Legal
Privacy Policy
Last updated: 15 April 2026
1.Data Controller
The data controller for LearnX-AI is:
| Company | NordX Labs Oy |
| Business ID (Y-tunnus) | 3615236-4 |
| hello@animlearn.com |
2.What Data We Collect
| Account | Full name, email address, preferred language, account creation date |
| Google Sign-In (optional) | Google user ID, profile picture URL, name and email from Google OAuth |
| Learning activity | Video watch percentage, concept mastery scores, practice attempts and answers, AI feedback on submissions, time taken on exercises |
| Chat history | Problem-solving conversations with the AI tutor |
| Security logs | IP address, browser user-agent — recorded on sign-in/sign-up for fraud prevention. Retained for 90 days, then deleted automatically. |
3.Legal Basis for Processing
Processing of personal data in LearnX-AI is based on public interest and the exercise of official authority (GDPR Article 6(1)(e)), in connection with the school's educational activities.
Security logging (IP address, user-agent) is based on our legitimate interest (Article 6(1)(f)) in preventing unauthorised access and fraud.
4.Profiling and Automated Processing
LearnX-AI automatically analyses your learning activity to personalise the educational experience. This includes:
- Calculating a mastery score (0–1) per concept based on your quiz answers and practice attempts
- Tracking a learning trend (improving / stable / declining) per concept
- Monitoring video watch completion to identify gaps in learning
- Generating personalised practice questions based on your performance
This constitutes profiling under GDPR Article 4(4). The profiling is carried out in the public interest as part of educational activities. It does not produce legal effects or significantly affect you.
5.Third-Party Processors
We share data with the following third-party service providers acting as data processors:
| Google LLC | Google OAuth authentication. Data transferred: name, email, Google user ID. Governed by Google's Data Processing Terms. |
| Anthropic / Claude (via Google Cloud Vertex AI, EU) | AI content generation. Hosted on Google Cloud within the EU. No student personal identifiers are sent to the model. |
| Microsoft Azure (EU) | AI embeddings for syllabus search (Azure OpenAI). Document text processed in EU region. |
| Cloudflare R2 (EU) | Storage of generated video files and SVG assets. |
| Supabase / PostgreSQL | Database hosting for all user and learning data. |
We do not sell personal data to any third party.
6.Data Retention
| Account data | Retained while your account is active. Deleted on account deletion request. |
| Learning activity | Retained while your account is active. Deleted on account deletion. |
| Security logs (IP, user-agent) | Automatically deleted after 90 days. |
| AI-generated videos | Retained while linked to your account. Deleted on account deletion. |
7.Your Rights
Under GDPR, you have the following rights:
- Right of access — request a copy of your personal data
- Right to rectification — correct inaccurate data via Settings
- Right to erasure — delete your account and all associated data via Settings → Delete Account
- Right to restriction — request that we limit processing of your data
- Right to object — object to processing based on public interest
- Right to data portability — request your data in a machine-readable format
To exercise any of these rights, contact us at hello@animlearn.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
8.Data Security
- Passwords are hashed using bcrypt (never stored in plaintext)
- All data in transit is encrypted with TLS/HTTPS
- Authentication tokens are stored locally in the browser and not sent to third parties
- Access to production databases is restricted to authorised personnel
9.Cookies and Local Storage
LearnX-AI does not use tracking cookies. Authentication tokens are stored in your browser's localStorage and are used only to keep you logged in. No third-party analytics or advertising cookies are used.
10.Children's Data
LearnX-AI is designed for use in schools, including by minors. Student accounts are created and managed within the school context. Teachers and school administrators are responsible for ensuring that student accounts comply with applicable laws on processing children's data.
We do not knowingly collect data from children outside of a supervised educational context.
11.Changes to This Policy
We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated via the application or by email.
12.Contact
| Company | NordX Labs Oy |
| hello@animlearn.com |