Privacy Policy

Last updated: July 21, 2026

This Privacy Policy explains how xFiLearn ("we", "us") collects, uses, and protects information when you use our learning platform (the "Service"). We act as a processor of the data our Customers store in their workspaces, and as a controller of the account and billing data we collect directly.

1. Information we collect

• Account information: name, work email, company name, phone number, and password (stored only as a secure hash) when you create an account.
• Workspace & learning data: team members, courses, enrollments, and progress that Customers create within their workspaces.
• Billing information: plan, seat count, and subscription status. Payment card details are handled by our payment processor and are not stored on our servers.
• Usage & technical data: log data such as IP address, browser type, and pages accessed, used to operate and secure the Service.

2. How we use information

• To provide, maintain, and improve the Service;
• To authenticate users and route them to the correct workspace;
• To process subscriptions and manage seats and plan status;
• To communicate with you about your account, security, and updates;
• To detect, prevent, and address fraud, abuse, and security issues.

3. Tenant isolation

Each Customer's workspace is stored in a separate, isolated database. We design the platform so that one workspace cannot access another's data. Access to Customer data by our staff is limited to what is necessary to operate and support the Service.

4. How we share information

We do not sell your personal information. We share information only with:

• Service providers (e.g., hosting and payment processing) who process data on our behalf under appropriate obligations;
• Legal authorities where required by law or to protect rights, safety, and security;
• Successors in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service. After account closure, we may retain and then delete data within a reasonable period, subject to legal obligations.

6. Security

We use technical and organizational measures to protect information, including database-per-tenant isolation, least-privilege database access, encrypted transport (HTTPS), and hashed passwords. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights

Depending on your location, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. Because much of the data is controlled by the Customer whose workspace you belong to, please direct workspace-related requests to your workspace administrator; we will assist our Customers in responding. To exercise rights regarding data we control directly, contact us using the details below.

8. International transfers

We may process and store information in countries other than where you reside. Where required, we implement appropriate safeguards for such transfers.

9. Children

The Service is intended for use by organizations and their workforce and is not directed to children under the age required by applicable law without appropriate consent.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated through the Service or by email, and the "Last updated" date above will be revised.

11. Contact

For privacy questions or requests, contact us at Support@hixfi.com.