Privacy Policy

10x K Factor is provided by 10x K Factor, LLC ("we," "us"). Contact: privacy@10xkfactor.com or mail 123 Product Ave, Suite 100, Austin, TX 78701, USA. If a Data Protection Officer (DPO) is required, email dpo@10xkfactor.com.

We collect information in three ways:

• You provide: account info (name, email, role/relationship: student/parent/tutor), authentication identifiers, profile, messages, study artifacts (prompts, answers, uploads), feedback, and settings.
• Automatically: device + app diagnostics (IP, device/OS, browser, app version), event logs (sign-in/out, clicks, session timing), presence pings, feature usage, referral codes, invite flows, coarse location (from IP), cookies/local storage identifiers.
• From others: school/organization admins, invited users (if they share your email), single sign-on providers, and lawful data enrichment (e.g., deliverability checks).

Sensitive data: We do not intentionally collect sensitive categories. Do not submit sensitive data unless requested and protected by an agreement (e.g., school contract).

• Provide, maintain, and secure the Service (auth, sessions, fraud/abuse prevention).
• Enable learning + AI features (Socratic hints, feedback, diagnostics).
• Power social/viral mechanics (presence, activity feed, invites, leaderboards, rewards).
• Measure performance and improve the product (analytics, experiments/A-B tests).
• Communicate with you (service emails, feature updates, critical notices).
• Comply with law and enforce terms.

• Contract: to provide the Service you request.
• Legitimate interests: product improvement, security/anti-abuse, analytics with privacy safeguards.
• Consent: certain cookies/marketing; parental/school consent where required.
• Legal obligation: record-keeping, compliance.

AI outputs may be inaccurate—verify important information.

Training: By default, we do not use customer content to train foundation models. We may use aggregated or de-identified telemetry to improve features. Where optional fine-tuning on your data is available, we'll present a clear opt-in control.

Third-party AI: If we use third-party models or APIs, we minimize data sent and apply confidentiality controls under data processing agreements.

We process presence, invites, referrals, leaderboards, and rewards to operate these features and prevent abuse. Public displays (like leaderboards) use minimal identifiers and can be controlled by settings where available.

Used for core functionality (session), preferences, analytics, and limited marketing attribution. Manage choices at /cookie-settings. Some features rely on cookies and may not function if disabled. We honor Do Not Track only where required by law; see settings for granular controls.

We do not sell personal information for money. Certain analytics/advertising disclosures could be considered "sharing" under CPRA. You can opt out at /privacy-choices.

We share personal info with:

• Service providers/processors (hosting, storage, email, analytics, payments, abuse prevention) bound by contract to protect data. Current list: https://example.com/subprocessors.
• School/organization admins for managed accounts.
• Legal/safety: to comply with law, respond to lawful requests, or protect users and our Service.
• Business transfers: in a merger/acquisition; we'll provide notice and choices as required.

We do not disclose student personal information for targeted advertising or build profiles unrelated to education purposes.

Minimum age: 13 (or local equivalent). For users under 18, a parent/guardian or school authorization may be required.

School accounts: Schools act as controllers for student data they provide. We act as a processor under a data processing agreement (DPA), limit use to educational purposes, and enable administrator controls.

Parents/guardians can request access or deletion via privacy@10xkfactor.com or /privacy-request (subject to school approval where applicable).

Depending on your location (e.g., EEA/UK/CH, California, Virginia, Colorado, Connecticut, Utah), you may have rights to:

• Access/know, correct, delete, and port your data.
• Opt out of targeted advertising/"sharing" and certain profiling.
• Object or restrict certain processing; withdraw consent.
• Appeal a decision (US state laws).

Use /privacy-request or email privacy@10xkfactor.com. We will verify your request, including authorized agents as required by law. Non-discrimination: we will not deny services for exercising rights, though some features may not work without certain data.

We keep data only as long as needed for the purposes above, then delete or de-identify. Typical periods: account data (life of account + 90 days), logs (90–180 days), experiments (≤ 180 days), backups (rolling ≤ 35 days), legal/compliance (as required). You can request deletion at any time (subject to exemptions).

We use industry-standard safeguards (encryption in transit/at rest where applicable, least-privilege access, secret rotation, monitoring). No method is 100% secure; promptly notify privacy@10xkfactor.com if you suspect an issue.

We may process data in the US and other countries. Where required, we use appropriate safeguards (e.g., SCCs, UK IDTA/Addendum) and technical measures to protect data.

Links/integrations are governed by their own policies. Review those policies; we're not responsible for third-party practices.

We respond to GPC/required signals where applicable and continue improving support. Manage additional preferences at /cookie-settings.

We may update this policy. Material changes will be announced by reasonable means (e.g., email or in-app). Continued use after the effective date means you accept the updated policy.

Questions or requests: privacy@10xkfactor.com or mail 123 Product Ave, Suite 100, Austin, TX 78701, USA. If you are in the EEA/UK/CH and believe your rights were not addressed, you may contact your local supervisory authority.

Effective Date: November 7, 2025