GDPR Privacy Practices

1. Our position on GDPR

explainx.ai is operated by AISOLO Technologies Private Limited, a company incorporated in India. We are not formally certified as GDPR-compliant, and India is not an EEA country. However, we believe privacy is a right — not a checkbox — and we apply the core principles of the General Data Protection Regulation (EU) 2016/679 ("GDPR") across our platform, for all users globally.

This page explains the GDPR-aligned practices we follow, the rights we extend to users in the European Economic Area ("EEA") and United Kingdom, and how to exercise them. For our full data practices, see our Privacy Policy.

2. Data we collect and why

We collect personal data only to the extent necessary to provide and improve our Services. The types of data we process and our purposes are described in our Privacy Policy (Section 2). In summary:

• Account data (email, name) — to authenticate you and operate your account.
• Payment data — processed by Stripe for paid services; we do not store card numbers.
• Usage and analytics — via PostHog and similar tools, to understand how the platform is used and improve it.
• Newsletter and marketing — only where you have opted in; you can unsubscribe at any time.
• Browser extension data — largely processed on-device; see Privacy Policy Section 2.5.

3. Legal bases we rely on

Where GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the Services you signed up for — account management, delivering courses, workshop enrollment, processing payments.
• Legitimate interests (Art. 6(1)(f)): Security and fraud prevention, product analytics, understanding how features are used, and improving the platform — where these are not overridden by your rights.
• Consent (Art. 6(1)(a)): For optional marketing emails and newsletter subscriptions. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): Where processing is required by applicable law (e.g. tax records, responding to lawful requests).

4. Your rights under GDPR

If you are in the EEA or UK, you have the following rights regarding your personal data. We honor these requests for all users, regardless of location, as a matter of principle.

4.1 Right of access (Art. 15)

You may request a copy of the personal data we hold about you and information about how we process it.

4.2 Right to rectification (Art. 16)

You may request correction of inaccurate personal data or completion of incomplete data.

4.3 Right to erasure / "right to be forgotten" (Art. 17)

You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where processing was unlawful. Some data may be retained where required by law or for legitimate business purposes (e.g. billing records).

4.4 Right to restriction of processing (Art. 18)

You may request that we restrict processing of your data in certain circumstances — for example while accuracy is contested, or where processing is unlawful but you prefer restriction over erasure.

4.5 Right to data portability (Art. 20)

Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.

4.6 Right to object (Art. 21)

You may object to processing based on legitimate interests, including profiling. We will cease processing unless we have compelling legitimate grounds or the processing is for the establishment, exercise, or defence of legal claims. You may opt out of marketing at any time using the unsubscribe link in any marketing email.

4.7 Rights related to automated decision-making (Art. 22)

We do not make solely automated decisions that produce legal or similarly significant effects on individuals. AI-generated content (e.g. search results, chatbot answers) is for informational purposes only and does not constitute such a decision.

How to exercise your rights

Submit requests to [email protected] with the subject "GDPR Rights Request — [right type]". We will respond within 30 days. We may ask you to verify your identity before processing the request. For complex or multiple requests, we may extend the response period by up to two additional months and will notify you.

You also have the right to lodge a complaint with your local supervisory authority (e.g. your country's Data Protection Authority). We would prefer you contact us first so we can address any concern directly.

5. Data transfers

AISOLO is based in India. When EEA or UK users use our Services, personal data is transferred to India and to the sub-processors we use (listed below), which may be located outside the EEA.

We rely on the following transfer mechanisms where applicable:

• Sub-processor contractual protections: Our key sub-processors (Stripe, PostHog, Vercel, Anthropic, Google/GitHub OAuth) maintain their own GDPR-compliant data transfer mechanisms and standard contractual clauses. We rely on these sub-processors' commitments for EEA-outbound transfers that pass through their systems.
• Your consent or contract performance: Where you initiate a cross-border transaction (e.g. a Workshop purchase as a customer in the EEA), the transfer is necessary for the performance of a contract between you and AISOLO.

We acknowledge that India does not have a formal EU adequacy decision. We are a small company and have taken practical steps to minimize data exposure. If you have concerns about transfers, contact us at [email protected].

6. Sub-processors

We use the following key third-party sub-processors that may process personal data on our behalf:

7. Data retention

We retain personal data for as long as necessary to provide the Services and comply with legal obligations. Account data is retained while your account is active and for a reasonable period afterward for legal and operational purposes. Payment records are retained as required by tax and accounting law. You may request deletion as described in Section 4.3.

8. Cookies and tracking

We use cookies and similar tracking technologies for authentication (session cookies), analytics (PostHog), and occasionally for functionality. Where required, we will request your consent before placing non-essential cookies. You can control cookie preferences through your browser settings. Disabling cookies may affect some Platform functionality.

9. Contact

For any GDPR-related inquiry: [email protected]

AISOLO Technologies Private Limited · 1003, Kamdhenu Commerz, Sector 14, Kharghar, Navi Mumbai 410210, Maharashtra, India