Privacy Policy

Effective Date: December 15, 2025
Entity: Wexley ("Wexley", "we", "us", "our")
Contact: support@wexley.ai
Mailing Address: Wexley, 611 Wilshire Blvd, Suite 900, Los Angeles, CA 90017, USA

Wexley helps adults navigate school- and campus-related questions using AI-assisted summaries, answers, and links. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our websites, apps, and other online consumer services (the "Services").

This Policy applies whether you use free or paid tiers of Wexley.

By using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.

This Privacy Policy is part of, and incorporates, our Terms of Service. Capitalized terms used but not defined here have the meanings given in the Terms.

1. Scope and Audience

The Services are intended for adult users 18 years of age or older.

Wexley is currently designed and operated with a focus on users in the United States. While others may access the Services, we are not currently targeting or tailoring the Services to EU/UK or other non-US jurisdictions. If we later do so, we may update this Policy and/or provide region-specific notices.

This Policy applies to information we process when you:

Use our websites or web applications;
Create an account or student profile;
Use free or paid subscription tiers;
Ask questions, view answers, or interact with community features;
Communicate with us.

It does not apply to independent third-party websites, services, or platforms that you may visit via links or that may be embedded (for example, official school sites).

2. Information We Collect

We aim to collect only the information we need to operate and improve the Services. The examples below are illustrative and not exhaustive.

2.1 Information You Provide

Examples include (without limitation):

Account and profile information

Email address
Display name / username (which may be pseudonymous)
Password (stored by our authentication provider; we do not see plaintext passwords)
Optional avatar image
Tier selection (Free, Plus, Educator)
Communication preferences (e.g., email opt-outs)

Student-related profiles and personalization

For each student profile you choose to create (for example, "Alex" or "Student 1"), you may provide:

Student nickname or label (we encourage first names, nicknames, or labels rather than full legal names)
Campus or school (e.g., a specific college or K–12 school)
Level (K-8, high school, college, etc.)
High-level attributes such as grade level, graduation year, housing type, major, interests, topics of concern, and other similar academic or campus-related context
Status (current, prospective, alumni, etc.)

Content you submit

Questions (public or private)
Comments, reactions, and community posts
Community calendar events and related information
School requests or feedback
Emails or messages you send to us

Billing and subscription information (if applicable)

Subscription tier and status
Limited billing metadata (for example, a payment processor customer ID and whether payment succeeded)
We do not store full payment card numbers or CVV; those are handled by our payment processor.

When you provide information about someone else (for example, a student), you represent that you are authorized to do so and that you will only provide what is reasonably necessary for the Services (see Section 11).

2.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect certain information, for example (not exhaustively):

Device and usage information

IP address
Browser type, operating system, device type
Pages or screens visited, features used, referring/exit URLs
Timestamps and approximate session duration
Clicks, scrolls, and other interactions with site elements

Log and security information

Login attempts and authentication events
Error and crash data
Signals used for rate limiting, abuse detection, and security monitoring

We retain detailed login-attempt IP logs for up to 90 days, and we maintain an automated cleanup process that deletes or de-identifies login-attempt records older than 90 days, except where we need to retain certain records longer for security, fraud prevention, or legal reasons.

2.3 Information from Service Providers and Partners

We may receive limited information from, for example:

Authentication and infrastructure providers (for account creation, secure login, and hosting)
Analytics providers (aggregated statistics about visits and usage patterns)
Payment processors (confirmation that a payment succeeded or failed, subscription details)
AI and search providers (for example, content classification or safety signals)

We design our systems so that direct personal identifiers are not included in AI and search prompts unless necessary for a specific function. For example, we do not send your real name, email address, or a student's name to external AI or search providers as part of normal question-answering.

3. How We Use Information

We use the information we collect for purposes that include (but are not limited to):

Provide and operate the Services

Create and manage accounts and student profiles
Authenticate users and maintain sessions
Deliver answers, summaries, and related features
Provide community features (questions, comments, events)

Personalize and improve the experience

Tailor responses based on the campus and high-level student context you provide
Show more relevant content based on your usage patterns
Develop new features and improve usability

Security, integrity, and abuse prevention

Detect and block spam or automated abuse
Enforce rate limits and protect against attacks
Investigate and mitigate suspicious or harmful activity

Analytics and performance

Understand how the Services are used in aggregate
Measure feature adoption, engagement, and performance
Debug outages and issues

Advertising and marketing (where applicable)

Operate ad-supported experiences (for example, in the Free Tier)
Measure the effectiveness of ads and promotions
Provide or tailor promotional communications where permitted

Some of our use of online identifiers and usage data with advertising and analytics partners may be considered a "sale" or "sharing" of personal information under certain US state privacy laws (see Section 9). We do not disclose your personal information in exchange for money.

Payments and account management

Process subscription fees and manage billing
Provide receipts and transactional communications
Enforce subscription and usage limits consistent with our Terms

Legal, compliance, and protection

Comply with applicable laws, regulations, and legal processes
Respond to lawful requests and legal claims
Protect our rights, property, users, and the public

We do not use your User Content to train Wexley's own models in a way that identifies you, unless you later opt in or provide explicit consent where required. We may use aggregated or de-identified data (which is not reasonably capable of identifying you) for research, safety, and service improvement.

4. Cookies, SDKs, and Similar Technologies

We and our service providers use cookies, local storage, and similar technologies to:

Keep you signed in and maintain session state
Remember your preferences
Perform analytics on how the Service is used
Support advertising or sponsored content (for example, frequency capping and measurement)

Types of cookies/technologies may include:

Strictly necessary (required for core functions like sign-in)
Performance and analytics (traffic measurement, performance monitoring)
Advertising / marketing (ad display and measurement, where applicable)

You can control cookies and similar technologies by:

Adjusting your browser settings (for example, blocking or deleting cookies);
Using any in-product cookie banners or preference centers we provide; and
Installing browser add-ons where available (for example, for certain analytics tools).

If you block certain cookies, some features of the Services may not function properly.

We do not sell your personal information in exchange for money. We share information with third parties in the following ways:

5.1 Service Providers (Processors)

We use service providers who act on our behalf and under our instructions, for purposes such as:

Hosting and infrastructure
Authentication and account management
Database and file storage
Analytics and performance monitoring
Email and communication
Payment processing and billing
Security, logging, and rate limiting
Advertising, where applicable

These providers may process personal information to deliver their services to us, but they are not allowed to use your information for their own independent purposes beyond what is permitted in their agreements with us.

5.2 AI and Search Providers

To generate answers and summaries, we send limited context to AI and search providers.

We intentionally avoid sending direct personal identifiers (such as your name, email, or a student's name) in these prompts as part of normal operations.
These providers process data under their own terms and privacy policies, which may include logging for security, abuse prevention, and service improvement at a system level.

5.3 Advertising and Analytics Partners

We may share limited identifiers and usage data (for example, cookie IDs, IP-based geolocation, and page views) with advertising and analytics partners to:

Serve, measure, and improve ads and sponsored content;
Understand how campaigns perform; and
Avoid showing the same ads too often.

Under certain US state laws (such as the California Consumer Privacy Act as amended by the CPRA), these activities may be considered a "sale" or "sharing" of personal information, even though we do not exchange your data for money. You can learn more and exercise related rights in Section 9.

5.4 Legal, Safety, and Corporate Events

We may disclose information:

To comply with law, regulation, legal process, or governmental requests;
To enforce our Terms or protect the security and integrity of the Services;
To protect the rights, property, or safety of Wexley, our users, or others; or
In connection with a corporate transaction (such as a merger, acquisition, or sale of assets), where your information may transfer as part of that transaction, subject to appropriate protections.

We may also share aggregated, de-identified, or anonymized information that does not reasonably identify you, for example to describe usage trends.

6. Data Retention

We retain personal information for as long as reasonably necessary to:

Provide the Services and operate our business;
Comply with legal, accounting, and reporting obligations;
Resolve disputes and enforce our agreements; and
Maintain security and prevent abuse.

Typical examples:

Account data and settings – retained while your account is active and for a period after closure (for example, to complete account closure, prevent fraud, or comply with legal obligations).
Login and security logs – detailed login-attempt IP logs are retained for up to 90 days and are subject to an automated cleanup process that deletes or de-identifies login-attempt records older than 90 days, unless we need to retain certain records longer for security, fraud prevention, or legal reasons.
Billing and payment records – retained consistent with tax and accounting requirements.
Public content (e.g., public questions or comments) – may remain visible even after account deactivation, unless we choose to remove it or are required to do so by law. We may dissociate such content from your account consistent with our Terms of Service.

When we no longer need personal information for the purposes described, we may delete it or convert it to a de-identified or aggregated form.

7. Security

We use reasonable administrative, technical, and physical safeguards to protect information, including:

Encryption in transit for connections to our Services
Access controls and authentication measures
Segregation of roles and internal access limitations
Logging and monitoring for security and abuse

No system is perfectly secure. We cannot guarantee absolute security of your information. You are responsible for choosing a strong password, keeping your credentials secure, and using the Services in a safe and responsible way.

If we become aware of a data security incident involving your personal information, we will take appropriate steps and provide any required notifications in accordance with applicable law.

8. Your Choices and Controls

8.1 Account Settings

Within available settings, you may be able to:

Update your profile information (such as display name, username, and avatar);
Manage student profiles and personalization choices;
Adjust communication preferences (for example, newsletters and notifications);
Switch between tiers or cancel subscriptions.

8.2 Access, Correction, and Deletion

You can request:

Access to the personal information we hold about you;
Correction of inaccurate or incomplete information; and
Deletion of your account and associated personal information, subject to legal and operational constraints.

Where self-service tools are not available or you need additional assistance, you can contact us at support@wexley.ai. We may take reasonable steps to verify your identity before acting on your request.

We generally aim to respond to reasonable access/export and deletion requests within about 30 days, and no later than any timeframes required by applicable law, recognizing that complex or high-volume requests may take longer.

8.3 Data Export

We may provide tools that allow you to download or export your core account and question data directly from the Services. Where those tools are not yet available or you prefer email, you may request a copy of your data at support@wexley.ai, and we will provide it in a reasonable, commonly used electronic format, subject to verification and legal limitations.

8.4 Marketing Communications

You may opt out of non-essential marketing emails:

By clicking the "unsubscribe" or similar link in the email; or
By adjusting your communication preferences or contacting us.

We may still send you necessary transactional or service emails (for example, about your account, security, or billing).

8.5 Cookies and Tracking

You can manage cookies and similar technologies as described in Section 4 and, where available, in any cookie banner or preferences interface.

For users in states with laws like the California Consumer Privacy Act (CCPA/CPRA):

Some of our use of advertising and analytics cookies and similar technologies may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising.

You can opt out of these activities by:

Using any "Do Not Sell or Share" or similar control we provide within the Services; and/or
Contacting us at support@wexley.ai with "Privacy Request – Do Not Sell or Share" in the subject.

When you exercise these rights, we will apply them as required by applicable law, which generally means:

Limiting our use of certain advertising and analytics tools for your browser and account; and
Respecting your choices going forward, subject to necessary cookies and any legal obligations.

Where required by applicable law, we also recognize opt-out preference signals (such as the Global Privacy Control) for the browser or device that sends the signal, subject to our ability to reasonably apply the signal.

9. California and Other U.S. State Privacy Rights

If you are a resident of California or another US state with similar privacy laws, you may have additional rights with respect to your personal information.

9.1 Categories of Personal Information (Notice at Collection)

Over the past 12 months, we may have collected the following categories of personal information (as defined in the CCPA/CPRA) for the purposes described in this Policy:

Identifiers (e.g., name or username, email address, IP address, device identifiers)
Customer records information (e.g., billing contact info and subscription details)
Internet or other electronic network activity (e.g., usage data, logs, interactions with the Services)
Approximate geolocation (e.g., city/region inferred from IP address)
Inferences (e.g., high-level interest and preference segments inferred from your use of the Services)
Sensitive data – we do not intend to collect sensitive personal information as defined by California law, and we ask that you do not submit sensitive data (such as government ID numbers or detailed financial account numbers) via the Services.

We collect these categories of information from the sources described in Sections 2.1–2.3 and use them for the purposes described in Section 3.

9.2 Sale/Sharing for Targeted Advertising

As noted above:

We do not sell personal information for money.
We may allow advertising and analytics partners to collect or receive certain identifiers and internet activity via cookies and similar technologies. Under California law, this may be considered a "sale" or "sharing" of personal information.
California residents can opt out of this "sale" or "sharing" as described in Section 8.6.

9.3 Your State Privacy Rights

Subject to applicable law and verification, you may have the right to:

Know the categories of personal information we collect, the sources of that information, our purposes for collecting it, and the categories of third parties to whom personal information is disclosed;
Access and receive a copy of the specific pieces of personal information we hold about you;
Correct inaccurate personal information about you;
Delete certain personal information we hold about you;
Opt out of "sale" or "sharing" for cross-context behavioral advertising; and
Not be discriminated against for exercising any of your privacy rights.

To exercise these rights, you can contact us at support@wexley.ai with a clear description of your request and any information we reasonably need to verify your identity. We will not discriminate against you (for example, by denying services or charging different prices) solely because you exercise a privacy right, though different tiers, features, or pricing may be available where certain data uses (such as targeted advertising) are disabled.

You may designate an authorized agent to submit requests on your behalf where permitted by law. We may require proof of the agent's authorization and may also require you to verify your identity directly with us.

If we deny your request in whole or in part where permitted by law, we will tell you why.

10. International Users

The Services are operated in the United States, and your information may be transferred to, stored in, or processed in the United States.

If you access the Services from outside the United States, you:

Acknowledge that US data-protection laws may differ from those in your country and may not provide the same level of protection or rights; and
Consent (to the extent required) to the transfer, storage, and processing of your information in the United States as described in this Policy.

If Wexley later chooses to actively target or localize the Services for the EU, UK, or other jurisdictions, we may adopt additional privacy notices or mechanisms to address those regions and will update this Policy or provide supplemental documentation as needed.

11. Children and Student Information

The Services are intended for adults 18 years and older. We do not knowingly allow individuals under 18 to create accounts or use the Services directly.

If we become aware that we have collected personal information directly from someone under 18 in a manner that requires parental consent and we do not have that consent, we will take appropriate steps to delete that information.

If you believe a minor has provided personal information directly to us, please contact support@wexley.ai.

Student information provided by parents or other adults.

Many Wexley users are parents, guardians, or family members of students (including minors and adults). When you, as an adult user:

Create or update a student profile; or
Include a student's circumstances in a question,

you are responsible for:

Ensuring you are authorized to provide that information;
Only providing information that is reasonably necessary for the intended use (for example, using a first name, nickname, or label like "Student 1" rather than full legal name); and
Not providing sensitive identifiers such as full social security numbers, full education records, or detailed medical records.

In our consumer-facing Services, we are not acting as a school or "school official" under FERPA, nor as a HIPAA covered entity or business associate for purposes of medical records. If, in the future, we enter into separate agreements with schools or institutions that involve different data-handling roles, those will be governed by separate terms and notices.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top.

For material changes that affect your rights or how we use personal information, we may provide additional notice (for example, via the Services or by email) where required by law. If you continue to use the Services after an updated Privacy Policy takes effect, you are deemed to have accepted the updated Policy.

If you do not agree with an updated Privacy Policy, you should stop using the Services.

13. Contact Us

If you have questions, concerns, or requests about this Privacy Policy or our privacy practices, you can contact us at:

Email: support@wexley.ai
Mailing Address: Wexley, 611 Wilshire Blvd, Suite 900, Los Angeles, CA 90017, USA