Full Privacy
Policy

1. Introduction and Purpose

This Data Processing Addendum, Data Retention Policy, and User Rights Framework (collectively, this "Document") is issued by Secondary AI Inc. ("Secondary AI," "we," "our," or "us"). It governs the collection, use, processing, storage, disclosure, and deletion of personal information and data in connection with our AI-powered platform and services (the "Services").

Secondary AI is committed to the responsible development and deployment of artificial intelligence and to the protection of personal information. This Document is designed to comply with and give effect to applicable privacy and data protection laws across multiple jurisdictions, including Canada, the European Union, and the United States.

2. Scope and Applicability

This Document applies to all personal information and data processed by Secondary AI in connection with the Services, including:

• Teacher/Educator Data: Account information, institution affiliation, usage patterns, and authentication credentials.
• Student Data: Chat interactions, learning progress, assessment results, and optional identity information (where applicable).
• School/Institutional Data: Aggregated usage metrics, anonymized analytics, and organizational metadata.
• Technical Data: IP addresses, device identifiers, cookies, and log files necessary for service operation and security.

3. Legal Basis for Processing

Secondary AI processes personal information based on the following legal grounds:

• Consent: Explicit, informed consent from the data subject or their legal guardian (for minors).
• Contract Performance: Processing necessary to provide the Services under the terms of service.
• Legal Obligation: Compliance with applicable laws, regulations, and court orders.
• Legitimate Interest: Improvement of Services, fraud prevention, and security measures.
• Educational Purpose: Processing student data solely for pedagogical and learning outcome assessment.

4. Data Collection and Use

What We Collect:

• Teacher profiles, account credentials, institutional affiliation, and subject expertise metadata
• Student chat transcripts, learning outcome tracking, assessment data, and optional demographic information
• Session logs, timestamps, IP addresses, and device information
• Feedback, ratings, and user-generated configuration data

How We Use It:

• Deliver personalized AI-powered educational experiences
• Generate learning insights, progress tracking, and performance analytics
• Detect and prevent misuse, ensure platform security, and monitor for safety concerns
• Improve our algorithms, models, and service offerings through aggregated analytics
• Comply with legal and regulatory requirements, including COPPA, FERPA, PIPEDA, and GDPR

5. Data Retention and Deletion

Retention Periods:

• Active Account Data: Retained for the duration of the account and 30 days after closure for recovery purposes.
• Chat Session Transcripts: Retained for 12 months from the last interaction, then automatically deleted unless requested by the teacher for audit purposes.
• Learning Analytics & Insights: Aggregated, anonymized data retained for up to 24 months to support service improvement.
• Technical Logs: Server logs retained for 90 days for security and troubleshooting purposes, then deleted.
• Student Identifiable Data: Deleted upon explicit request or upon account closure, except where retention is legally required.

Right to Deletion (Right to be Forgotten):

Users may request the deletion of their personal data at any time by contacting us at thesecondaryai@gmail.com. We will process deletion requests within 30 days, except where retention is required by law or necessary for platform security.

6. Data Security and Protection

Secondary AI implements industry-leading security measures to protect personal data:

• Encryption: All data in transit uses TLS/SSL encryption. Data at rest is encrypted using AES-256 or equivalent.
• Access Controls: Role-based access restrictions limiting data access to authorized personnel only.
• Data Minimization: We collect only the minimum data necessary to provide the Services.
• Audit Logging: Comprehensive logs track all data access and modifications for accountability.
• Incident Response: Documented procedures for detecting, responding to, and notifying users of data breaches.
• Third-Party Security: All service providers are contractually obligated to maintain equivalent security standards.

7. User Rights and Requests

Under applicable privacy laws, users have the following rights:

• Right to Access: Obtain copies of personal data processed by Secondary AI.
• Right to Rectification: Correct inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of personal data (subject to legal retention obligations).
• Right to Data Portability: Receive personal data in a structured, machine-readable format and transmit it to another controller.
• Right to Object: Object to certain processing activities on grounds of legitimate interest.
• Right to Withdraw Consent: Withdraw previously given consent at any time (does not affect prior processing).

To exercise any of these rights, please submit a request to thesecondaryai@gmail.com with proof of identity. We will respond within 30 days.

8. Third-Party Data Sharing

No Sales of Personal Data: Secondary AI does not sell, rent, or otherwise disclose personal information for commercial purposes.

Service Providers: We share data with carefully selected third-party processors only when necessary to provide the Services, including:

• Google Gemini: Processes chat interactions and generates AI feedback under strict data agreements prohibiting model training on user data.
• Cloud Infrastructure Providers: Host and secure data with enterprise-grade encryption and compliance certifications.
• Analytics Tools: Aggregate usage patterns to improve service performance (with full anonymization).

All service provider agreements include Data Processing Addendums (DPAs) enforcing equivalent privacy protections.

9. Compliance with Regulatory Frameworks

10. Changes to This Document

Secondary AI may update this Data Processing Addendum, Data Retention Policy, and User Rights Framework to reflect changes in our Services, technology, or applicable laws. Material changes will be communicated via email to registered users with at least 30 days' notice. Continued use of the Services following notification constitutes acceptance of the updated terms.

11. Contact Information

For questions, requests, or concerns regarding this Document, please contact Secondary AI at: