Xuman.AI Privacy Policy

This Privacy Policy explains how Xuman.AI Inc ("Xuman.AI," "we," "us," or "our") collects, uses, discloses, and protects information about you when you access or use our websites, mobile applications, and online services, including the Xuman.AI mobile and web application (collectively, the "Services" or "Xuman.AI"), and when you otherwise interact with us.

Xuman.AI operates a youth services marketplace and technology platform, under the brand Xuman.AI, that helps families connect with independent providers ("Guides") for tutoring, mentoring, coaching, enrichment, and other youth-focused services.

By using the Services, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, you should not use the Services.

1. Scope

This Privacy Policy applies to:

• Individuals and households using the Services as families, parents, or legal guardians;
• Independent Guides and other providers offering services through the marketplace;
• Visitors to our websites and users of our mobile apps; and
• Representatives of organizations (such as schools, districts, nonprofits, or foundations) that interact with Xuman.AI.

It does not apply to third-party websites, apps, or services that we do not own or control, even if they are accessed through the Services.

2. Information We Collect

We collect information in three main ways:

• Information you provide directly
• Information we collect automatically when you use the Services
• Information we derive or receive from others

2.1 Information you provide

The information you provide depends on your role and how you use the Services.

Families / parents / legal guardians

When you create an account, manage profiles, or book services, you may provide:

• Contact information (e.g., name, email address, phone number);
• Account credentials (e.g., username, password);
• Child-related information such as:
  • first name or nickname;
  • age or age range;
  • general background and context (for example, school grade, interests);
  • goals and priorities (e.g., academic support, enrichment, confidence-building, skills, wellness);
• Preferences related to:
  • categories and types of services;
  • budget and schedule;
  • format (in-person, virtual, hybrid; 1:1 or small group);
• Communications with Guides or Xuman.AI (e.g., messages, notes, feedback, support requests).

We ask that you do not include unnecessary sensitive personal information in free-text fields. If you choose to provide such information, you do so voluntarily.

Guides / providers

When you apply to become a Guide or manage your practice through Xuman.AI, you may provide:

• Identity and contact information (e.g., name, email address, phone number);
• Professional information:
  • biography and profile details;
  • skills, credentials, and experience;
  • categories and types of services offered;
  • age ranges and formats served;
  • pricing, schedule, and availability;
• Payment and payout information (e.g., financial account details for receiving earnings, tax-related information where required);
• Communication and performance information (e.g., messages with families, feedback, and notes).

Where applicable, we may collect additional information as part of a background check workflow, administered by a third-party provider.

Organizational partners

If you represent a school, district, nonprofit, or other organization, you may provide:

• Business contact details;
• Information about your role and responsibilities;
• Information about potential programs, pilots, or partnerships;
• Correspondence with Xuman.AI.

2.2 Information we collect automatically

When you use the Services, we automatically collect certain information about how the Services are accessed and used, for example:

Device and usage information

• IP address;
• browser type and settings;
• device identifiers and operating system;
• app version;
• pages viewed, features used, date and time of visits;
• clickstream data and other usage statistics.

Log and diagnostic information

Log files and diagnostic information to help us monitor, secure, and improve the Services.

Cookies and similar technologies

We use cookies, web beacons, local storage, and similar technologies to:

• remember your preferences and settings;
• keep you signed in;
• understand how the Services are used;
• personalize certain content;
• and support security and performance.

You can adjust your browser or device settings to refuse or limit cookies. However, some features of the Services may not function properly if cookies are disabled.

2.3 Human Experience Engine signals and derived information

Xuman.AI includes a Human Experience Engine that uses signals from sessions and interactions to help understand compatibility ("Human Fit") and improve matching over time.

Depending on how the Services are used, and subject to applicable law, we may collect and derive information such as:

Session-level behavioral signals

• attendance, punctuality, persistence, drop-offs, rescheduling, and rebooking patterns;
• session frequency, duration, and format (1:1 vs group; in-person vs virtual).

Interaction-level and contextual signals

• high-level information about engagement and participation;
• feedback and ratings shared within the platform;
• goals associated with sessions and categories (e.g., test prep, enrichment, skills, wellness);
• group composition data for small-group micro-communities (age ranges, levels, topics, historic engagement).

From these signals, we may derive:

• evolving profiles for families, children, and Guides that reflect patterns in how they interact, learn, teach, and collaborate; and
• Human Fit indicators that help inform recommendations, search results, and routing decisions.

We use these signals in accordance with this Privacy Policy, and we treat them as part of your personal information.

2.4 Information from third parties

We may receive information about you from:

• Payment processors – confirmation of payments, limited card or bank information (tokenized or truncated), payout status;
• Background check providers – where applicable, results or status of background screening, subject to applicable law;
• Communication and infrastructure providers – limited technical data to support messaging, video, and collaboration features;
• Partners and referrers – if you are referred to Xuman.AI by a school, organization, or another partner, we may receive limited information necessary to set up and support your use of the Services.

2.5 Third-Party Service Integrations

Xuman.AI allows you to connect optional third-party accounts to enhance your experience. When you choose to connect any of the following services, we collect and process data from those services in accordance with the permissions you explicitly grant. You can disconnect any integration at any time from your Xuman.AI account settings; on disconnect, we revoke the relevant access tokens and stop collecting data from that service.

Google (Calendar and YouTube)

With your consent, Xuman.AI accesses your Google Calendar to provide two-way calendar sync: creating booking events on your calendar and blocking your availability based on existing events. We use the scopes calendar.events and calendar.calendarlist.readonly. With your separate consent, we also access your YouTube videos to import them into your provider portfolio, using the youtube.readonly scope.

Xuman.AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft (Outlook Calendar)

With your consent, Xuman.AI accesses your Outlook calendar for two-way sync: creating booking events and blocking availability based on existing events. We use the scopes Calendars.ReadWrite, offline_access, and User.Read via Microsoft Graph.

TikTok

With your consent, Xuman.AI accesses your TikTok account to (a) display your existing TikTok videos so you can import them into your Xuman.AI portfolio (video.list), and (b) post videos from your portfolio directly to your TikTok profile (video.publish, via the Content Posting API). Each post is initiated explicitly by you — Xuman.AI never posts without your action.

Facebook and Instagram

With your consent, Xuman.AI accesses your Instagram account to import content into your Xuman.AI portfolio. When you authorize the Instagram connection, we may access your Instagram username and profile picture, photos and videos from your Instagram account that you choose to import, and associated media metadata (captions, timestamps, and media type). We use Instagram data solely to display your media library within Xuman.AI so you can select content to import, and to re-host selected media as "Drops" (content posts) on your Xuman.AI profile. We do not access your Instagram direct messages, followers, or following lists; we do not post to your Instagram account; and we do not use your Instagram data for advertising.

For Facebook Pages, we use pages_show_list to let you select which Facebook Page to connect, and pages_read_engagement to read the Page's posts so you can import media into your Xuman.AI portfolio.

When you import content from Instagram or Facebook, a copy is uploaded to our servers (hosted in the United States) and retained as part of your Xuman.AI profile until you delete it or delete your account. Original content remains on the source platform and is not affected by actions you take on Xuman.AI. Your use of Instagram and Facebook is governed by Meta's privacy policy; we encourage you to review Instagram's Privacy Policy and Meta's Terms of Service for information about how they collect and use your data.

Data we collect from these integrations

For each connected service, we store: the OAuth access token (encrypted at rest), the provider's user identifier, your display name, profile picture (when provided), and metadata about content you choose to import or share through Xuman.AI. We do not access or store data beyond what is needed for the feature you enabled.

Sharing with third parties

We do not sell or share data obtained from these integrations with any party outside Xuman.AI, except as necessary to operate the integration (e.g., posting a video to TikTok at your request) or as required by law.

3. How We Use Information

We use the information we collect for the following purposes:

3.1 To operate, maintain, and provide the Services

• Creating and managing accounts and profiles;
• Enabling discovery, booking, scheduling, and management of services;
• Facilitating communications between families, Guides, and Xuman.AI;
• Operating the Human Experience Engine and Human Fit features;
• Processing payments, payouts, refunds, and adjustments;
• Providing customer support and responding to inquiries.

3.2 To personalize and improve the experience

• Tailoring recommendations and search results based on your preferences and activity;
• Helping route families to Guides and groups that are more likely to be a good fit;
• Helping Guides understand patterns in their practice and demand;
• Understanding how the Services are used so we can improve performance, features, and usability.

3.3 To support trust, safety, and integrity

• Verifying identity or eligibility where appropriate;
• Facilitating background checks or screenings through third-party providers;
• Monitoring for, detecting, investigating, and preventing:
  • fraud and abuse;
  • security incidents or unauthorized access;
  • violations of our Terms of Service or other policies;
• Supporting user reports, incident investigation, and enforcement actions.

3.4 To communicate with you

• Sending transactional communications (for example, confirmations, reminders, updates, and support messages);
• Sending informational or marketing communications about features, services, and opportunities, in accordance with applicable law and your communication preferences;
• Communicating about policy updates and changes to the Services.

You can opt out of certain marketing emails by following the unsubscribe instructions in those emails. We may still send you non-marketing messages (such as transactional or service messages).

3.5 To comply with legal obligations and protect rights

• Complying with applicable laws, regulations, and legal processes;
• Responding to subpoenas, court orders, or other lawful requests for information;
• Protecting the rights, property, or safety of Xuman.AI, our users, minors, or the public;
• Enforcing our Terms of Service and other agreements.

4. How We Share Information

We do not sell your personal information.

We may share information as described below:

4.1 With other users, as part of normal use of the Services

To make the marketplace function:

Families and Guides

• Families see information about Guides that is reasonably necessary to evaluate and book services (e.g., profile, categories, formats, pricing, schedule, location context).
• Guides see information about families and children that is reasonably necessary to understand requests and deliver services (e.g., names, ages or age ranges, goals, preferences, and relevant context shared by the family).

You can choose what you share in free-text fields and communications. You should avoid sharing unnecessary sensitive personal information.

4.2 With service providers and vendors

We may share information with third-party vendors who perform services on our behalf, such as:

• Payment processing and fraud prevention;
• Background checks and identity verification;
• Cloud hosting and infrastructure;
• Analytics and performance monitoring;
• Communication and collaboration tools (e.g., email, messaging, video);
• Customer support and ticketing.

These providers are authorized to use your information only as necessary to provide services to Xuman.AI and are subject to appropriate contractual safeguards.

4.3 With organizational partners

If you use Xuman.AI in connection with a school, district, nonprofit, or similar organization (for example, as part of a specific program or pilot), we may share information with that organization consistent with the purpose of the program and any applicable agreements.

4.4 For legal and safety reasons

We may disclose information if we believe, in good faith, that such disclosure is reasonably necessary to:

• Comply with any applicable law, regulation, legal process, or governmental request;
• Protect the rights, property, or safety of Xuman.AI, our users, or the public;
• Detect, prevent, or otherwise address fraud, security, or technical issues;
• Enforce our Terms of Service or other policies; or
• Respond to claims that content or behavior violates the rights of third parties.

4.5 Business transfers

In connection with any actual or contemplated merger, acquisition, financing, due diligence, reorganization, bankruptcy, or sale of all or part of our business, we may share or transfer some or all of your information, subject to appropriate confidentiality obligations. If such a transaction occurs, your information may be among the assets transferred.

5. Cookies and Similar Technologies

We use cookies and similar technologies to:

• keep you signed in;
• remember your preferences and settings;
• understand how you use the Services;
• measure and improve performance;
• and support security.

You can control cookies through your browser or device settings. If you block or delete cookies, some features of the Services may not work properly.

6. Data Retention

We retain personal information for as long as reasonably necessary to:

• provide the Services to you;
• support the purposes described in this Privacy Policy;
• comply with our legal and regulatory obligations;
• resolve disputes; and
• enforce our agreements.

Retention periods may vary depending on the type of information, the nature of our relationship with you, and our legal obligations. When information is no longer needed, we will delete it or de-identify it, subject to any legal or operational requirements.

7. Children's Privacy

Xuman.AI is designed to serve youth, but children do not directly enter into contracts with Xuman.AI.

• Accounts that book or manage services for minors must be created and controlled by a parent, legal guardian, or authorized adult.
• We collect information about children that is provided by parents/guardians or by Guides in connection with services (for example, age, general context, goals, and session history).
• We do not knowingly collect personal information directly from children under the age of 13 without appropriate parental consent, where required by law.

If you believe that we have collected personal information directly from a child in a way that violates this Policy or applicable law, please contact us at info@xuman.ai, and we will take appropriate steps to review and address the issue.

8. Data Location and International Use

All Xuman.AI data is stored and processed in the United States.

• Our production systems, databases, and backups are hosted in US-based data centers.
• Our primary operational and infrastructure providers are also US-based or use US-region resources for Xuman.AI.

If you access the Services from outside the United States, you understand that:

• Your information will be transferred to, stored, and processed in the United States;
• US data protection laws may differ from those in your country of residence;
• By using the Services, you consent to the transfer of your information to the United States as described in this Privacy Policy.

9. Security

We use administrative, technical, and physical safeguards designed to help protect personal information from unauthorized access, use, or disclosure.

These measures include, as appropriate:

• encryption in transit and at rest;
• access controls and role-based permissions;
• network and application-level security controls;
• monitoring and logging;
• internal policies and training.

No system can be completely secure, and we cannot guarantee that information will never be accessed, used, or disclosed in a manner that is inconsistent with this Privacy Policy. However, we continuously work to improve our security posture and to protect the integrity of the Services.

If you believe your account or information has been compromised, please contact us immediately.

10. Your Choices and Rights

Depending on your location and applicable law, you may have certain rights regarding your personal information, such as the right to:

• access and review personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of certain information, subject to our legal and operational obligations;
• object to or request restriction of certain processing;
• withdraw consent where processing is based on consent (without affecting prior lawful processing).

We will respond to requests in accordance with applicable law. We may need to verify your identity before processing certain requests.

10.1 Access, update, and deletion

You can access and update some of your information through your account settings. If you need additional assistance, you can contact us using the details in the "Contact Us" section below.

We may retain certain information as required by law or for our legitimate business purposes (for example, transaction records, security logs, and information needed to prevent fraud or enforce our Terms of Service).

10.2 Marketing communications

You can opt out of marketing email communications by following the unsubscribe instructions in those emails or by contacting us. Even if you opt out of marketing emails, we may still send you non-marketing communications (for example, transactional messages related to your account or bookings).

10.3 Do Not Track

Some browsers include a "Do Not Track" (DNT) setting. At this time, the Services do not respond to DNT signals. We will update this Privacy Policy if our practices change.

11. Third-Party Links and Services

The Services may contain links to or integrations with third-party websites, applications, or services. If you choose to use those services, you may provide information directly to third parties, or we may share certain limited information about you with them as described in this Policy.

We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you use.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we do, we will:

• update the "Last Updated" date at the top of this page; and
• where appropriate, provide additional notice (for example, by posting a notice in the Services or sending an email).

Your continued use of the Services after an updated Privacy Policy becomes effective means you accept the updated Policy. If you do not agree, you should stop using the Services.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or if you wish to exercise your rights, you may contact us at: