Privacy Policy

01Who is responsible for your data

IT24, RC 33417, ICE 002754343000020, Morocco, operates LabXenon and is the controller of the personal data described here ("we"). For any question or request about your data, contact us at contact@labxenon.com.

This policy applies to the website labxenon.com, the LabXenon app and the emails we send. We follow the Moroccan law n° 09-08 on the protection of individuals with regard to the processing of personal data and, for people in the European Union, the General Data Protection Regulation (GDPR).

02What we collect

03Why we use it, and on what basis

• To provide the service — create your account, run your labs, grade tasks, issue certificates, run organizations, answer support and custom requests, send account emails (confirmation, password reset, invitations, quotations). Basis: performance of our contract with you.
• To keep the platform and your account secure — sign-in protection, security logs, abuse and fraud prevention, enforcing the Terms. Basis: our legitimate interest in a safe service.
• To recommend labs and improve LabXenon — using your welcome-screen answers and aggregated usage (for example, which labs are launched and passed). Basis: our legitimate interest; the welcome-screen answers are optional.
• Billing and accounting — keeping invoices and payment records. Basis: legal obligations.

04What we don't do

• We don't sell your personal data and we don't show advertising.
• We don't use advertising or analytics trackers. The website's fonts and scripts are served from our own servers; the only exception is Paddle's checkout, loaded from Paddle when you open a payment.
• We don't send marketing emails without your consent. Account and service emails are part of the service.

05What other people can see

• Your organization's owners and admins can see your name, email, role, assigned labs, progress, scores and lab activity within that organization.
• Reviews you publish on a lab are shown in the catalog with your name (or the first part of your email address if you didn't give a name).
• Certificates can be verified by anyone who has the certificate code: the check shows your name, the lab, your score and the date.
• Our team (platform administrators and support staff) can access account data when needed to run the service, help you, or investigate abuse.

06Service providers

We use a small number of providers who process data on our behalf, under contracts that require them to protect it:

Some of these providers are outside Morocco and the European Union. Where data leaves the country where it is collected, we rely on the safeguards the law requires (such as adequacy decisions, standard contractual clauses or the authorizations required by the CNDP) and on transfers being necessary for the service you asked for. We may also disclose data when the law requires it, for example to a court or authority.

07How long we keep it

• Account and learning data: while your account exists. When you ask us to delete your account, it is scheduled for deletion and erased after a 30-day grace period (so a mistaken request can be cancelled); your name and email are then removed from our systems.
• Backups: database backups, kept on our server with restricted access, are deleted after 14 days.
• Lab machines: deleted when the session ends.
• Demo requests: kept so we can follow up on your request; you can ask us to delete yours at any time.
• Sign-in sessions: a sign-in stays valid for up to 30 days unless you sign out.
• Invoices and accounting records: as long as tax and accounting laws require.
• Security logs: kept to protect the platform; after an account is deleted they no longer identify you by name or email.

08Your rights

Depending on the law that applies to you, you can:

• access your data and get a copy of it (we can send you an export of your account);
• correct inaccurate data — most of it directly in Settings;
• delete your account and data;
• object to processing based on our legitimate interests, or ask us to restrict it;
• receive your data in a portable format;
• withdraw consent you gave, at any time.

To use these rights, contact us at contact@labxenon.com from the email address of your account. We answer within 30 days. If you are not satisfied, you can complain to the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel, www.cndp.ma) in Morocco, or to the data protection authority of your country in the European Union.

09How we protect it

• All traffic is encrypted (HTTPS). Passwords are stored only as Argon2id hashes; sign-in tokens are stored as hashes.
• Two-step verification is available for every account.
• Each organization's data is separated in the database, and lab machines are isolated from each other.
• Access to production systems is limited to the people who run the service, and important actions are logged.

10Age

LabXenon is not intended for children. You must be at least 16 years old to create an account. If you believe a child has given us personal data, contact us and we will delete it.

11Changes to this policy

We may update this policy as the service changes. We show the date of the last update at the top, and we tell you by email or in the app before important changes apply. The Cookies page explains the few cookies we use.