong codes. Browsers receive strict security headers.
What we have not done: we have not had an independent security audit, and customer data is held in a shared database project separated by access rules rather than in a separate database for each customer. If you need more for a school, ask us before you buy.
AI and your content
Most of our apps send what you type or upload to a third-party AI provider to produce a reply. Our Terms say we do not ourselves train AI models on your data. We cannot make promises for the provider, so please do not enter anything into an AI feature that you are not allowed to share, and keep student details to a minimum.
Your data, your control
Sign in at account.xaglobal.app with the email you used. There you can:
- Download my data, a copy of what we hold about you.
- Delete my account and data. You type your email to confirm. Records of payments are kept, either without your personal details or untouched, because a payment record cannot simply disappear.
- Manage billing in the Stripe portal, including cancelling.
Prefer to write? Email [email protected] and we will help. For a form message you sent us, tell us the email address you used.
Questions or a concern
Write to [email protected]. If you think you found a security problem, please send the details there and give us a reasonable time to fix it before you tell anyone else. Please do not test on other people's data.