Your content is secure. Your privacy is protected.
Plain-language answers to how XAM handles your files, your questions, and your students’ data. No legal hedging, no small print, just what you actually need to know.
- Stored securely, never shared with third parties.
- Never used to train AI models. Ever.
- Your question bank is yours, never shared across accounts.
- GDPR-compliant.
Individual educator
Quick answers on what happens to your files and content before you upload your first document.
IT administrator
The technical and compliance detail an IT team needs to evaluate XAM for institutional deployment.
Data protection officer
GDPR rights, data-handling practices, and how to exercise rights or request deletion and a DPA.
What happens when you upload a document.
The question most educators have before they upload anything for the first time, answered in order.
When you upload a file
It travels to XAM over an encrypted connection (HTTPS/TLS). XAM reads it, extracts the text and images, and stores that content in encrypted cloud storage, solely to generate your questions.
PDF · DOCX · CSV · TXT
Where your file is stored
Extracted content sits in secure, encrypted cloud storage, isolated to your account. No other user or organisation can reach it, and it stays in your File Manager while your account is active.
Reachable only from your account
What the AI does with it
The AI reads your extracted content to generate questions, and nothing more. Your files are never used to train, fine-tune or improve any AI model, including ours.
Never contributes to AI training
What XAM never does
Your files are never shared with third parties, never sold or licensed, and never used for advertising or research. Only for generating your questions.
Deleting your files
Delete any file from the File Manager whenever you like and the stored content is removed. Close your account and all uploaded files and generated content go with it.
Account deletion: privacy@xam.pro
Your past papers and curriculum stay yours.
The materials educators upload are confidential: proprietary curriculum, past exams, working notes. They're encrypted, isolated to your account, and never used to train anything. Upload the first document without a second thought.
What happens to the questions you generate.
Your most valuable asset in XAM. It's safe, it's yours, and it doesn't vanish if you change plan or leave.
Your questions belong to you
Everything you generate, import or edit is stored in your account and is yours. XAM claims no ownership, and you can export your whole bank any time in six formats.
PDF · Word · Excel · CSV · JSON · TXT
Isolated to your account
Your bank is never shared with other users or organisations. On the Institutional plan, questions are shared within your organisation only, never beyond it.
If you cancel or downgrade
Drop from Educator Pro to Free and your full bank is preserved; you keep every question. You lose only the Pro features, not your content. Closing entirely? Export first.
What happens when students take an assessment.
For institutional buyers, GDPR for student data is a legal obligation. Here's exactly what's collected, who sees it, and how long it's kept.
How students access it
Through a shareable link from their teacher. No student account, no registration, and no personal information required to take an assessment.
No student account needed
What's collected
On submission, XAM records the responses and the time. If the teacher asks students to identify themselves by name or ID, that's collected too. Nothing else is gathered automatically.
Only what the teacher asks for
Who can see responses
Only the teacher who published it, and on Institutional plans, admins in the same organisation. Never visible to XAM staff in normal operation, and never shared with third parties.
How long it's kept
For as long as the teacher's account is active. Teachers can delete individual submissions or a whole assessment's responses from the Teacher Panel, and closing an account deletes it all.
Delete any time from the Teacher Panel
Important for schools and colleges
When XAM is used to deliver assessments to minors, the institution, as the data controller, is responsible for appropriate consent and data-handling under GDPR and local law. XAM acts as a data processor on the institution’s behalf. A Data Processing Agreement is available on request at privacy@xam.pro.
XAM will never use your content to train AI.
An unconditional commitment, not a policy that changes with plan upgrades or terms updates.
- XAM does not use your uploaded documents to train AI models.
- XAM does not use your generated questions to train AI models.
- XAM does not use student responses to train AI models.
This applies to all users, all plans, at all times, past, present and future. The AI models XAM uses come from third-party providers, and our agreements with them explicitly prohibit using your content for training. If that ever changes, we’ll tell you in advance and get your explicit consent before any content is used.
For IT administrators and technical evaluators.
The specifics an IT team needs to evaluate XAM for deployment. Where we can't be specific here, we say so and give you a path to the detail.
Data in transit
Everything between XAM and users is encrypted with TLS. Connections are HTTPS-only, and any unencrypted request is redirected automatically.
Data at rest
All stored data, uploaded files, extracted content, generated questions and student responses, is encrypted at rest with AES-256.
Data residency
XAM's infrastructure runs with a major cloud provider. For the specific residency detail your evaluation needs, contact privacy@xam.pro.
Details on request
Access controls
Production access is restricted to authorised personnel using multi-factor authentication, logged and reviewed regularly. Staff have no routine access to your content.
Subprocessors
A limited set of third-party subprocessors deliver the service, including cloud storage and AI inference. The full list is available on request.
List on request: privacy@xam.pro
Incident notification
If a breach affects personal data, XAM notifies affected users and, where GDPR requires, the relevant supervisory authority within 72 hours of becoming aware.
Security testing
XAM runs regular security testing, including vulnerability assessments, to keep the service hardened.
Data Processing Agreement
A DPA is available for institutions that need one for GDPR, setting out XAM's obligations as a data processor.
Request: privacy@xam.pro
XAM is GDPR-compliant.
XAM meets GDPR for data handling, storage, security and user rights. It acts as a data controller for account holders' data, and as a data processor for student data handled on an institution's behalf.
| Your right | What it means |
|---|---|
| Right of access | Request a copy of any personal data XAM holds about you. |
| Right to erasure | Request deletion of your account and all associated data. |
| Right to rectification | Correct any inaccurate data held in your account. |
| Right to portability | Export your question bank and account data in a portable format. |
| Right to object | Object to processing for any purpose beyond delivering the service. |
| Right to restrict | Ask us to pause processing while a concern is resolved. |
To exercise any of these, contact privacy@xam.pro. We respond within 30 days.
What data we hold
- Account info: name, email, and password (stored as a hash, never plain text)
- Usage data: logins and feature use, to run and support the service
- Uploaded content extracted from your documents
- Your generated questions
- Student submissions from the Student Panel
Legal basis
- Contract: to provide the service you signed up for
- Legitimate interests: usage data for reliability and security
- Legal obligation: to meet GDPR duties, including breach notification
Retention
- Account data: while your account is active
- Files and questions: until you delete them or close the account
- Student data: until the teacher deletes it or closes the account
- Usage logs: only as long as needed for security and reliability
Your data is always portable. Leaving is easy.
A platform that makes it hard to leave is one that isn't sure of itself. Export whenever you like, and close your account cleanly.
Export your question bank
From the Repository screen, any time, in six formats: PDF, Word, Excel, CSV, JSON or TXT. No export limits, export as often as you like.
Six formats, no restrictions
Export your account data
Request a full export of your account data, including account info, file metadata and generated content, from privacy@xam.pro. Provided within 30 days.
Close your account
In Account Settings, choose Close account. Export your bank first if you want to keep it. Once closed, all files, questions and submissions are permanently deleted.
Closure is permanent
Questions, concerns, or requests.
Ask about how we handle your data, exercise a GDPR right, or report a security concern. We're direct and we respond.
We respond to privacy and data-protection enquiries within 5 working days, and to GDPR rights requests within 30 days. If you’re not satisfied with our response, you can complain to your national data protection authority, which in the EU is typically the supervisory authority where you’re based.
Secure by default, from your first upload.
Start free with 150 credits a month, no card and no time limit. For institutions, request a Data Processing Agreement any time.
No credit card required. Free plan, 150 credits a month. GDPR compliant.
Last updated: 5 August 2026