Schools: privacy and security
Summary
- No student accounts: students join with the class code and a pseudonym. No email, no password, no real name required.
- Roles: the school is the controller and Simulath is the processor (art. 28 GDPR). We sign a data processing agreement.
- No ads or analytics for students: student pages and class mode do not load Google Analytics or third-party cookies.
- Transparent AI: the Electra tutor always says it is an AI, does not grade, and the teacher decides.
- Security: HTTPS everywhere, HSTS, secure session cookies, restricted access.
Student data we process
Pseudonym, class, labs used, progress, activity dates and a technical session identifier. Messages to the AI tutor are sent to OpenAI to generate the answer. Ask students not to type their full name or personal data.
Sub-processors
DreamHost (hosting, US), OpenAI (AI tutor), Stripe (license payments, no student data), Vercel (Call Center AI, only if used), Google Fonts. Details in the privacy policy.
Data Processing Agreement (DPA)
Template in English (.docx), Spanish (.docx) and Polish (.docx). Send it signed to info@simulath.com.
Accessibility
See the accessibility statement (WCAG 2.1 AA, partially conformant).