Privacy Policy & Terms of Service

1. Definitions & scope

“nxoria”, “the Service”, “we”, “us” means the nxoria science-simulation platform: this website, the public showcase, the school portal, the team workspace, the administration interfaces, and all simulation and assessment content delivered through them. “School” means the institution that requested or holds a subscription. “School Administrator” means the account managing a School's membership. “Member” means any account affiliated with a School, including teachers and students. “Staff” means an intern or employee account provisioned by the platform administrator. “You” means any visitor or account holder.

This single document is both our Privacy Policy and our Terms of Service (together, the “Agreement”). It applies to every visit, every demo request, and every account. If you do not agree, do not register for or use the Service.

Where you accept on behalf of a School, you represent and warrant that you are authorised to bind that School to this Agreement. Where a Member is a minor, the School procures and supervises their access as described in §6.

2. Acceptance — and how it is recorded as evidence

Creating an account requires an affirmative act of acceptance: a mandatory, unticked checkbox presented immediately next to links to this Agreement at registration. Electronic contracts formed this way are valid and enforceable under the Indian Contract Act, 1872 and the Information Technology Act, 2000.

Each acceptance is recorded in a dedicated acceptance ledger as an electronic record containing: the accepting account's identity; the exact version identifier of this Agreement as published at that moment (currently version 2026-07-31); the date and time of acceptance recorded by our servers in UTC; the network (IP) address from which the acceptance was made; the browser user-agent string; and the context of acceptance (registration, or in-portal re-affirmation). The full text of every published version of this Agreement is preserved immutably in our version-control history, so the precise wording accepted on any given date can be produced.

When we materially update this Agreement (see §18), signed-in users are shown the new version and asked to re-affirm; that re-affirmation is recorded in the same ledger. Continued use of the Service after the stated effective date of an updated Agreement likewise constitutes acceptance of it.

Acceptance records are retained for as long as the account exists and thereafter for the period necessary to establish or defend legal claims, and are available to the account holder on request (§20).

3. Data we collect — exhaustively listed

Demo requests: school name, contact name, email, optional phone, approximate student count, and your free-text message. Used solely to prepare, send, and follow up on a quotation.

Accounts: full name, email address, hashed password (hashing and authentication are performed by our infrastructure provider; we never see or store plain-text passwords), school affiliation, role (student / teacher / school administrator / staff / platform administrator), account status, optional student identity details entered at registration (class, section, roll number, admission number), teacher subject assignments, account-creation time, and the acceptance-ledger records described in §2.

Practice-test activity: for each attempt — the experiment, score, maximum marks, percentage, per-question correctness and the answer options chosen, time taken, whether the test was exited early, and the submission timestamp. This exists so students can review their own work, teachers can teach from real results, and Schools can see engagement. It is never used for advertising and never shared outside your School and the platform administrator.

Assignments & teaching data: assignments created by teachers (test, target class, deadline, notes) and their completion state; class rosters a teacher imports or types (student names and identifiers supplied by the School).

Feedback & messages: submissions through the in-portal feedback widget (category, optional star rating, message, optionally the experiment concerned), help/contact messages, testimonials you provide for publication, and simulation requests.

Staff workspace (interns/employees only): the employment details the administrator records (name, email, position, department, phone, start date), tasks and task updates, meeting invitations and responses, work-log entries, and suggestions.

Technical data: our hosting provider automatically processes standard web-server request logs (IP address, user agent, requested URL, timestamp) for security and operation of the Service. The portal stores your recently-opened and favourited experiments in your own browser's localStorage; that data never leaves your device.

What we do NOT collect: no third-party advertising trackers, no social-media pixels, no fingerprinting, no precise location, no biometric data, and no payment-card data through this website (invoicing is handled off-platform between us and your School). If our optional, cookie-less, self-hosted-style visitor analytics is enabled it counts anonymous page views without cookies or cross-site identifiers.

4. Purposes & legal bases

We process personal data to: (a) perform this Agreement — authenticate you, display your School's library, run practice tests and assignments, let School Administrators manage membership, and operate the staff workspace; (b) respond to enquiries you initiate; (c) protect the security and integrity of the Service (legitimate interest); (d) maintain the acceptance and compliance records described in §2 (legal obligation and legitimate interest); and (e) comply with applicable law.

Under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) we process personal data on the basis of consent given at registration for the itemised purposes above, and for certain legitimate uses recognised by that Act. Under the GDPR (where it applies to a School), the bases are performance of contract, legitimate interests, and compliance with legal obligations.

We do not use personal data for automated decision-making producing legal or similarly significant effects, we do not profile students for any purpose beyond the academic feedback the product visibly provides to the student and their own School, we do not use personal data to train machine-learning models, and we never use children's data for tracking, behavioural monitoring, or targeted advertising of any kind.

5. Sharing & subprocessors

We do not sell, rent, trade, or broker personal data — ever, to anyone, for any consideration.

Subprocessors under this Agreement: (1) Supabase, Inc. — database, authentication and file storage; data resides in Supabase's hosting region for our project and is protected by their security programme in addition to ours. (2) Vercel, Inc. — application hosting and content delivery, which entails processing of standard request logs as described in §3. (3) Where email notification is configured, Google LLC (Gmail) transmits operational notification emails to the platform administrator; user email content is not shared with Google beyond what is necessary to deliver such notifications. If AI-generated study guidance is enabled, aggregate practice statistics (never names, emails, or free text) are processed by Anthropic, PBC to compose the guidance shown to the student.

We may disclose data where required by applicable law, court order, or governmental authority; where necessary to establish or defend legal claims; or to protect the rights, property, safety and integrity of the Service, its users, or the public. Where lawful, we will notify the affected School before disclosure.

In a merger, acquisition or asset sale, data may transfer to the successor entity bound by this Agreement; Schools will be notified and may terminate under §16.

6. Children, Schools & parental consent

The Service is procured by Schools for classroom education. In India, the DPDP Act treats every person under 18 as a child; the DPDP framework recognises processing of children's data by and for educational institutions for academic activities and student safety, and that is precisely and only how the Service handles student data: authentication, the School's own library, the student's own practice results shown to the student, their teachers and their School.

The School is responsible for obtaining any parental or guardian consent required by the law applicable to it — including verifiable parental consent under the DPDP Act and Rules where required, COPPA authorisation for schools in the United States, or GDPR Article 8 consent in the EU — before providing a student with an access code, and for supervising student use. We support this division of responsibility contractually: the School, not nxoria, decides who receives access.

Consistent with the DPDP Act's restrictions, the Service performs no tracking, behavioural monitoring or advertising directed at children — there are no ads anywhere in the product, and student activity data is used solely for the academic purposes the product visibly performs.

School Administrators are responsible for: safeguarding the School's access code and rotating it if exposed; the accuracy of their member list; approving only legitimate members; and promptly disabling or removing members who should no longer have access. nxoria is not liable for access resulting from a School's failure to protect its code or manage its members.

7. Security measures

All traffic is encrypted in transit (TLS). Sessions use HTTP-only cookies. Every database table is protected by row-level security enforced in the database engine itself, so even a compromised or malicious client cannot read another School's data; library access additionally requires an active membership of an active, unexpired School. Roles are assigned by database triggers and can never be set by client input. Uploaded simulation files execute in a sandboxed, opaque-origin iframe with no access to sessions, cookies, or the parent page. Content-Security-Policy, HSTS and related headers are applied to every response. The acceptance ledger (§2) is insert-only from user context: acceptance records cannot be edited or deleted by any user-facing interface.

No system is perfectly secure and we do not warrant that security incidents are impossible. If we become aware of a personal-data breach, we will notify affected account emails and Schools without undue delay, describe the scope and mitigation, and make any notifications to authorities that applicable law requires (including to the Data Protection Board of India where the DPDP Act so requires).

8. Data retention & deletion

Demo requests are retained while relevant to a live or prospective commercial relationship and deleted on request. Account data is retained while the account exists. Practice-test history is retained for the account's life because it is the student's own academic record; a student or School may request its erasure as described below. Testimonials are retained while published plus a reasonable archival period. Acceptance-ledger records are retained per §2. Staff workspace records are retained for the employment relationship plus the period necessary for legal compliance.

You may request access to, correction of, or deletion of your personal data by writing to the contact in §20. Account deletion removes your profile and school affiliation from live systems immediately; residual copies in encrypted backups are purged on the backup rotation schedule (no longer than 30 days). School-level records are deleted at the request of the School's authorised contact after the subscription ends. We may retain the minimum records needed to comply with law, resolve disputes, and enforce agreements — including acceptance-ledger entries.

9. Your rights & Grievance Officer

Rights under the DPDP Act (India): you may (a) access a summary of your personal data and the processing activities; (b) seek correction, completion or updating of your data; (c) seek erasure of data no longer necessary for the purpose it was collected for; (d) withdraw consent at any time with prospective effect (which may end your ability to use the Service); (e) nominate another individual to exercise your rights in the event of death or incapacity; and (f) have an accessible grievance-redressal mechanism. For minors, these rights are exercised by the parent or lawful guardian, normally through the School.

Rights under the GDPR (where it applies): access, rectification, erasure, restriction, portability, and objection, plus the right to lodge a complaint with your supervisory authority.

Grievance Officer (as required by the DPDP Act and India's IT Rules): Siyon Singh, Grievance Officer, nxoria — axiom.physicsinfo@gmail.com. Write “GRIEVANCE” in the subject line. We acknowledge grievances within 72 hours with a reference identifier, and resolve them within the timelines prescribed by applicable law (and in any event within 90 days).

If you are not satisfied with the resolution after exhausting this mechanism, you may complain to the Data Protection Board of India in the manner the DPDP Act and its Rules prescribe; EU data subjects may approach their supervisory authority.

10. Cookies

We set only strictly-necessary cookies: the HTTP-only authentication session issued at sign-in. There are no advertising, analytics or third-party cookies, and therefore no cookie-consent banner is required. Blocking cookies will prevent signing in but does not affect the public site.

11. Subscriptions, quotations & payment

Access to the portal is granted under a quotation accepted by the School, which — together with this Agreement — forms the entire contract. Quotations state the term, seat allowance and price; invoicing and payment occur off-platform as stated in the quotation. Prices are exclusive of applicable taxes, which the School bears.

We may suspend or restrict a School's access for non-payment after reasonable notice, at the end of an agreed term that is not renewed, or for material breach of this Agreement. Seat limits, expiry dates and school deactivation take effect immediately in the platform.

Except where required by law or expressly stated in §18 (material changes), fees already paid are non-refundable.

12. Acceptable use — strictly enforced

You agree NOT to: share credentials or access codes outside the subscribed School; resell, sublicense, re-host, frame, scrape, or bulk-download simulation content; reverse-engineer, decompile or extract source beyond what mandatory law permits; probe, scan, overload, penetration-test (except with our prior written consent), or bypass security or access controls; upload or transmit malicious code; misrepresent your identity or authority; use the Service to violate any law or third-party right; or interfere with other users' access.

We may suspend, restrict or terminate accounts that breach this section, with or without notice proportionate to severity, and the School remains liable for fees for the remainder of the term where the breach is the School's or its members' fault.

13. Intellectual property

All simulations, engines, code, text, mathematics presentation, design, trademarks and other platform content are and remain the exclusive property of nxoria or its licensors, protected by copyright and other laws. Schools receive a limited, non-exclusive, non-transferable, non-sublicensable licence to use the Service for the School's own teaching during the subscription term. No other rights are granted, whether by implication, estoppel or otherwise.

Feedback and suggestions you send us may be used without restriction or compensation. Testimonials you submit for publication grant us a worldwide, royalty-free licence to display them with your attribution; you may withdraw a testimonial at any time and we will unpublish it within a reasonable period.

14. Warranty disclaimer

THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, OR UNINTERRUPTED AVAILABILITY. While every simulation is built and numerically verified with care, simulations are teaching aids: they are not a substitute for laboratory safety judgement, professional engineering analysis, or examination-board specifications, and we do not warrant fitness for any purpose beyond classroom instruction. Practice-test scores and AI-generated study guidance are formative feedback, not certified assessments, and must not be treated as official academic records.

15. Limitation of liability & indemnity

TO THE MAXIMUM EXTENT PERMITTED BY LAW: (a) NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA OR GOODWILL, EVEN IF ADVISED OF THE POSSIBILITY; (b) OUR TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THE SERVICE IS LIMITED TO THE FEES ACTUALLY PAID BY THE SCHOOL FOR THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY, OR, WHERE NO FEES WERE PAID, TO ₹1,000. Nothing in this Agreement limits liability that cannot be limited by law, including for fraud.

The School will indemnify and hold nxoria harmless from third-party claims, damages and reasonable costs arising from: the School's or its members' breach of this Agreement (including acceptable use and the consent obligations under §6), content the School submits, or the School's violation of applicable law.

16. Term, suspension & termination

This Agreement applies from your first use and continues while you hold an account or the School holds a subscription. Either party may terminate for material breach not cured within 14 days of written notice. We may suspend access immediately where reasonably necessary to protect the Service or comply with law, giving notice as soon as practicable.

On termination or expiry: portal access ends; sections that by nature survive (including §§2, 5, 7–9, 13–15, 17–19) continue to apply; and data is handled per §8.

17. Force majeure

Neither party is liable for delay or failure caused by events beyond its reasonable control — including internet or hosting-provider outages, power failures, labour disputes, epidemics, natural disasters, war, or governmental action — provided the affected party uses reasonable efforts to mitigate and resumes performance as soon as practicable.

18. Changes to the Service or this Agreement

We continuously improve the Service and may add, modify or retire features, provided the core service (access to the simulation library) is not materially degraded during a paid term.

We may update this Agreement. Material changes will be announced on this page with a new version identifier and effective date at least 14 days in advance where practicable, and signed-in users will be asked to re-affirm the new version (§2). Continued use after the effective date constitutes acceptance. If a material change adversely affects an existing subscription, the School may terminate within 30 days of the effective date and receive a pro-rata refund of prepaid fees for the unused period — this is the exclusive remedy for such changes.

19. Governing law, disputes & general provisions

This Agreement is governed by the laws of India, without regard to conflict-of-law rules. The parties will first attempt in good faith to resolve any dispute by negotiation within 30 days of written notice. Failing that, disputes are subject to the exclusive jurisdiction of the courts of the operator's principal place of business, except that either party may seek injunctive relief for IP or security violations in any competent court.

Severability: if any provision is held unenforceable, it will be modified to the minimum extent necessary and the remainder stays in force. No waiver: failure to enforce a provision is not a waiver of it. Assignment: the School may not assign this Agreement without our written consent; we may assign to a successor under §5. Entire agreement: this Agreement plus the accepted quotation constitute the entire agreement and supersede all prior discussions. Headings are for convenience only. Notices to Schools are validly given to the School Administrator's account email. Electronic records of this Agreement and of acceptances (§2) are intended to be admissible as evidence under the Information Technology Act, 2000 and the Bharatiya Sakshya Adhiniyam.

20. Contact

Questions, privacy requests (access / correction / deletion / consent withdrawal), acceptance-record requests, security reports and legal notices: axiom.physicsinfo@gmail.com (Grievance Officer: Siyon Singh — see §9). We aim to acknowledge within 2 working days and resolve privacy requests within 30 days.