Legal
Privacy Policy
How Xpversity collects, uses, and protects personal data for accounts, courses, XP, and payments.
This Privacy Policy explains how Xpversity (“we”, “us”, “our”) collects, uses, stores, and protects personal data when you visit xpversity.com, create an account, enroll in courses, use the character and XP features, pay through Stripe, or contact us.
Xpversity is operated by NeuroCoWorks. This policy should be read together with our Terms of Service and Refund Policy.
If you sign in with Google, Google shares basic profile information with us according to your Google account settings and our OAuth consent screen.
1. Who We Are
Xpversity — The MMO University
Operated by NeuroCoWorks
Santaroza 3, Athens, Greece 10564
Email: [email protected]
For GDPR purposes we act as the data controller for personal data processed through the Xpversity platform as described below.
2. Scope
This policy applies to:
- Browsing xpversity.com and creating a student or owner account
- Email/password registration, email verification, and password reset
- Google Sign-In for Xpversity
- Course enrollment, lesson progress, XP awards, and character panel data
- Paid purchases processed through Stripe
- Message Us contact submissions and the Chatara assistant widget
- Session cookies used to keep you signed in
It does not replace policies of third-party sites we link to (for example external course resources).
3. Data We Collect
Information you provide
- Account: display name, email address, password hash (for email accounts)
- Google Sign-In: email, display name, and profile identifiers provided by Google
- Learning: enrollments, lesson progress, completion timestamps, and XP event history
- Contact: name, email, inquiry type, and message content from Message Us
- Owner/admin: course content you upload (titles, descriptions, videos, covers, article text)
Information collected automatically
- Technical logs from our hosting stack (IP address, user-agent, request timestamps) for security and reliability
- HttpOnly session cookies for authenticated access and refresh tokens
- Payment metadata from Stripe (status, amount, currency, checkout session id) — not full card numbers
We do not sell personal data. We do not use Xpversity for cross-site advertising or ad retargeting.
4. How We Use Data
- Create and manage your account and authentication sessions
- Deliver enrolled courses, track progress, and award XP/levels
- Process free and paid enrollments and issue purchase records
- Send transactional email (verification, password reset) via Amazon SES
- Respond to support and contact requests
- Operate Chatara on-site assistance when enabled
- Secure the platform, prevent abuse, and maintain audit logs
- Improve course delivery, UX, and reliability
5. Legal Bases (Summary)
- Contract — to provide the learning service you sign up for, including enrollments and progress sync
- Legitimate interests — platform security, fraud prevention, service improvement, and business records (balanced against your rights)
- Consent — where required for optional communications beyond transactional email
- Legal obligation — accounting, tax, and regulatory retention where applicable
6. Google Sign-In
If you choose Google Sign-In, we receive information from Google such as your email address and name to create or match your Xpversity account. Google’s use of your data is governed by Google’s privacy policy and your Google account settings.
We use this data only to authenticate you and personalize your Xpversity profile. We do not post to Google on your behalf.
7. Payments
Paid course purchases are processed by Stripe. Card data is handled by Stripe under Stripe’s terms and privacy policy. We receive business records needed to fulfill the purchase (name, email, course id, payment status, amount) — never your full card number.
9. International Transfers
Some processors may process data outside the EEA/UK. Where that happens we rely on appropriate safeguards such as an adequacy decision or the European Commission’s Standard Contractual Clauses (SCCs), unless a GDPR derogation applies.
10. Retention
- Account & learning records — for the life of your account and a reasonable period afterward for disputes
- Verification & password-reset tokens — until used or expired (typically 24 hours to 1 hour respectively)
- Contact messages — as long as needed to respond and for legitimate business records
- Payment records — as required for accounting and legal obligations
- Course media — while the course remains published or as needed for enrolled learners
11. Security
We use HTTPS, password hashing, httpOnly session cookies, access controls on infrastructure, and industry-standard protections on our processors. No method of transmission or storage is perfectly secure. Report suspected issues to [email protected].
13. Your Rights
Depending on applicable law (including GDPR), you may request access, rectification, erasure, restriction, portability, or object to certain processing. You may lodge a complaint with the Hellenic Data Protection Authority (HDPA) or another competent supervisory authority.
To exercise rights, email [email protected] with enough detail for us to verify and fulfill your request.
14. Children
Xpversity is intended for users who can form a binding contract under applicable law. We do not knowingly collect data from children under 16 without appropriate parental consent.
15. Changes
We may update this policy when our practices, products, or legal requirements change. The “Last updated” date above shows the latest revision.
16. Contact
Privacy questions: [email protected]
Home: xpversity.com