Exafy is designed to be a safe, age-aware, and education-focused learning environment. This policy explains the principles we follow, how we expect learners and adults to use the platform, and how to report safety concerns. It complements our Terms & Conditions and Privacy Policy.
Urgent help and emergencies
Exafy is not an emergency service.If a learner is in immediate danger, contact local emergency services, the learner's school safeguarding lead, parent, guardian, or another trusted responsible adult immediately. We cannot respond in real time and we do not monitor the platform 24/7.
For non-emergency safety concerns related to Exafy itself — content, AI behaviour, account misuse, or anything that has made a learner feel uncomfortable — see Reporting concerns.
Our safety principles
- Put learner wellbeing first
- Keep content age-appropriate
- Avoid harmful or unsuitable topics
- Protect children's data
- Reduce unnecessary data collection
- Use AI responsibly and transparently
- Support parents, guardians, teachers, and schools
Suitable educational content
Our learning materials are designed for English learning, exam preparation, vocabulary development, listening practice, reading, writing, and speaking improvement. We aim to avoid:
- Explicit sexual content
- Gambling content
- Alcohol or drug promotion
- Graphic violence
- Hate speech, harassment, or abuse
- Partisan political persuasion
- Religious debate or provocation
- Unsafe challenges or risky behaviour
- Culturally inappropriate material for school-age learners
Gamification safety
We use gamification (XP, streaks, badges, quests, mastery goals) to encourage learning, not to manufacture pressure. We avoid designs that exploit children's vulnerability or that pressure learners to share more personal data than necessary. We do not use loss-aversion patterns or aggressive notifications targeted at younger learners.
AI safety
AI-assisted feedback is used to support learning. It may be imperfect. Learners should not treat AI feedback as final exam marking or professional advice. We aim to prevent AI tools from producing unsafe, inappropriate, discriminatory, or age-unsuitable content. AI providers are listed in our Privacy Policy.
Learner accounts
Learners should use the platform under the supervision or approval of a parent, guardian, teacher, school, or responsible adult where appropriate. Learners must not share passwords, impersonate others, bully other users, upload harmful content, or misuse the platform.
Parent, guardian, teacher, and school roles
Adults responsible for learners should:
- Ensure account details are accurate
- Monitor age-appropriate use
- Help learners understand safe online behaviour
- Report concerns promptly
- Avoid sharing unnecessary personal data about children
Reporting concerns
Safety concerns can be reported to info@exafy.ai with the subject line "Safety". We may review accounts, content, submissions, or activity logs where necessary to investigate.
Response to safety issues
Where we identify a safety risk, we may:
- Remove content
- Restrict features
- Suspend or close accounts
- Notify parents, guardians, schools, or authorities where appropriate
- Improve filters, moderation, or learning safeguards
How quickly we respond
Our response time depends on the severity of the issue and how it reaches us. We list our standard targets below so reporters know what to expect.
- Urgent learner-safety reports — concerns suggesting imminent risk of harm, self-harm, exploitation, grooming, or abuse. Reviewed as soon as reasonably possible during operating hours, normally within the same working day, with an initial acknowledgement and triage step. Outside operating hours we monitor the safeguarding inbox at intervals; reports flagged urgent move to the top of the queue when staff are next available.
- General safety concerns — inappropriate content, gamification worries, bullying or harassment between learners, AI-output complaints, account-access issues affecting safeguarding. Normally acknowledged within 2 working days. A substantive response follows once we have completed any necessary internal review.
- Privacy and data-protection requests — access, correction, deletion, restriction, portability, complaint. Normally acknowledged within 5 working days and substantively answered within the one-month period set by UK GDPR Article 12(3) (this is a calendar month, so the deadline depends on when the request was received). Equivalent local statutory deadlines apply for Saudi PDPL and other Middle East frameworks.
- Complex investigations— multi-party reports, content-moderation disputes, school-mediated reports, or cases requiring external coordination. Handled case-by-case. We will update the reporter where appropriate and where doing so does not compromise the investigation or another learner's safety.
Operating hours. Our safeguarding queue is monitored during UK business hours (Monday–Friday, excluding UK public holidays). Reports submitted outside these hours are read at the next working session; reports we tag as urgent during triage are escalated immediately.
Escalation path. If you have submitted a report and have not received an acknowledgement within the target above, please re-send it to info@exafy.ai with "Safeguarding escalation" in the subject line and we will treat it as overdue. Independent complaint routes to the relevant data-protection authority remain available regardless of whether you have contacted us first.
These targets reflect our normal operations. They are not contractual SLAs and do not override any mandatory statutory timeframes that apply. Exafy is not an emergency service — if a learner is in immediate danger, see Urgent help and emergencies.
Safeguarding lead and staff vetting
Safeguarding reports go to info@exafy.ai with the subject line "Safeguarding". The Designated Safeguarding Contact role owns the queue and the internal escalation tree. Human moderators with sustained access to learner submissions undergo enhanced Disclosure and Barring Service (DBS) checks where the role meets the legal threshold.
Schools and KCSIE alignment
Keeping Children Safe in Education (KCSIE) is UK statutory guidance for schools in England. For UK schools using Exafy with under-18 pupils we align with the spirit of KCSIE. The school remains the data controller for pupil records and is responsible for parental consent, curriculum context, and ongoing safeguarding decisions about its pupils. We will support reasonable safeguarding requests from a school's designated safeguarding lead under the school's data-protection arrangements.
For schools outside the UK, Exafy will support reasonable safety and data-protection requests under the school's local safeguarding framework.
Saudi Arabia and Middle East users
Exafy is built for learners across the Middle East — including Saudi Arabia, the United Arab Emirates, Kuwait, Qatar, Oman, Bahrain, and Lebanon. We treat regional safety, cultural fit, and language access as first-class concerns alongside our UK safeguarding obligations.
Culturally appropriate content. Our learning materials are reviewed to be age-appropriate, culturally respectful, and suitable for school-age learners in the region. Topics that would be considered insensitive or inappropriate for Gulf and Levant audiences (alcohol-focused scenarios, dating themes, religiously sensitive depictions, gambling references, gender-stereotyped role play) are filtered out at content-authoring time and during ongoing review. We welcome flags from schools, families, and learners on anything that falls short of this standard.
Language and bilingual support.The platform is available in English and Arabic. Privacy and safety information is published in both languages where the user's locale preference is set to Arabic. Safety reports can be submitted in either language and are reviewed by staff who can respond in the language the reporter used.
Schools and ministries.Schools using Exafy in the Middle East remain the data controller for pupil records and are responsible for parental consent under their local framework — including but not limited to the Saudi Ministry of Education's data-protection guidance, the UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection, and equivalent rules in Kuwait, Qatar, Oman, Bahrain, and Lebanon. We support reasonable safeguarding and privacy requests from a school's designated safeguarding contact or the equivalent role under the school's local arrangements.
Parents, guardians, and learners. Local statutory rights — including under the Saudi Personal Data Protection Law (PDPL) where it applies, the UAE PDPL, and other regional frameworks — may give you additional rights such as requesting access, correction, destruction of your personal data where legally available, or filing a complaint with the relevant authority. We will not intentionally limit any mandatory privacy or consumer right that applies in your country of residence.
How to contact us. Please email info@exafy.ai with the subject line "Safety" for safeguarding reports or "Privacy request" for data-protection requests. We accept reports in English or Arabic. Response targets above apply; the queue is monitored during UK working hours, which run roughly 12:00–20:00 Riyadh time during winter (UK GMT, Riyadh = UK + 3 hours) and 11:00–19:00 during summer (UK BST, Riyadh = UK + 2 hours). Urgent reports are escalated outside these hours as soon as a staff member is available.