Privacy Policy
Last updated: 6 October 2026
Who we are
xAPI Course Builder is an online tool for writing, generating and exporting xAPI and cmi5 e-learning courses. It is operated by The Digital Learning Guy, ABN 36 441 834 283, of Suite 324, L1, 241 Adelaide Street, Brisbane City QLD 4000 ("we", "us").
This policy explains what personal information we collect, why, where it is stored and the choices you have. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Information we collect
We collect only what we need to run your account and your courses.
| What | Examples | Why |
|---|---|---|
| Account details | Your name, email address and password (stored only as a one-way hash) | To create your account and sign you in |
| Sign-in security | One-time sign-in codes, password reset links, a "remember this browser" token with your browser type (kept 30 days), and your IP address for rate-limiting (kept 1 day) | To protect your account and stop abuse |
| Course content | Course text, questions, images, video, audio, files you upload, and documents you give us to generate a course from | To store, edit, publish and export your courses |
| Collaboration and review | Who a course is shared with, reviewer names and email addresses, review comments, replies and screenshots | To run course sharing and review |
| Plan and billing | Your plan, usage of AI runs, and your Stripe customer and subscription IDs | To apply plan limits and manage your subscription |
| Personal Anthropic API key | If you add one, it is encrypted before it is stored, and only its last 4 characters are shown | To run AI generation on your own key |
| Usage | Pages visited, browser and device type, and approximate location, through Google Analytics | To see how the course builder is used, so we can improve it |
We do not see or store your card details: payments are handled entirely by Stripe.
How we use your information
We use your information only to provide and improve the service, and we never sell it or use it for advertising.
- To create and manage your account, and to send sign-in codes, password resets and course review emails
- To store, generate, publish and export your courses
- To apply your plan's limits and process subscriptions and purchases
- To keep the service secure and to fix problems
- To understand how the service is used, so we can improve it
When you use AI course generation, the content and documents you provide are sent to Anthropic, our AI provider, to produce the course. Anthropic does not use content sent through its commercial API to train its models.
Where your data is stored
Your account details and courses are stored on servers in Australia. Our application, database and uploaded course files are hosted on Amazon Web Services in the Sydney region.
A few trusted service providers process some information on our behalf, and some of them are outside Australia:
| Provider | What they receive | Location |
|---|---|---|
| Amazon Web Services | Everything stored by the service | Australia (Sydney) |
| Zoho | Your name and email address, to deliver our emails | Australia |
| Anthropic | Content and documents you send for AI course generation | United States |
| Stripe | Your name, email and payment details when you subscribe or buy AI runs | Australia, United States and other countries |
| Cloudflare Turnstile | Browser signals used to check you are a person when you sign up or send us a message | Global |
| Google Analytics | Usage information, as described above | United States |
Where information goes overseas, we take reasonable steps to make sure these providers protect it to a standard consistent with the Australian Privacy Principles.
Sharing, security and retention
We share your information only with the providers listed above, with people you choose to share a course with, or where the law requires it.
Security. All traffic uses HTTPS. Passwords are hashed, personal API keys are encrypted, and sign-in uses an emailed one-time code as a second step. Sign-in attempts are rate-limited.
Retention. We keep your account and courses while your account is open. Short-lived security records expire on their own: sign-in codes after 10 minutes, password reset links after 60 minutes, remembered browsers after 30 days and rate-limit records after 1 day. If your subscription ends, your courses stay available to view and export.
Deletion. To close your account and have your personal information and courses deleted, contact us through xapi.com.au. We may keep billing records for as long as tax law requires.
Your rights, cookies and contact
Your rights. You can view and update your name, email and password from My profile. You can ask us for a copy of your personal information, ask us to correct it, or ask us to delete it, by contacting us through xapi.com.au. We will respond within 30 days.
Cookies and browser storage. We use one essential session cookie to keep you signed in. We also use Google Analytics cookies to see how the course builder is used. Visitors in Europe are asked first, and anyone can turn them off from at the bottom of every page. Google's advertising features are off, and links that carry sign-in or review codes are stripped before they reach Google. Your browser also stores your draft course, display preferences and the "remember this browser" token.
Courses you publish. Exported courses run on your own LMS or LRS. Learner data those courses send is held by that system, not by us.
Changes. If we change this policy, we will update the date at the top and, for significant changes, tell you by email.
Contact and complaints. Questions or complaints: contact us through xapi.com.au, or write to The Digital Learning Guy, Suite 324, L1, 241 Adelaide Street, Brisbane City QLD 4000. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.