Legal
Privacy Policy
Effective date: July 22, 2026
1. Introduction and scope
This policy explains how Xata Technologies OPC("we", "us") collects, uses, discloses, and protects personal information when you use Systems Thinker Learn at learn.systemsthinker.ai (the "Platform"): creating an account, taking a course, and buying full access.
It covers the Platform only. Our marketing site at systemsthinker.ai maintains its own privacy notice covering the newsletter and the AI Readiness Check.
2. Who we are
Xata Technologies OPC
SEC Registration No. 2025080212430-00
Unit 2116-17 21F, Park Triangle Corporate Plaza, BGC, Taguig City, NCR, Philippines 1635
Under the Philippine Data Privacy Act of 2012 we are the personal information controller, and our Compliance Officer for Privacy is reachable at privacy@xatatech.com. Under the EU and UK GDPR we act as data controller. Under the CCPA as amended we are a "business". Under the Australian Privacy Act 1988 (Cth) we are an APP entity.
3. What we collect
- Account information: your email address, and your name if you give one. Accounts are managed through Amazon Cognito. If you sign in with Google or Apple, we receive your email address and name from them, never your password for that account.
- Authentication data: passwords are set and stored by Amazon Cognito and are never visible to us.
- Learning activity: which courses you are enrolled in, which lessons you have completed, your position in a lesson, quiz answers and results, and certificates earned.
- Purchase records: what you bought, when, the amount, the country used for tax, and the receipt identifier. See section 5 for card details, which we never receive.
- Correspondence: what you write to us, including refund requests and support email.
- Usage data: pages viewed, lessons played, and interaction events, collected through PostHog on production only. See section 6.
We do not collect government identifiers, and we do not receive your full card number, expiry date, or security code at any point.
4. How and why we use it
| Purpose | What we use | Legal basis |
|---|---|---|
| Give you access to the course you enrolled in or bought | Account information, purchase records | Performance of a contract |
| Save your progress and issue certificates | Learning activity | Performance of a contract |
| Send transactional email such as receipts and password resets | Account information, purchase records | Performance of a contract |
| Handle refunds, billing questions, and support | Purchase records, correspondence | Performance of a contract, legal obligation |
| Understand which lessons work and improve the course | Learning activity, usage data | Legitimate interest |
| Keep accounts secure and prevent abuse | Account information, request metadata | Legitimate interest |
| Meet tax, accounting, and other legal obligations | Purchase records | Legal obligation |
We do not use your learning activity to advertise to you, and we do not sell it. We do not make automated decisions about you that produce legal or similarly significant effects.
5. Payments and billing data
Paddle.com Market Ltd acts as our merchant of record. When you buy, your payment details go to Paddle directly. We never see or store your card number, expiry date, or security code.
Paddle is an independent controller of the payment data it collects, and processes it under its own privacy notice. What Paddle passes back to us is limited to what we need to give you access and keep lawful records: your email address, what you bought, the amount, the currency, the country used to calculate tax, and a receipt identifier.
Purchase records are kept for the period tax and accounting law requires, which is longer than the life of your account. See section 9.
6. Cookies and analytics
We set a small number of strictly necessary cookies. These keep you signed in, remember your light or dark theme choice, and remember the width of the lesson sidebar. They are required for the Platform to work and cannot be turned off from within it.
We use PostHog for product analytics, loaded on production only and served through a first-party subdomain (t.systemsthinker.ai). PostHog, Inc. processes this data on our behalf. Session recording is disabled, so it does not capture a replay of your visit. Once you are signed in, we associate analytics events with your account so we can see where learners get stuck.
Where your browser's time zone indicates you are outside the EEA, the UK, and Switzerland, analytics keeps its identifier in your browser's local storage and in a first-party analytics cookie scoped to systemsthinker.ai. Its purpose is to recognize a returning learner and to link a browsing session to an account, so we can measure whether people come back and finish a course. It is not used for advertising, is not shared with advertisers, and is not used for cross-context behavioral advertising.
We do not set the analytics cookie where your browser's time zone indicates you are in the EEA, the UK, or Switzerland. There the identifier lives in your browser's session storage and is discarded when you close the tab, which is how analytics behaved on the Platform before. Your region is worked out in the browser from your time zone setting alone, which is an approximation rather than a precise location check, so a virtual private network or a device clock set to another region can change the result. The test is deliberately broad in the direction that skips the cookie: if your time zone is European, or in a European overseas territory, or cannot be read at all, the Platform treats you as being in that group and sets no analytics cookie.
We run no advertising or remarketing technologies, and nothing that requires opt-in consent runs by default, which is why the Platform does not show a cookie banner. The regional fallback described above is the mechanism that keeps this true where an analytics cookie would need opt-in. If that changes we will update this policy and put the required consent mechanism in place first.
7. Sharing and disclosure
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
- Paddle.com Market Ltd for payments, tax, and receipts.
- Amazon Web Services for hosting, the database, file storage, account management through Cognito, and transactional email through SES.
- PostHog, Inc. for product analytics.
- Apple and Google where you chose to sign in with them, or bought through their stores.
We may also disclose information where the law requires it, in connection with a business transaction subject to confidentiality protections, or with your consent.
8. International transfers
Our infrastructure runs in the United States (AWS us-east-1), wherever you access the Platform from, so your information is transferred to and processed there. For visitors in the EEA, UK, or Switzerland we rely on your consent or our legitimate interests together with contractual and technical safeguards with our providers. Elsewhere we take reasonable organizational, contractual, and technical measures consistent with this policy.
9. Data retention
- Account and learning activity: kept while your account exists, and deleted when you delete it.
- Purchase records: kept for as long as tax and accounting law requires, which outlives your account. Deleting your account does not erase the record that a transaction happened.
- Correspondence: kept per our general business record-keeping.
- Analytics:kept per PostHog's default retention for our account.
10. Your rights by region
Philippines: Data Privacy Act of 2012
You have the right to be informed, to access and correct your personal information, to object to processing, to request erasure or blocking, to data portability, and to be indemnified for damages from unlawful processing. Complaints may be filed with the National Privacy Commission at privacy.gov.ph.
EEA, UK, and Switzerland: GDPR
You have the right to access, rectify, or erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time. You may complain to your local supervisory authority.
United States: CCPA and other state privacy laws
You have the right to know what we collect and why, to request deletion or correction, and to opt out of the sale or sharing of personal information. That last right is already satisfied, because we do neither. We will not discriminate against you for exercising these rights.
Australia: Privacy Act 1988 (Cth)
Under the Australian Privacy Principles you may access and correct personal information we hold about you, and complain to the Office of the Australian Information Commissioner at oaic.gov.au.
11. How to exercise your rights
You can change your name and password, and delete your account, from your account settings while signed in. For anything else, email privacy@xatatech.com with enough detail for us to verify who you are and find your records, normally the email address on the account. We respond within thirty (30) days, unless the law that applies to you allows longer or requires shorter.
12. Children's privacy
The Platform is intended for business audiences and is not directed at children under 16. If we learn we have collected personal information from a child under 16, we will delete it promptly.
13. Security
We use reasonable technical and organizational measures to protect personal information: traffic is encrypted in transit, the database is not publicly reachable, course media is served through signed, expiring URLs, and passwords are held by Amazon Cognito rather than by us. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
14. Changes to this policy
We may update this policy. The effective date above reflects the latest revision, and material changes will be noted on this page. Continued use of the Platform after a revised policy is posted is your acknowledgment of the update.
July 22, 2026. Section 6 was updated to disclose the first-party analytics cookie the Platform sets outside the EEA, the UK, and Switzerland.
15. Governing law and venue
This policy is governed by the laws of the Republic of the Philippines. The courts of Taguig City, Metro Manila have exclusive jurisdiction and venue over any dispute, without prejudice to mandatory rights you may have in your local courts or before your local data protection authority.
16. Contact us
Xata Technologies OPC
Unit 2116-17 21F, Park Triangle Corporate Plaza, BGC, Taguig City, NCR, Philippines 1635
privacy@xatatech.com
For refunds and billing questions, see the refund policy.