XYSHIMAUNIThis notice describes how XYSHIMA Uni processes account, coursework, project, journal and AI-workspace data, the purposes and lawful bases, retention, recipients, personalization, international transfers and GDPR rights.
XYSHIMA Uni is provided by Masoud Elahian, trading as Xynara Analytics, Vasileos Evagorou 3, P.O. Box 6023, Larnaca, Cyprus. For the consumer Uni service, Masoud Elahian is the controller unless a specific processing activity states otherwise. Privacy requests: support@xyshima.com.
Email, user ID, authentication metadata, shared account age band, country of residence and guardian-approval status where applicable, plus Uni country or region, university, degree or programme, study level, discipline, academic stage and the main academic goal you select.
Course names and codes, syllabus text, instructor names you enter, course progress, tasks, deadlines, exams, study blocks, priorities and completion state.
Project titles, types, objectives, next actions, methods, files, findings, feedback, citations and other project context you choose to store.
Document titles, file references, source URLs, citations, notes and uploaded academic material used for grounding requested AI work.
Journal dates, study method, workload and optional self-ratings such as mood, energy, stress and focus, plus reflections, obstacles and next plans that you choose to record.
Prompts and context sent for requested AI tasks, model tier and usage accounting, subscription/payment references, support records, and Study Group membership or messages where those features are used.
Data minimisation: do not upload or write personal data about other people, confidential employer/client information, health information, political/religious information, biometric/genetic data or other special-category data unless it is genuinely necessary for your academic task and you have a lawful basis to use it.
Account operation, persistent academic workspace, course/project storage, AI assistance, personalization, uploads, planning, billing and support are generally processed because they are necessary to provide the service you request or to take requested pre-contract steps.
Tax/accounting records, valid legal notices, payment/refund records and privacy-rights handling may be retained where required by applicable law.
Security, fraud/abuse prevention, rate limiting, service reliability and incident investigation may rely on legitimate interests, balanced against your rights and expectations.
Optional product analytics and optional marketing are separate from the core service and operate only after an affirmative choice where consent is the applicable basis. Consent can be withdrawn for future processing without affecting prior lawful processing.
XYSHIMA Uni may infer an academic working state from information such as course progress, upcoming deadlines, open tasks, workload, journal study signals and project status. This is used to rank suggested next actions and tailor academic assistance.
These profiles are educational productivity guidance. XYSHIMA Uni does not use them to make admissions, official grading, employment, credit, disciplinary or other decisions that produce legal or similarly significant effects. You may ask questions about this processing or exercise applicable rights through Settings → Data & Privacy.
When you ask for AI assistance, relevant prompts and academic context may be sent to the configured AI provider to generate the requested response. XYSHIMA Uni routes routine study utilities, normal academic reasoning, project and lab-report tasks at different model/reasoning levels. Avoid placing unnecessary personal or special-category data in prompts. AI output can be wrong and should be checked against appropriate academic sources and course requirements.
Service providers can include Supabase for authentication/database infrastructure, Cloudflare for hosting/security, OpenAI for AI functionality, PayPal for payments and configured email infrastructure for service messages. See Service Providers. Some processing may occur outside Cyprus or the EEA. Where required, XYSHIMA relies on an applicable adequacy decision, Standard Contractual Clauses or another lawful transfer safeguard and must maintain the relevant provider documentation.
Uni account and academic-workspace data is generally retained while the account is active. Signed-in users can permanently delete the shared XYSHIMA account from Settings → Data & Privacy after a fresh password and security check. Because the same sign-in is used for XYSHIMA School and XYSHIMA Uni, self-service deletion removes both workspaces together.
Uni profile, courses, projects, library metadata, planner/journal data, the linked authentication account, connected School learning data, and uploaded School study files are removed. Active XYSHIMA and Uni renewal subscriptions linked to the account are cancelled first.
If the account owns a Study Group with another active member, ownership is transferred so the other members do not lose their shared group; messages written by the deleting account are removed. Payment/accounting records, a minimal completed-deletion record, or information required for a legal hold, dispute, fraud/safety investigation or another lawful exception may remain without an active account link.
Optional analytics has a target retention of up to 13 months. Closed privacy-request case records have a current target of 3 years where needed to demonstrate request handling. A one-way coded deletion marker is retained to record that deletion occurred and to prevent repeated free trials by deleting and recreating the same email; the marker does not store the readable email address.
Where applicable, you may request access, rectification, erasure, restriction, portability and objection; withdraw consent for consent-based processing; and complain to a supervisory authority. Signed-in users can download a machine-readable account/Uni export, permanently delete the shared account, or submit another tracked request from Settings → Data & Privacy. We may carry out proportionate identity verification and normally respond without undue delay and within one month; a lawful extension may apply for complex or numerous requests.
In Cyprus, the supervisory authority is the Office of the Commissioner for Personal Data Protection.
Essential storage supports authentication, security and requested workspace functions. Optional analytics is not required for Uni and must not be activated without an appropriate affirmative consent mechanism where required. The current Uni interface does not provide an optional-analytics opt-in. See the Cookies & Analytics Notice. Rejecting optional analytics must not block the core service.
XYSHIMA uses one shared age and legal profile across School and Uni. Under the current product policy, independent accounts for users under 14 are not permitted. Users aged 14–17 must complete the shared account profile and obtain parent or legal-guardian approval before the Uni workspace becomes available. Users aged 18 or older may continue after accepting the current account terms. A current legal profile is reused across both products so users are not asked to complete the same age and guardian process twice. Additional safeguards may apply to particular features such as Study Groups.
This notice is updated when Uni processing materially changes. A privacy notice is information, not blanket consent. If a future activity requires consent or a new contractual/legal acceptance, XYSHIMA must ask for that separately instead of treating continued use as consent.