AILearn360 Privacy Policy

Account Information

• • Name, email address, username
• • Email address, phone number (if provided)
• • Password (hashed), passkey authentication settings
• • Profile language preferences, timezone

Documents and Content

• • PDFs, text files, and other study materials you upload
• • Quizzes, summaries, and notes created from your documents
• • Quiz scores, study session history, progress tracking
• • Notes, annotations, custom quiz questions

Usage and Technical Data

• • Features used, time spent, interaction patterns
• • Browser type, operating system, device identifiers
• • IP address, session data, error logs
• • Aggregated usage statistics, performance metrics

Security and Compliance Data

• • Login attempts, account access history
• • Failed authentication attempts, suspicious activities
• • Account changes, privacy setting modifications
• • Consent records, data processing activities

Antivirus Scanning Data

Device Tracking Data

• • Browser type, OS, screen resolution, timezone
• • Used for fraud detection and abuse prevention
• • Tracked per device/IP to prevent abuse and enforce limits on how many accounts can be created from the same device or location within a rolling time window
• • Registered devices (max 3 per account)
• • Hardware concurrency, language, platform info

• • Create and manage your account
• • Provide core platform features
• • Process and store your uploaded documents
• • Generate study materials and track progress
• • Provide customer support
• • Process payments and manage subscriptions

File Processing

• • Extract text content for AI analysis and quiz generation
• • Convert DOCX files to PDF format for security
• • Detect and count pages for optimization and UI
• • Identify tables, forms, and structured data
• • Generate thumbnails and previews
• • Scan for malware
• • Chunk large files to avoid memory issues

• • Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• • Access Controls: Role-based access, multi-factor authentication
• • Network Security: Firewalls, intrusion detection
• • Secure Development: Security testing and code reviews

• • Staff Training: Regular privacy and security training
• • Data Minimization: Collect only necessary data
• • Access Logging: All data access is logged and monitored
• • Incident Response: Procedures for data breaches and security incidents

What is a Personal Data Breach

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Notification to the Supervisory Authority (GDPR Art. 33)

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its possible adverse effects, and the contact details of our Data Protection Officer.

Where notification is not made within 72 hours, it will be accompanied by an explanation of the reasons for the delay and may be provided in phases.

Communication to Data Subjects (GDPR Art. 34)

When a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, AiLearn360 will communicate the breach to the affected data subjects without undue delay. The communication will describe the nature of the breach and contain the information required by GDPR Art. 33(3).

Communication to data subjects is not required if: (a) appropriate technical and organisational protection measures were applied to the affected data (e.g., encryption); (b) subsequent measures have been taken that eliminate the high risk; or (c) it would involve disproportionate effort, in which case a public communication or equivalent measure will be used.

Our Internal Breach Response Process

1. 1.Detection and containment (target: within 4 hours of detection)
2. 2.Risk assessment and classification (target: within 24 hours)
3. 3.Notification to supervisory authority if required (target: within 72 hours)
4. 4.Communication to affected users if required (target: without undue delay)
5. 5.Post-incident review and remediation plan (target: within 30 days)

• • Active Accounts: Data retained while account is active
• • Inactive Accounts: Data deleted after 3 years of inactivity
• • Deleted Accounts: Data deleted within 90 days of account deletion
• • Backup Data: Removed from backups within 12 months

Security and Compliance Data

• • Access Logs: Retained for 90 days
• • Security Incidents: Retained for 2 years for compliance
• • Consent Records: Retained for 3 years after withdrawal
• • Audit Trails: Retained for required legal compliance periods

Right to Access

Right to Rectification

• • Correct inaccurate data
• • Complete incomplete data
• • Update your account information

Right to Erasure

• • Data is no longer necessary
• • You withdraw consent (for consent-based processing)
• • Data has been unlawfully processed
• • Deletion is required by law

Right to Data Portability

• • Export your data in a structured, machine-readable format
• • Transfer data to another provider
• • Use our data export tools in account settings

Right to Object

• • Processing based on legitimate interests
• • Direct marketing communications
• • Automated decision-making

Right to Restrict Processing

• • You dispute data accuracy
• • Processing is unlawful but you don't want deletion
• • We no longer need the data but you need it for legal claims

How to Exercise Your Rights

• • Contact: [email protected]
• • Response Time: We respond within 30 days (or 90 days for complex requests).

EU Data Residency

• • Primary Storage: European Union (Italy)
• • Backup Locations: EU member states only
• • Processing Location: EU unless explicitly disclosed

Third Party Transfers

• • Adequacy Decisions: Transfers to countries with adequate protection
• • Standard Clauses: EU-approved SCCs for other transfers
• • Binding Rules: Used by some multinational providers
• • Consent: We may rely on your consent if other safeguards are unavailable

US Transfers

• • Data Privacy Framework: If provider is certified
• • Standard Contractual Clauses: With additional safeguards
• • Encryption: All data encrypted in transit and at rest

• • Minimum Age: 18 years old
• • Age Verification: Users must confirm they are 18 or older at signup

• • Account Suspension: Accounts of underage users are suspended immediately
• • Data Deletion: All data deleted within 30 days
• • Parent Contact: We will attempt to contact parent/guardian if possible

Privacy Contact

• • Email: [email protected]
• • Response Time: 5 business days

Supervisory Authority

• • Lead Supervisory Authority: Garante per la protezione dei dati personali (Italy)
• • Website: https://www.gpdp.it
• • Email: [email protected]

You may also contact your local data protection authority.

Dispute Resolution

• • Internal Process: Contact our privacy team first
• • Mediation: Available through EU dispute resolution mechanisms
• • Legal Action: Your rights under applicable law are preserved

• • Fraud Detection: Risk scoring for suspicious activities
• • Performance Optimization: System resource allocation

• • We do not engage in automated profiling of individuals
• • We do not make automated decisions affecting your legal rights
• • We do not engage in discriminatory automated processing

Our assessment (documented at docs/DPIA-NOT-APPLICABLE.md) concludes that no DPIA is required. The reasons are:

• • No special categories of data under Art. 9 GDPR are processed.
• • No profiling or automated decision-making with legal or significant effects (Art. 22 GDPR).
• • No large-scale processing (AiLearn360 is a micro-enterprise under EU definition).
• • No vulnerable data subjects (the service is gated by an 18+ age check).
• • No high-risk AI system under EU AI Act Annex III is deployed (all 11 use cases are classified Limited Risk).

Policy Updates

• • Changes in our data processing practices
• • New legal requirements
• • Service improvements and new features
• • User feedback and best practices

Notification Process

• • Material Changes: 30 days advance notice via email
• • Minor Updates: Notice in your account dashboard
• • Immediate Changes: Possible for urgent legal or security reasons

Privacy Contact

• • Email: [email protected]
• • Response Time: 5 business days

Supervisory Authority

• • Lead Supervisory Authority: Garante per la protezione dei dati personali (Italy)
• • Website: https://www.gpdp.it
• • Email: [email protected]

You may also contact your local data protection authority.

Dispute Resolution

• • Internal Process: Contact our privacy team first
• • Mediation: Available through EU dispute resolution mechanisms
• • Legal Action: Your rights under applicable law are preserved