Privacy Policy

3) Data We Collect

• Account Data: name (optional), username, email, password (hashed), role (e.g., student/teacher/parent).
• Learning Data: questions served, answers provided, correctness, timings, scores, difficulty/level estimations, feedback, saved notes.
• Usage & Device Data: IP address, browser/OS, device identifiers, pages viewed, referral URLs, cookies, session IDs.
• Communication Data: messages sent to support, email preferences, notifications.
• Payment Data (if applicable): transaction references from payment processors (we do not store full card numbers on our servers).
• Aggregated/Anonymised Data: statistics that do not identify an individual.

4) How We Use Your Data

1. Provide and maintain the Service (accounts, sessions, AI-generated questions, grading, progress tracking).
2. Improve accuracy and coverage of questions/answers, troubleshoot issues, and enhance performance.
3. Send service messages (security, updates); send optional product emails where permitted.
4. Generate aggregated analytics for research and product development (with de-identification where possible).
5. Comply with legal obligations and enforce our Terms.

5) Legal Bases (UK/EU GDPR)

• Contract — to provide the Service you requested.
• Legitimate Interests — service improvement, security, fraud prevention, analytics proportionate to users’ expectations.
• Consent — optional cookies/marketing emails (where required). You can withdraw consent at any time.
• Legal Obligation — compliance with applicable laws or lawful requests.

6) About AI-Generated Content & Auto-Grading

• Questions, answers, and explanations may be AI-generated and can contain errors or omissions.
• Auto-grading and ability/difficulty estimations are indicative only and must not be treated as official assessment.
• Teachers/parents should review results for high-stakes use. See Terms for full disclaimer.

7) Cookies & Similar Technologies

We use necessary cookies for authentication and core functionality. With consent (where required), we may use analytics cookies to understand usage and improve the Service. You can manage cookies in your browser; disabling certain cookies may affect features.

8) Third-Party Processors

We may use reputable vendors for:

• Hosting/Infrastructure (e.g., cloud hosting, CDNs, backups).
• Email Delivery (e.g., transactional email providers).
• Analytics (e.g., web analytics for aggregated usage stats).
• Payments (if applicable, handled by PCI-compliant processors).

These providers process data on our behalf under contracts requiring confidentiality and security. They may have their own privacy policies; please review them where applicable.

9) When We Share Your Data

• With processors listed above to operate the Service.
• With authorities where legally required, or to protect our rights, users, or the public.
• In corporate transactions (merger, acquisition); the successor will assume the same privacy commitments.
• We do not sell your personal data.

10) Data Retention

We keep personal data only for as long as necessary to provide the Service and meet legal obligations. Upon account deletion, we will delete or anonymise personal data within a reasonable period (backups may persist for a limited time).

11) Security

• Transport encryption (TLS), hashed passwords, access controls, and least-privilege practices.
• No system is 100% secure. If you suspect a breach, contact security@ameba.ac immediately.

12) International Data Transfers

Data may be processed outside your country. Where required, we rely on appropriate safeguards (e.g., UK/EU Standard Contractual Clauses).

13) Children & Students

• Where students under the age of consent use the Service, a parent/guardian or school is expected to provide consent and supervision.
• We minimise collection from children and delete data that was collected without appropriate consent when notified.

14) Your Rights

Subject to law, you may:

• Access a copy of your personal data.
• Rectify inaccurate or incomplete data.
• Delete your account/data (with legal/operational limits).
• Restrict or object to certain processing.
• Port data to another provider (where technically feasible).
• Withdraw consent for optional processing at any time.

To exercise rights, email privacy@ameba.ac. We may verify your identity before responding.

15) Schools & Educators

If a school deploys the Service, it is responsible for obtaining appropriate consents and providing notices to students/parents as required by local law. We act as a processor for school-controlled data and will process it per the school’s instructions and our agreement.

16) Changes to This Policy

We may update this Policy from time to time. Material changes will be highlighted on the Platform and, where appropriate, notified to users. Continued use after posting constitutes acceptance.