Privacy & Data Policy

This policy explains what personal data XR Academy (“we”, “us”, “our”) collects when you use our website, our mobile app for iPhone and Android and the virtual reality streaming service they provide (together, the “Service”), why we collect it, how long we keep it and what choices you have. Please read it together with our Terms & Conditions.

1. Who we are

XR Academy is a subscription-based virtual reality platform offering 360° videos, virtual tours, immersive VR experiences and educational programmes. The Service, including the mobile app published on the App Store and Google Play, is operated by Tip Top Union Limited, which is the controller of your personal data. Our contact details are in the Contact section at the end of this policy.

2. Data we collect

We only collect the data we need to give you access to the Service, keep it secure and support you.

• Mobile number. When you sign in with your mobile number we send it to your mobile carrier or its billing partner to confirm that the number has an active subscription. We store the number, in full and in a masked form, together with the subscription identifiers the carrier returns, such as a subscription ID, service name, billing plan, start and renewal dates and country.
• Account details. An account identifier, a display name and, if you sign in with email and password, your email address and a protected form of your password. For carrier sign-in a technical account identifier is derived from your subscription token; you do not choose a password.
• Access tokens. If you reach the Service through an access link from your carrier or a partner portal, the token in that link is used to sign you in and is not reused for any other purpose.
• Usage data. Which videos, tours and experiences you open, when you watch them and for how long, and the titles you save to your Favourites, so that the Service works, streams can be delivered securely and we can understand what is popular.
• Technical data. IP address, device type and operating system, app version, browser type, language and approximate country, error and performance logs. This is collected automatically whenever you use the Service.
• Motion and orientation data. To let you look around in 360° and VR content, the app reads your device’s motion and orientation sensors while a video is playing. This data is processed on your device to move the picture and is not stored or sent to us.
• Preferences stored on your device. The mobile app keeps settings such as playback and language preferences on your device.
• Support messages. Anything you send us through the contact form, by email or through our support tools, including your name and email address.

We do not ask for and do not knowingly collect payment card details. Subscription charges are billed by your mobile carrier, which processes your payment data under its own privacy policy. Nothing is bought through the App Store or Google Play, so Apple and Google do not process payments for the Service.

The mobile app contains no third-party advertising or analytics software development kits, and it does not track you across other companies’ apps or websites.

3. Why we use your data and on what legal basis

• To provide the Service: confirming your subscription, signing you in, streaming content, keeping your Favourites and remembering your settings. Basis: performance of our contract with you.
• To keep the Service secure: protecting streams with signed, time-limited links, preventing account sharing and fraud, and detecting abuse. Basis: our legitimate interest in running a secure service.
• To support you: answering your questions and resolving problems. Basis: performance of our contract and our legitimate interest in good customer service.
• To improve the Service: analysing usage in aggregate to understand which content and features are used. Basis: our legitimate interest in improving what we offer.
• To send you service messages: for example about changes to the Service or to these policies. Basis: performance of our contract and legal obligations.
• To show notifications you allowed: where the app offers notifications, it asks for your device’s permission first. Basis: your consent, which you can withdraw at any time in your device settings.
• To comply with the law: responding to lawful requests from authorities and keeping records we are required to keep. Basis: legal obligation.

We do not sell your personal data and we do not use it for third-party advertising.

4. Device permissions

The app only asks for the device permissions it needs. Motion and orientation sensors are used while you watch 360° or VR content so the picture follows your movement. Where the app offers notifications, it asks for notification permission the first time; you can change either permission at any time in your device settings, and the rest of the app keeps working without them.

5. Who we share data with

• Mobile carriers and billing partners, to confirm your subscription and to bill it. They act as independent controllers for the billing relationship.
• Hosting and infrastructure providers that run our servers, databases, authentication and content delivery network. They process data on our instructions.
• Customer support tools we use to answer your messages.
• App stores. Apple and Google distribute the app and may collect download, crash and device data under their own privacy policies. We do not share your account or viewing data with them.
• Professional advisers and authorities, where the law requires it or to protect our rights.
• A buyer or successor, if our business is sold or reorganised, in which case this policy will continue to apply.

Every provider that processes personal data on our behalf is bound by contract to protect it to the same standard as this policy and to use it only on our instructions.

6. International transfers

Tip Top Union Limited is established in Hong Kong, and our providers may store or process data in other countries. When data leaves the country or region where you live we rely on safeguards recognised by the applicable data protection law, such as adequacy decisions or standard contractual clauses, and we require our providers to protect your data to the same standard.

7. How long we keep data

• Account and subscription data: for as long as your subscription is active and up to 24 months after it ends, unless a longer period is required by law or to resolve disputes.
• Usage and technical logs: up to 12 months.
• Support messages: up to 24 months after the request is closed.
• Data you delete from the app (see section 9): removed immediately from your device and from your profile.

8. Security

We protect your data with encryption in transit, access controls, signed and expiring streaming links and monitoring. No online service can be completely secure, so please keep your device and any access links private.

9. Deleting your data and your account

The mobile app includes a Delete account option. Using it removes the profile data saved for you, including your Favourites, signs you out and wipes everything the app stored on your device. You can also ask us to delete your account by email. Because access to the Service is granted through your subscription, deleting your account does not cancel that subscription and does not remove your ability to sign in again later; if you sign in again, a fresh profile is created.

10. Your rights

Depending on where you live, you may have the right to ask us for access to your personal data, to correct or erase it, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw consent where we rely on it. You may also complain to your data protection authority. To exercise any of these rights, contact us using the details below. We may ask you to confirm your identity first.

11. Children

A subscription can only be taken out by someone old enough to hold a mobile subscription contract, so accounts are for adults aged 18 or over, or the minimum age for such a contract in your country. Younger family members may watch under the supervision of the subscription holder, who remains responsible for the account. We do not knowingly collect personal data from children; if you believe a child has provided us with personal data, contact us and we will delete it.

12. Cookies

The mobile app does not use cookies. Our public website does not set cookies and does not run analytics. The member portal uses only the cookies and local storage needed to keep you signed in and remember your language; it does not use advertising or tracking cookies.

13. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it was last changed. If a change materially affects your rights we will notify you through the Service before it takes effect.

14. Contact

XR Academy is operated by Tip Top Union Limited. You can reach us by email at support@tiptopunion.com or by post at 84 Nathan Road, Kowloon, Hong Kong. Please include the mobile number or email address you sign in with so that we can find your account.