Privacy Policy

When you use Nexelia, we collect the following information:

• Account information: your name, email address, and password (hashed).
• Age and country: your date of birth and country of residence, collected at signup so we can apply the right minimum age. See section 9.
• Parental consent records: if you are below the age of consent where you live, your parent or guardian’s email address, the date they agreed, and the IP address and browser they used. We keep this as evidence that consent was given.
• Study progress: which questions you answer, flashcard reviews, exam attempts, and accuracy data.
• Your written answers: everything you type into exam questions, essays and the AI tutor.
• Photographs you upload: pictures of handwritten work, for marking. These are deleted after 30 days.
• Preferences: exam board, subjects of interest, daily study goals, and exam dates.
• What you tell us about yourself: at signup and afterwards you can tell us which days you study, what tools you like, what you do outside school, and anything else you want the tutor to know. That last box is free text and some people use it to mention a learning difficulty or an accommodation. Section 2 says where it goes.
• What Nexo works out about you: from all of the above, Nexelia builds a picture of how you learn: which topics you find hard, how you like things explained, how your week is going, and an estimated grade. Section 2 says how to switch this off.
• Usage data: pages visited, features used, and device/browser type. See section 8 for which of this is optional.
• Payment information: processed securely by Stripe. We do not store your card details.

• Teaching and marking: to mark your answers, generate explanations, and adapt what you are shown to what you find difficult.
• Personalisation: to generate study plans, track your progress, and recommend content.
• Age assurance: to decide whether you can use the service directly or need a parent’s agreement first.
• Service improvement: to understand how the platform is used and improve it.
• Communications: assignment reminders, weekly digests, and account notifications. You can opt out of non-essential emails.
• Security and reliability: to detect abuse and to record technical errors so we can fix them.

Nexo builds a picture of you, and you can switch it off

Nexo is the part of Nexelia that adapts to you. It notices which questions you get wrong, when you study and what trips you up, and uses that to choose what to show you next and to estimate a grade. This is on by default.

You can see everything it has worked out, correct anything that is wrong, and turn it off, in either of two places: your learning profile or your account settings. It is the same switch in both.

You can also delete what it has already worked out. At the bottom of your learning profile there is a button that wipes the profile on that page and Nexo’s summaries of your tutor sessions. It does not touch your answers, your marks, your progress, your tutor conversations themselves, your study plan, your predicted grade, or the corrections you made to the profile, because those are your own words.

The switch and the button are two different things and you can use either without the other. One stops Nexo learning and keeps what it already learned. The other wipes what it learned. If you delete without also switching off, Nexo starts building the profile again from your next sessions, so the button offers to do both and we suggest both.

What is sent to the AI companies, and what the switch stops

We do not run our own AI. Marking, the tutor and Nexo’s suggestions are produced by outside companies, listed in section 4, and to answer they have to be sent something. That is:

• What you wrote: the answer, essay or tutor message itself, and any photograph of handwritten work.
• What you told us about yourself: your study days, the tools and activities you listed, and the free-text note. If you mentioned an accommodation there, it is sent so the tutor can take it into account.
• What Nexo worked out: the topics you find hard, how you prefer things explained, how your week has gone, and your target grade.

⚠ Turning the switch off stops the second and third of those. What you actually wrote still has to be sent, because there is no way to mark an answer without sending the answer. Nothing else about you goes with it.

⚠ The trade is worth knowing before you make it. If you told us about an accommodation, switching off stops that reaching the tutor as well, so the tutor stops taking it into account. We would rather say so plainly than have you find out. Your study plan and coach keep using what Nexo already learned, and nothing already learned is deleted, and switching back on restores it.

Your account, your work and your files are stored in the European Union. Our database, login system and file storage run on Supabase in Ireland (eu-west-1), and our error monitoring runs in Sentry’s EU region.

One piece of this is not in the EU, and we would rather name it than let the sentence above cover it. Our short-term cache, Upstash, runs in London, in the United Kingdom. It holds cached tutor answers, and counters keyed by your account ID (five password-change attempts in fifteen minutes) and, on the public demo only, by your IP address. Cached answers expire on their own: seven days for text, thirty for interactive widgets. The United Kingdom is outside the EU and outside the EEA. The European Commission has decided that UK data protection law offers adequate protection, and that adequacy decision is what permits this, rather than any contract we have signed.

Our hosting provider, Vercel, runs our code in Dublin, the same city as the database. Until 1 September 2026 it ran in Washington DC, and this notice said so.

⚠ That does not make Nexelia an EU-only service, and we will not describe it as one. Vercel’s routing layer, which sees every request before our code does, runs in data centres worldwide including the United States, and we cannot switch that off. It reads the address you are visiting and your sign-in cookie. So some of your data still touches the United States on every request, even though the part that reads your answers now runs in Ireland. Several of the services in section 4, including the AI providers, process data outside the EU as well.

If you are a school asking whether all processing happens in the EU, the honest answer is no, and nothing on this page should be read as a guarantee that your data never leaves it.

All data is encrypted in transit (TLS) and at rest in our database. We keep your data for as long as your account is open. What governs how long each kind of thing lives is set out in section 5.

We use the following services to operate Nexelia. Those that receive things you have written are marked, because that is the part most worth knowing.

• Supabase (EU, Ireland): database, authentication, and file storage.
• Vercel (United States): website hosting and the servers that run our code.
• Google Gemini: receives your written work, and unless you switch Nexo off, what you told us about yourself and what Nexo worked out. Marks your answers, powers the tutor and makes its interactive widgets. Photographs of handwritten work are sent to Google for marking.
• Groq (United States): receives your written work, and unless you switch Nexo off, what you told us about yourself and what Nexo worked out. Generates tutor replies and hints.
• Google Cloud Text-to-Speech: turns chapter text into audio. Receives our lesson content, not your work.
• Upstash (United Kingdom, London, not the EU, see section 3): short-term cache. Holds cached tutor answers, and counters keyed by your account ID and, on the public demo, by your IP address.
• Sentry (EU): records technical errors so we can fix them. It receives the page address and the error itself. It no longer receives your account ID. We removed that on 11 September 2026, so an error report can no longer be traced back to you by us or by anyone with access to it.
• Stripe: payment processing. Receives your email address and what you bought.
• Resend (United States): sends our emails. Receives the recipient address and the message.
• Google Analytics: website analytics on our public pages, only if you accept cookies. See section 8.

We would rather tell you what governs how long something lives than give you a list of numbers. A number goes out of date the moment it changes; a reason stays true and lets you check us against it.

⚠ For most of what we hold, the clock is not a clock. Your work is kept because the product is built on it: your progress, your weak topics and your revision history are the service. So the thing that ends retention is normally you deleting your account, not a timer expiring.

Being honest about the shape of this: two things above are on a timer, photographs and your cookie choice. Everything else is kept for as long as your account is open, and goes immediately when you delete it. The control is in your hands and it is in section 7. There is one more timer, and it only starts if you stop using Nexelia altogether.

If you stop using Nexelia, we do not keep your work forever

We would rather delete a dormant account than hold a student’s schoolwork indefinitely because they never came back.

If you have not signed in for three years, we email you to say the account will be deleted, and we delete it 30 days later unless you sign in. Signing in is all it takes; the clock resets and you will not hear from us about it again.

If you signed up but never finished setting the account up, the period is one year rather than three. There is no work to lose in that case, and it usually means a parent was asked for their agreement and never gave it.

Where a parent gave their agreement for you to use Nexelia, we email them too. We use the address they gave us on that agreement, and only while it still stands. If they have withdrawn it, or never confirmed it, we do not write to them. We do this because an account nobody has opened for three years often has an email address nobody reads any more, and we would rather two people were told than delete a student’s work on a notice that went nowhere.

We always warn you first, and we never delete an account we have not warned. When we do delete, everything goes: your answers, your progress, your tutor conversations and anything you uploaded.

These get confused, and the difference matters, so here is each one plainly.

⚠ The one people get wrong: withdrawing parental consent closes the account, it does not erase the data. If a parent withdraws consent, the student can no longer sign in, and because they can no longer sign in, they can no longer run the deletion themselves. If you want both, delete the account first, then there is nothing left to withdraw. If consent has already been withdrawn and you want the data gone too, write to us and we will do it.

You have the right to:

• Access: request a copy of the data we hold about you.
• Correction: update or correct inaccurate information via your account settings.
• Deletion: delete your account and its data at any time from Account settings → Danger zone. This happens immediately, and removes your answers, progress, tutor conversations and any photographs you uploaded.
• Portability: request your data in a machine-readable format.
• Withdraw consent: change your cookie choice at any time from the “Cookie preferences” link in the footer. A parent who gave consent can withdraw it using the link in the email they received, at any time.
• Objection: opt out of non-essential communications at any time.
• Complain: raise a concern with your national data protection authority. In Spain that is the Agencia Española de Protección de Datos, aepd.es. If you live elsewhere in the EU or the UK, you can complain to your own country’s authority instead.

If there is an active complaint or legal process

Where a complaint, claim or legal process is under way and involves you, we may need to keep some data that we would otherwise delete, to handle, defend or resolve it. If that happens we keep only what is needed for that purpose, use it for nothing else, delete the rest, and tell you what we have kept and why. This is the exception in Article 17(3)(e) GDPR.

⚠ To be straight with you: this is a commitment about how we would behave, not a description of a system that already exists. We have no automated legal-hold mechanism. If this ever applies, a person will do it by hand and write to you. We would rather say that than describe machinery we have not built.

We use cookies that are necessary to run the site: keeping you signed in, and remembering your cookie choice itself. These do not ask permission because the site cannot work without them.

Google Analytics is optional and off by default. We do not load it at all until you press Accept. It runs only on our public marketing pages, never inside the product, and never while you are signed in. If you accept, it sets two cookies that last 400 days. Google keeps the underlying event data for 2 months and user-level data for 14 months.

You can change your mind at any time using Cookie preferences in the footer. Withdrawing deletes the Google Analytics cookies as well as stopping any further collection. A full list of every cookie and stored value is in our Cookie Policy.

Data protection law sets a minimum age at which you can agree to a service like this on your own. It differs by country: commonly 16, but as low as 13 in some places. We ask for your date of birth and country of residence at signup so we can apply the right one. If your country is not on our list, we apply 18.

If you are below that age, you can still use Nexelia, but we ask for a parent or guardian’s email address and email them for their agreement first. Your account stays inactive until they confirm. They can withdraw their agreement at any time using the link in that email, which closes the account.

We keep a record of who agreed and when, because we have to be able to show that consent was given.

Most of what you write on Nexelia is yours alone: your answers, your essays, your tutor conversations. When you delete your account, those go with it.

A few places are shared with other people, and there the rules differ depending on the space:

• Question discussions and peer reviews: what you wrote is deleted along with your account.
• Community resources you shared: the resource stays, detached from you. Your name and the link to your profile are removed, and it is no longer connected to you.

Where something stays, we keep it under Article 17(3)(a) GDPR, which allows content to be retained where it is necessary for other people’s freedom of expression and information. A shared library is several people’s work, and removing one contribution can leave what others built on top of it meaningless.

⚠ This is not an automatic rule you have to accept. If something you wrote identifies you by its own content even after your name is removed, tell us and we will look at it individually. We can edit it, remove part of it, or delete it entirely. That is an open channel, not an exception you have to earn.

⚠ We have not designated a Data Protection Officer. We are not currently required to, and we would rather say so than leave you looking for one. Privacy requests go to the address below and are handled by the team directly.

For any privacy-related questions or requests, contact us at main@nexeliaacademy.com.