Version 1.2, in effect from 4 November 2026
This is a draft awaiting legal review. It describes how Scholarix works today and may change before the public launch.
Who is responsible
Scholarix is responsible for the personal data used to run the service for individual teachers and their students. When a school uses Scholarix for its staff and students, the school decides how that data is used, and we process it on the school's behalf. You can reach us at info@scholarix.online.
What we collect
- Account details: your name, email address, account type (teacher or student) and password, which we store only as a secure hash. Optionally, a phone number and profile details such as school, subject and grade.
- Sign-in with Google or Microsoft: your name, email address and the provider's account ID, and from Google a link to your profile picture. We don't keep the provider's access tokens.
- Age information for students: birth month and year, and whether consent came from a school or a parent.
- What you add: documents, web and YouTube links, transcripts, lessons and other generated material, classroom posts, and your conversations with the assistant and tutors, including files you attach.
- Voice: when you talk to the assistant or a tutor, your speech is turned into text as you speak; we keep the text, not the recording. Audio or video you upload for transcription is deleted once it has been processed. A teacher who creates a voice profile uploads a voice sample with consent, and we keep it until the profile is deleted.
- Usage and security data: which features you use and how much, for plan limits; your sign-in sessions with a description of the browser; and records of the searches and AI tools used to answer your requests.
- Payments: Stripe handles card payments. We keep the customer and subscription references and each invoice's amount and status.
- Messages to us: what you write in the contact form or by email.
Why we use it
- To provide the service: your account, your library and generated material, classes, tutors and conversations.
- To keep the service secure: sign-in checks, the anti-bot check on forms, limits on repeated attempts, and looking into misuse.
- To send service emails: verification codes, password resets, invitations and warnings about plan limits. We don't send marketing email.
- To bill paid plans and keep the records that accounting law requires.
- To find and fix problems, using records of how requests ran.
- To protect children, by recording age and consent as our Children's Privacy Notice describes.
We don't sell personal data, we don't show advertising, and we don't use your content to train AI models.
How AI processes your data
When you ask for material or send a message, the text needed to answer is sent to our AI providers: your request, relevant passages from your library and earlier messages in the conversation. Web searches go to a search provider. These providers process the data for us under contract, and our sub-processor list names them.
Google Classroom and Google Drive
A teacher can connect their Google account to send material to Google Classroom. With the teacher's permission, Scholarix then reads the teacher's courses and topics, and the names and email addresses of the students in a course the teacher links to a Scholarix class. It creates copies of the teacher's material in a Scholarix folder of their Google Drive, posts them to the course as materials or assignments, keeps the assignments it posted in step when the teacher changes or deletes them in Scholarix, adds topics to the course when the teacher asks, and, when the teacher asks, invites students to the course. It can reach only the Drive files it created itself.
We store what these features need: the connection's access tokens, encrypted; the courses linked to classes; and, for a linked course, each student's Google account id and email address, so that the class and the course stay matched. We use this data only to provide these features to the teacher who connected. We don't use it for advertising, we don't sell it, we don't use it to train AI models, and people at Scholarix don't read it except for security, to comply with the law, or with the teacher's permission to help them.
Scholarix's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
A teacher can disconnect at any time in Settings, or in their Google account's security settings. Disconnecting revokes Scholarix's access and deletes the stored tokens; copies already posted stay in Google Classroom and Drive, under Google's terms.
Microsoft Teams
A teacher can connect their school's Microsoft account to use Microsoft Teams. In a school, this works only once the school's owner turns Teams on for the school's Microsoft directory and the school's IT administrator approves Scholarix's access. With the teacher's permission, Scholarix reads the teacher's Teams classes, and the names and sign-in names of the students in a class the teacher links to a Scholarix class. It posts copies of the teacher's material and assignments to those classes, and sends back the grades and feedback the teacher returns in Scholarix.
We store what these features need: the connection's tokens, encrypted; the account's Microsoft identifier and directory; the Teams classes linked to classes; and, for a linked class, each student's Microsoft account identifier and sign-in name, so that the two stay matched. We use this data only to provide these features to the teacher who connected, with the same limits as for Google: we don't use it for advertising, we don't sell it, we don't use it to train AI models, and people at Scholarix don't read it except for security, to comply with the law, or with the teacher's permission to help them.
A teacher can disconnect at any time in Settings; Scholarix then deletes the stored tokens. The school's administrator can also withdraw Scholarix's approval in Microsoft's admin centre. Copies already posted stay in Teams, under Microsoft's terms.
Safety checks
Messages that students send to the assistant and tutors, and the replies they receive, are checked automatically for harmful content. A flagged message is recorded with a short excerpt so that a teacher or school administrator can review it.
Where data is processed
Our providers run data centres in several countries, and some processing takes place in the United States, for example speech recognition and our search index. Where the law requires it, these transfers rely on safeguards such as standard contractual clauses.
How long we keep data
- Account and content: while your account is open. When an account is closed, we delete its personal data within 30 days, except what the law requires us to keep.
- Sign-in sessions: at most 90 days, and their records are removed 30 days after they end.
- Audio and video uploaded for transcription: deleted once processed.
- Invoices and payment records: as long as tax law requires.
- Server logs: a short time, after which they are overwritten.
- Backups: encrypted, and kept for at most 12 months.
Your rights
Depending on where you live, you can ask to see the personal data we hold about you, to correct it, to delete it or to receive a copy, and you can object to or restrict how we use it and withdraw consent. Write to info@scholarix.online from your account's email address; we answer within one month. If your school manages your account, we may pass your request to the school. You can also complain to your data protection authority.
Children
Students under 16 join through a school or teacher who holds consent, or with a parent's approval. Our Children's Privacy Notice explains what we collect from students and what parents can do.
Security
We encrypt data in transit, keep files in private storage reached only through short-lived links, store passwords and sign-in codes only as secure hashes, and limit who on our side can reach your data. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
Changes to this policy
We update this policy when our practices change. The version and date at the top show the current one, and we ask you to accept important changes.
Questions about this document? Write to info@scholarix.online.