Privacy Policy

1. General Information and Data Controller

The controller of the personal data of the users of the educational platform available at www.edubba.ai (hereinafter: "Platform" or "edubba") is: IBIS Świderski Sp. K. with its registered office in Kraków, ul. Leona Wyczółkowskiego 7, 30-118 Kraków, Poland, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, XI Commercial Division of the National Court Register, under the KRS number: 0000960648, NIP: 9452243846 (hereinafter: "Controller").

Contact with the Controller regarding matters related to the processing of personal data is possible via e-mail at: contact@edubba.ai or by post to the address of the Controller's registered office address.

The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: "GDPR"), as well as Polish national regulations.

2. Nature and Scope of Services and the Role of the Controller

The Platform is an educational tool utilizing artificial intelligence (AI) technologies to support teachers and schools implementing international curricula. In particular, the Platform enables: generating lesson plans, generating worksheets, tests, and flashcards, organizing teachers' work, analyzing curricula and source materials, and managing educational materials. Services are provided under a subscription model.

Distinction of roles: In the case of organizational subscriptions (schools, educational institutions), the School is the Controller of the personal data of its employees, teachers, and students entered into the system. The edubba platform acts solely as a Processor, processing data on the documented instructions of the School, in accordance with the Data Processing Agreement (DPA).

Responsibility for consents: The School and users introducing third-party data into the Platform (including student data, psychological notes, or opinions) declare that they possess the appropriate legal basis to do so (e.g., consents of parents/legal guardians or authorizations resulting from educational law).

3. Scope of Processed Data

The Controller processes the following detailed categories of users' personal data:

3.1 User account data: first name and last name, e-mail address, login details, encrypted password, organization or school data, assigned user role, account settings.

3.2 Organizational data: In the case of organizational or school accounts: school name and details, organization administrators' data, number of users, information about licenses and subscriptions.

3.3 Educational data, user materials, and content: The Platform may process content entered and generated by the user: curriculum source materials, educational materials, generated content, data entered into the AI system, users' notes.

3.4 Student data within the psychologist module: In the case of keeping records by psychologists and receiving student information for lessons: student's first name and last name, class/group assignment, educational and psychological recommendations, specialists' notes.

3.5 Technical and telemetric data: IP address, session identifiers, device and browser data, system logs, cookie data, analytical data regarding performance and the method of using the Platform's functionalities.

3.6 Payment data: payment identifiers, transaction statuses, billing data, invoice data. The Controller does not store users' full payment card details. This process is handled entirely by an external, certified operator.

4. Purposes and Legal Bases for Data Processing

Users' personal data are processed for the following purposes and based on the following legal grounds from the GDPR:

• Creation and maintenance of the user account and provision of digital services (including the subscriptions) – legal basis: Article 6(1)(b) of the GDPR (necessity for the performance of a contract).
• Verification of organizations and administrators – legal basis: Article 6(1)(b) of the GDPR (conclusion and performance of a contract) and Article 6(1)(f) of the GDPR (legitimate interest – fraud prevention).
• Handling payments, billing, and fulfillment of tax and accounting obligations – legal basis: Article 6(1)(c) of the GDPR (legal obligation resulting from provisions, including the Accounting Act).
• Handling inquiries and technical support – legal basis: Article 6(1)(f) of the GDPR (legitimate interest consisting in the efficient resolution of technical problems).
• Ensuring the security of the Platform (including log analysis, prevention of fraud and cyberattacks) – legal basis: Article 6(1)(f) of the GDPR (legitimate interest of the Controller).
• Marketing and marketing communication (e.g., newsletter) – legal basis: Article 6(1)(f) of the GDPR (legitimate interest consisting in direct marketing) in connection with obtaining voluntary, prior consent for the electronic communication channel.
• Establishment, exercise, or defense of legal claims – legal basis: Article 6(1)(f) of the GDPR (legitimate interest consisting in protecting the proprietary rights and image of the company).

5. Subscriptions

The Platform may offer individual subscriptions and organizational subscriptions for schools and educational institutions. Activating a subscription may require account registration, e-mail address verification, payment or payment card authorization, and, in specific cases, manual account activation by the Controller. In the case of school organizations, the activation process may include additional verification of school data and organization administrator authorizations. Rules for further data storage after the end of an active subscription and the expiry of this period are regulated in Section 13.

6. AI Technologies and the Psychologist Module

The Platform utilizes artificial intelligence technologies provided by external AI service providers, in particular OpenAI. In connection with using the AI functionality:

• data entered by the user are transferred to AI service providers via a secure, encrypted API key,
• content is analyzed automatically in order to generate dedicated educational materials,
• Data confidentiality in AI: In accordance with commercial B2B agreements concluded with AI technology providers, data transmitted via the API are not used by these entities to train public artificial intelligence models.

Materials generated by AI are of an auxiliary and educational nature. AI algorithms do not make automated decisions within the meaning of Art. 22 GDPR. The final verification and didactic decision always belong to a human.

The Platform may enable the use of a psychologist module and functions supporting the personalization of educational materials for students with special educational needs (SEN). Within these functionalities, the following may be processed: psychological recommendations, specialists' notes, information regarding educational support, information about adjustments to teaching materials, data regarding educational difficulties or the student's functioning.

• Protection of students' privacy: Any information about mental health, learning difficulties, development, or dysfunctions of students linked to their first name and last name constitutes a special category of data within the meaning of Art. 9 GDPR. The processing of this data in the Platform takes place exclusively within the framework and on the basis of the Data Processing Agreement (DPA) concluded with the School, which, as the Controller of this data, possesses appropriate legal-educational authorizations or proper consents of legal guardians.

6a. Compliance with the EU Artificial Intelligence Act (EU AI Act)

• 6a.1. The Controller declares that the functionalities of the edubba.ai Platform utilizing artificial intelligence technologies have been subjected to verification and classification in accordance with the requirements of Regulation (EU) 2024/1689 of the European Parliament and of the Council (AI Act):
  • The module for suggesting lesson adjustments to special educational needs (SEN) is of an exclusively auxiliary nature, assisting the teacher. Since the system does not make independent decisions, and the final verification and eventual modification rest fully with a human, these functionalities do not constitute high-risk systems within the meaning of the AI Act. However, the Controller implements heightened standards of transparency, accuracy, and cybersecurity for them.
  • Functions assisting the teacher in generating lesson plans, flashcards, and worksheets constitute AI systems with minimal risk, serving as preparatory tools.
  • Interactive direct communication tools (chatbots) constitute AI systems with limited risk and fulfill the information obligations regarding transparency provided for by EU law.
• 6a.2. With regard to functionalities supporting educational analysis, edubba.ai guarantees high standards of technical robustness, cybersecurity, and the implementation of a system log registry enabling the reconstruction of the suggestion generation process by the algorithm. The training and validation of models take place in compliance with strict data governance rules in order to eliminate bias and prejudice.
• 6a.3. Human oversight mechanism: All tools in edubba.ai have been designed in a way that ensures full and effective human oversight (human-in-the-loop). The SEN adjustment proposals generated by AI are of an advisory nature only and do not constitute automated decision-making within the meaning of Art. 22 GDPR. The final didactic decision always belongs to the teacher.

7. Purpose of Data Processing and Development of Services

The Controller does not use the content, source materials, or data entered by users for purposes other than the provision, maintenance, technical support, and development of the functionalities of the services for the benefit of the given user or the given School.

8. User Roles and Data Access

The Platform operates under an organizational model based on organizations, user roles (e.g., psychologist, organization administrator, organization teacher, individual teacher), subscription plans, and access levels. The scope of access to data depends directly on the role assigned to the user in the system. Organization administrators may have access to the data of users assigned to a given organization within the scope resulting from the granted administrative privileges.

• Absolute protection and isolation of the psychologist module: Data processed within the school psychologist module, including recommendations, meeting notes, diagnoses, and opinions, constitute special categories of personal data (mental health data) and are covered by the professional secrecy of the psychologist without time limit under national regulations. In order to ensure compliance with the law:
  • The Platform implements strict technical and logical data protection measures, ensuring that notes and diagnostic data are completely invisible to any other platform users within a given School, including individuals holding the role of organization administrator or managerial/directorial privileges.
  • Access to the psychologist module is restricted exclusively to authorized specialists handling a given case, and the data are protected by advanced access control and encryption mechanisms, preventing inspection by unauthorized persons.
• Automatic matching of support guidelines to lessons (SEN): The Platform enables the automatic assignment of teaching recommendations to specific lesson plans generated by the teacher. This process is based solely on data and documentation that have been entered into the system as part of the performance of duties by an authorized school psychologist and are intended for the purpose of individualizing the educational process.
• Rules for presenting data to teachers: The transmission of information generated on the basis of data from the psychologist to teachers for the purpose of personalizing lessons (e.g., guidelines regarding the student's personality traits, potential, needs, or sensitivity to specific educational topics) takes place in the form of an individualized support profile assigned to a given student. This information is strictly devoid of detailed medical descriptions and deep diagnostic documentation, and its presentation aims solely at ensuring the student's emotional safety and optimal learning conditions, unless the disclosure of a narrower scope of data is necessary and permissible on the basis of separate provisions of educational law.
• In order to ensure the highest degree of student privacy protection, all queries directed to external AI technology providers (including OpenAI) via the API key within the SEN module and the psychologist module are subjected to prior automatic pseudonymization or anonymization on the Platform's side, which excludes the possibility of identifying the identity of the data subjects by external systems.

9. History of Changes and Archiving

In order to ensure data security, accountability, and to preserve the integrity of didactic documentation, the system automatically stores: the history of changes and information about operations performed by users (activity logs). Deleted data may be temporarily stored in a system backup copy in accordance with the data retention policy and the network security principles of the Platform.

10. Payment Operator

Online payments are processed via Stripe or other independent payment operators indicated during the purchase process. Payment operators process data necessary to execute transactions as independent data controllers, in accordance with their privacy policies and strict financial security standards (PCI-DSS).

11. Data Sharing (Data Recipients)

Users' personal data may be transferred exclusively to trusted third parties supporting the operation of the platform on the basis of data processing agreements: AI service providers (e.g., OpenAI), payment operators (e.g., Stripe), hosting and cloud infrastructure providers, mailing and CRM system providers, analytical tool providers, as well as entities providing accounting and legal services to the Controller. Under no circumstances does the Controller sell or trade users' personal data with external commercial entities or brokers.

12. Transfers of Data Outside the European Economic Area

In connection with the use of global technological partners (e.g., OpenAI, Stripe), data may be transferred outside the European Economic Area (EEA), including to the United States. In such cases, the Controller applies appropriate safeguards required by the GDPR, relying on adequacy decisions of the European Commission (e.g., the EU-US Data Privacy Framework) or applying Standard Contractual Clauses (SCC) approved by the European Commission, along with additional security measures (such as data encryption at rest and in transit).

13. Data Storage Period and Retention Policy

• The personal data of Individual Users (teachers) are processed for the duration of having an active Account on the Platform. In the event of the expiration of a paid subscription, the Account transitions into an inactive state, and the Materials accumulated on it are not deleted, which enables the User to resume the subscription in the future without losing data. Data will be permanently deleted if the User submits a request to delete the Account (the right to be forgotten), which is executed within 14 days of submission to the address: contact@edubba.ai.
• In the case of organizational subscriptions (Schools and educational institutions), where edubba acts exclusively as a Processor, the retention periods for the data of students, teachers, and teaching materials are directly regulated by the Data Processing Agreement (DPA) concluded with the School. Upon termination or expiration of the agreement, edubba promptly deletes or returns all personal data and deletes existing copies in accordance with the School's decision, unless an obligation for their further storage results directly from Union law or Polish law.

14. User Rights

In accordance with the GDPR, every user (and, respectively, parents or legal guardians of students whose data are processed) is entitled to the right to: access their data and receive a copy thereof, rectify data, erase data ("the right to be forgotten"), restrict processing, transfer data to another provider, object to processing based on a legitimate interest, and withdraw consent at any time. The user also has the right to lodge a complaint with a supervisory authority – in Poland, this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw.

15. Cookies and Analytical Technologies

The Platform utilizes cookies and similar technologies in order to ensure session stability, increase the level of security, analyze traffic and statistics, and optimize the operation of the system. The user may at any time independently manage cookie settings from the level of their web browser or by using the dedicated privacy settings panel on the Platform's website.

16. Procedures in the Event of a Security Breach (Data Breach)

In the event of detecting any personal data protection breach that could result in a high risk to the rights or freedoms of natural persons, the Controller undertakes to take immediate remedial actions, report the incident to the supervisory authority within 72 hours, and promptly notify the affected users or School administrators, in accordance with the requirements of Art. 33 and 34 GDPR.

17. Data Security

The Controller applies advanced technical and organizational measures for data protection (including secure SSL/TLS transmission encryption protocols, database encryption, and access monitoring systems). Access to data within the internal structure of edubba is granted exclusively to persons explicitly authorized by the Controller, trained in the field of data protection, and bound by a strict obligation of confidentiality.

18. Changes to the Privacy Policy

The Controller reserves the right to update this Privacy Policy, in particular in the event of changes to legal regulations, the development of AI technology, or modifications to the functionalities of the edubba Platform. Registered users will be informed of significant changes via e-mail or through an in-system announcement with at least 14 days' notice.