Legal
How AI Challenge Portal collects, uses, protects, and retains information about students, educators, and administrators.
Version 1.0 - Effective 2026-08-31
This document is a structured placeholder. It reflects the platform's designed privacy posture but has not yet been reviewed by counsel. It must be reviewed and finalized before public launch.
Scope
This policy applies to everyone who uses AI Challenge Portal: students and independent learners in the student portal, and teachers, institution administrators, and platform administrators in the admin portal. Accounts are created by invitation; when an institution enrolls its students, the institution is the data controller and the platform processes data on its behalf under the institutional agreement.
Data we collect
Email address, display name, role, locale, and optionally date of birth. Used to operate your account, route you to the right portal, and communicate with you. Email addresses are treated as personal information and encrypted at rest.
Challenge conversation logs, evaluation scores, feedback, and skill progress. These are student educational records: they exist so students and their educators can see the reasoning work, and they are protected as described below.
Sign-in events, access logs, and AI usage/token logs. Used for security auditing and billing. Access to student records is itself logged with timestamp and accessor identity.
When you accept this Privacy Policy and the Terms of Use, we record which document version you accepted and when, as evidence of agreement.
Student data
FERPA (US). Student educational records are owned by the enrolling institution. They are accessible only to the student, the student's teachers, and institution administrators. They are not shared with third parties without written consent. When operating under an institutional contract, the platform acts as a "school official" and the institution's FERPA policy governs. Students 18 or older, or parents of younger students, may request access to or deletion of their records.
GDPR (EU). The platform acts as a data processor under Article 28; institutions are the data controllers. A Data Processing Agreement is provided for EU institutional contracts. The legal basis for processing is performance of contract, with legitimate interest for aggregate analytics. You may request erasure (conversation logs deleted, scores anonymized, billing logs retained for audit) and export of your conversation logs and scores.
COPPA (US, under 13). The platform does not knowingly collect data from children under 13 without verifiable parental consent. Institutions confirm in their subscription agreement that student users are 13 or older or that parental consent has been obtained through the institution's own processes. If a user is later identified as under 13 without consent, the account is suspended, its data deleted, and the institution notified.
AI
Conversation logs and evaluation data from student sessions are not used to train or fine-tune AI models. AI calls are made with data privacy settings that prevent inputs and outputs from being used for model training.
Retention
Conversation logs are retained for 2 years from the session date by default (institutions may configure 1 to 5 years). Evaluation scores persist as part of the skill profile unless the institution requests deletion. Token usage logs are kept 3 years for billing audit. Accounts persist until deletion is requested. Deletion is soft for 30 days to allow recovery, then permanent.
Your rights
You may request access to, correction of, or deletion of your personal information. Students in institutional programs should direct requests to their institution, which controls the records; independent learners may contact the platform directly. Contact: [contact email to be inserted at legal review].
Material changes to this policy will be versioned; you will be asked to review and accept the new version at your next sign-in.
