XARA Privacy Policy

This privacy policy explains which personal data afca ag processes when operating the AI conversation trainer Xara. Xara consists of the web client XaraWeb, the Xara app for Meta Quest and the administration tool XaraAdmin.

Personal data means any information relating to an identified or identifiable person. This policy is designed to meet the requirements of the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR). Whether and to what extent these laws apply depends on the individual case.

Xara is used in education and professional training and is intended for people aged 16 and over. Institutions must comply with the applicable legal requirements when their learners use the service, including any required notices, permissions and consents. This does not affect afca's own legal obligations.

afca ag, Industriestrasse 35, 3052 Zollikofen, Switzerland. For data protection requests: datenschutz@afca.ch (contact: Markus Brönnimann).

Xara is normally used by educational institutions and companies (the "institution") for their learners. The institution decides who trains, which scenarios are used and how long conversations are retained. It is the data controller for this processing; afca processes this data on its behalf and according to its instructions. afca is the controller for the operation of the platform itself (access management, security, technical logs).

3.1 Access and sign-in

• Xara app for Meta Quest: There is no user account. Access is granted through an access code issued by your institution or a one-time code. No names, email addresses or account data are collected. The app does not query your Meta account.
• XaraWeb: Access through an access link or code issued by your institution, or by signing in with Microsoft Entra ID (your institution's account or an account managed by afca). When you sign in with Entra ID, we receive your name, email address and user ID to verify that you belong to an institution. If you access Xara through a hep Verlag account, hep provides us with your email address and licence information to verify your entitlement.
• XaraAdmin: Sign-in exclusively through Microsoft Entra ID. XaraAdmin receives your name, email address and user ID as well as the name and tenant ID of your organisation (permissions "XaraAdmin can access the name, email address and user ID" and "XaraAdmin can view information about the organisation"). Consent is given once and can be revoked at any time; an administrator can grant it for the whole organisation. This data is used solely for access control and is not stored in the Xara database. It may appear in technical logs (Section 3.4).

Sign-in data is not linked to conversation content.

3.2 Optional user identifier

Your institution may require you to enter a user identifier before a conversation, for example a number or a short code. This identifier is stored with the conversation record so that your institution can attribute your exercises to you. afca does not know what the identifier means.

3.3 Voice and conversation content

• Voice input: While you speak, your voice is streamed to the speech recognition service Microsoft Azure AI Speech and converted to text there. The audio is stored neither by afca nor by Microsoft. Only the recognised text is kept.
• Conversation record: Your utterances as text and the AI avatar's replies are stored as a record, together with the scenario, a timestamp and, if enabled, your user identifier.
• Feedback: On request the AI analyses the conversation and gives you feedback. This analysis is part of the record.

Your institution can determine in XaraAdmin which staff members may view its conversation records and restrict this access to individual persons. Authorised staff also see the feedback and the user identifier.

Conversations are stored pseudonymised. afca does not hold the mapping between the user identifier assigned by your institution and your identity. Conversation content may nevertheless contain personal information if you include it yourself. Do not mention real names or details about real people in training conversations.

3.4 Technical logs and device data

Operation generates automatic backend logs: time, function called, session ID, error messages and an anonymised IP address. These backend logs contain no conversation content. Logs of XaraWeb and XaraAdmin may contain your sign-in identifier. If an optional user identifier is used, it may appear in backend logs together with the session ID.

The Quest app stores your access code, the selected language and your settings locally on the headset. With the "Upload log" function you can send the app's most recent technical log entries to afca for troubleshooting. These entries contain the session ID, device model and app version and may contain text recognised during the current conversation as well as the access code you entered. They are transmitted only when you trigger the upload.

3.5 Data we do not process

The Quest app does not access camera images. The passthrough view of your surroundings is rendered by the headset's operating system and is not visible to the app. The app does not store or transmit any hand, eye, face or body tracking data and collects no location, no advertising ID and no data from your Meta account. No analytics, advertising or social media services are embedded.

The app requires access to the microphone (voice input) and to the internet. No other permissions are requested.

5.1 Speech recognition and speech synthesis

Microsoft Azure AI Speech converts your speech to text and the avatar's replies to speech. Processing takes place in Microsoft data centres in Switzerland or in the EU. Microsoft stores neither audio nor text.

5.2 Conversation and feedback

For the avatar's replies and the feedback we use the Microsoft Azure OpenAI Service (including GPT-4o and Realtime models). The language model receives your institution's scenario instructions, the conversation so far and your current utterance as text. It does not receive sign-in data, your user identifier or your voice recording.

All models used by default are deployed with the deployment type "Data Zone Standard" in Microsoft's EU data zone. Processing takes place within this data zone, which follows the Microsoft Azure EU Data Boundary and comprises the EU member states as well as EFTA states such as Switzerland and Norway.

Microsoft does not use your inputs to train AI models and does not store them, with one exception: Microsoft automatically screens inputs for abuse and may retain content flagged as potentially abusive for up to 30 days for review. This content is stored in the geography of the respective Azure resource (Switzerland or EU). For resources in the European Economic Area, the review is carried out by authorised Microsoft employees located in the European Economic Area.

5.3 Optional voice dialogue models

Institutions may select additional models for individual scenarios: models offered through Microsoft Azure with the deployment type "Global Standard" (for example gpt-audio) or Google Gemini. These options are disabled by default and can only be used if the institution explicitly lifts the setting "AI models Switzerland/EU only" and assigns a corresponding model to a scenario. These models also receive conversation text, but not your voice recording. The institution selects the models in XaraAdmin; this privacy policy is also linked there.

With Global Standard, Microsoft may process data in any Azure region worldwide where the model is available; content retained for abuse monitoring stays in the geography of the Azure resource (EU). Gemini processing takes place in the USA; transient storage or caching may also occur in other countries where Google or its agents maintain facilities.

Microsoft and Google do not use the transmitted content to train or improve their AI models. Google retains content for abuse monitoring for a limited period that it does not specify.

5.4 AI feedback

AI feedback supports your reflection on the training conversation. It is generated automatically from the conversation content and is not a grade. afca does not use it to assess individuals, makes no automated decisions with legal effect and does not carry out profiling. As part of the conversation record, the feedback is visible in XaraAdmin to the staff your institution has authorised (Section 3.3). Your institution decides whether and how it uses conversation records.

We disclose personal data only to the following processors, to the extent necessary for operation. No data is passed on for advertising or for third parties' own purposes.

The scenario optimiser in XaraAdmin processes only scenario texts written by trainers, not conversations from XaraWeb or the Quest app. Anthropic does not use this content to train its models and normally deletes it within 30 days. If Anthropic's automated safety systems flag content as violating its usage policy, Anthropic may retain it for up to 2 years. Please do not include personal or confidential information in scenario texts either.

If you access Xara through a hep Verlag account, hep Verlag AG, Bern, verifies your sign-in and licence under its own responsibility and passes us the data listed in Section 3.1.

Under Swiss law, EU and EEA countries are recognised as providing an adequate level of data protection. For transfers to the USA and other countries by Google and Anthropic and for any other international transfers by Microsoft, we rely on the contractual safeguards named above.

When the customer relationship ends, all of the institution's data is exported on request and then deleted.

The Quest app and XaraWeb use no cookies for analytics or advertising. XaraWeb stores technically necessary settings and your access token locally in the browser. When you sign in through Microsoft Entra ID (XaraWeb, XaraAdmin), Microsoft sets cookies for authentication and single sign-on; Microsoft's privacy statement applies (privacy.microsoft.com). Google Analytics, social media plugins and trackers are not embedded.

We take appropriate technical and organisational measures: encryption in transit (TLS) and at rest, separation of data per institution, role-based access limited to staff who need it for operation, key management in Azure Key Vault, separate test and production environments, monitoring and logging. The infrastructure is covered by Microsoft Azure's certifications (including ISO/IEC 27001, ISO/IEC 27701, SOC 2).

Within the scope of the applicable data protection law you have the right to access, rectify and delete your data and to object to its processing. Please contact datenschutz@afca.ch. Please do not send passwords or access tokens. Where the user identifier assigned by your institution is needed to locate the relevant records, we coordinate the request with the institution.

afca handles correction and deletion requests without undue delay. We delete conversation and feedback data, synthesised avatar audio, usage logs and exports within 7 days, and technical logs, including uploaded app logs, within 30 days at the latest. Deleted records may remain in rolling backups for up to 7 days.

You may also lodge a complaint with the competent data protection authority, in Switzerland the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch).

We update this policy when our data processing changes. The version published on afca.ch applies. The German version is binding.

• Version 1.4 (06.10.2026): Revised policy with information on AI processing, data categories, retention, processors, Quest app permissions and data subject rights
• Version 1.2 (21.11.2025): Updated Azure services and locations
• Version 1.1 (05.11.2025): Updated Xara web client
• Version 1.0 (25.11.2024): First publication