Privacy policy

1. What we collect

• Account details: your name, email address, sign-in method and, if you turn it on, your two-step sign-in settings.
• Your content: the chats, files, documents, spreadsheets, decks, PDFs, projects and memory you or your workspace create or upload.
• Usage and billing records: plan, seats, credit use and payment status. Card details are handled by our payment processor and never reach our servers.
• Security and audit records: sign-in events, IP address and browser details, kept to protect accounts and, for workspaces that need it, as an audit trail.
• Signing evidence (xSign): each signer's name, email, the time of each step, IP address and browser, sealed into the record of a signed document.

2. Why we use it

To provide the service you asked for, keep accounts and workspaces secure, bill for paid plans, answer support requests and meet legal obligations. We do not sell personal data and we do not show advertising.

3. Who processes it for us

We use service providers for hosting, database and file storage, email delivery, payment processing and AI processing. Each receives only what it needs to perform its service for us and is bound by a data processing agreement. AI processing receives the content of a request only to produce its answer. You can ask us for the current list of processors through the contact form.

4. Workspaces and administrators

If you use Scholar XI through an organization, that organization controls its workspaces. Its administrators can manage members and access, set retention and export or delete workspace content. Members removed or suspended by an administrator lose access at once.

5. How long we keep it

• Your content stays until you or your workspace administrator delete it.
• Off-the-record chats are deleted 24 hours after they are created.
• Signed records are kept for the retention period the workspace sets (ten years unless changed) and while a legal hold applies, because they are evidence.
• Billing records are kept for as long as tax and accounting law requires.

6. How we protect it

Data is encrypted in transit. Each workspace's data is isolated at the database row level and access is checked on the server for every request. Signed documents and their attachments are encrypted individually. You can require two-step sign-in for your organization. Our security overview describes these controls in more detail.

7. Cookies and similar storage

We use only what the service needs to work: your browser stores your sign-in session and preferences such as theme and language, and a short-lived cookie protects connections to other apps while you approve them. We do not use advertising or cross-site tracking cookies.

8. Your choices and rights

You can see and change your account details in Account settings, export your content and delete your account. Depending on where you live, you may also have the right to access, correct, delete or port your personal data, to object to or restrict its use, and to complain to your data protection authority. To use any of these rights, contact us; we answer within 30 days.

9. International transfers

Our providers may process data outside your country. Where the law requires it, transfers rely on recognized safeguards such as standard contractual clauses.

10. Children

Scholar XI is not intended for anyone under 16, and we do not knowingly collect their data.

11. Changes and contact

We will post any change on this page and update the date above; for significant changes we will also tell account holders by email. Questions or requests go through the contact form.