Privacy notice.

1. Who this notice covers

This notice covers Ekadem’s public website, personal and Plus accounts, individual Teacher accounts, school-managed accounts, support, billing and integrations. “Ekadem,” “we” and “us” mean the operator identified in our Legal Notice.

It should be read with the Student and Family Notice, Cookies Notice, AI Transparency Notice, and—where a school provides the account—the school’s own privacy notice.

2. Who decides how data is used

School-managed use

The school, district or educational authority normally decides why student and staff data is processed. It is the controller, educational agency or responsible public body. Ekadem is its processor, school official, contractor or service provider and acts on the school’s documented instructions. Ask the school first about an education record, grade or classroom decision.

Individual use

For personal accounts, individually purchased subscriptions, the public website, billing, account administration, security and direct support, Ekadem normally decides the purposes and is the controller or business. An individual teacher must not place student data into a personal workspace unless the teacher has the school’s authority and an appropriate school agreement is in place.

Limited independent processing

Even for a school account, Ekadem may act independently for narrow purposes required to protect the service, keep financial or compliance records, answer a valid legal demand, or establish and defend legal claims. We do not turn school records into data for unrelated product advertising or model training.

3. Information we handle

We do not require an exact birth date or an individual age-band record for normal school use. A school describes the age range it serves as part of its institution-level setup and agreement. Please do not upload Social Security numbers, government IDs, medical files, special-education records or other highly sensitive material unless the school has explicitly approved the use and the feature is configured for it.

4. Where information comes from

We receive information directly from users; from a school, teacher, administrator or parent who creates an invitation or imports a roster; from authentication, payment and integration providers; and automatically from the device and service when someone signs in or uses a feature. We may infer simple operational facts, such as the likely country from an IP address or whether an account has reached a plan limit. We do not buy student marketing lists.

5. Why we use it and the legal basis

Where EU, EEA, German, UK or Swiss law requires a basis, we use the following:

For school records, the school selects and documents its own basis—often public task, legal obligation, an education-law power, contract, or valid consent where it is genuinely optional. Ekadem does not assume that consent is the right basis for mandatory public education.

6. When a feature uses AI

AI features may generate learning material, explanations, flashcards, speech, transcripts, formative feedback, search results or scoring suggestions. We send only the input and context needed for the request to an approved inference route. Prompts may contain personal data if the user puts it there, so school users should avoid names and sensitive information unless necessary and authorized.

• School routes require no-training settings and the shortest contracted provider retention.
• Ekadem does not use school prompts or outputs to train a general-purpose model.
• Usage analytics record operational metadata, not general prompt/response text.
• AI output can be wrong, incomplete, biased or unsuitable for a learner and must be reviewed by a person.
• AI scoring is enabled by default for new school classes after the required compliance gate, but a school can switch it off.

The active provider and location are described in the Subprocessor Schedule. Candidate providers are not treated as approved merely because the code supports them.

7. Who receives information

We disclose information only as needed to:

• the school, teachers, students and administrators authorized for the relevant class or workspace;
• hosting, authentication, AI, email, payment, support and integration providers performing a defined service;
• a connected service, such as Google Classroom, when an authorized user enables it;
• professional advisers under confidentiality, a buyer in a properly controlled business transaction, or insurers where necessary; and
• courts, regulators or public authorities when we reasonably believe disclosure is legally required. Where lawful, we notify the school or person and challenge overbroad demands.

We do not sell school data or personal information. We do not share it for cross-context behavioral advertising, and there are no third-party ads inside school accounts. We do not allow subprocessors to use school data for their own independent marketing or model training.

8. Data locations and international transfers

The standard Ekadem service runs on Cloudflare infrastructure and may process data internationally. A school’s country or AI provider setting does not create a separate regional hosting boundary.

A school can request a separately configured deployment using Hetzner for the application and storage, Clerk for authentication, and TensorX for AI inference. The agreed EU hosting and backup locations and the actual provider chain are recorded in its Order Form, DPA and custom deployment subprocessor schedule. TensorX requests never fall back to OpenRouter or another AI provider; features the selected provider cannot support are unavailable.

Email from a custom deployment, such as invitations, reminders and announcements, is sent through Cloudflare Email Service. Cloudflare receives the recipient’s address and the message for delivery and may process them internationally; the deployment’s database and stored files stay on its own server.

Clerk remains a separate identity system with its own processing locations and transfer arrangements. Hosting the LMS in the EU does not by itself guarantee that every identity, support, email or operational record remains exclusively in the EU. Optional billing or integrations have their own disclosures and must be agreed before they are added to a custom school deployment.

When European or Swiss data goes to a country without an applicable adequacy finding, we use a lawful transfer mechanism such as the European Commission Standard Contractual Clauses, Swiss-recognized clauses and supplementary safeguards, as applicable. The school’s Order Form, DPA and provider schedule control any narrower commitment. Contact privacy@ekadem.com to discuss a custom deployment.

9. How long information stays

We keep information only for the service, school instruction, security, dispute or legal period that applies. Typical periods include: invitations for 30 days after expiry or revocation; deleted courses/classes/lessons for a 30-day recovery period; source uploads for up to 60 days after processing unless still part of user content; school work and scores through the school year plus up to 90 days; AI school-cache entries up to 10 days; security logs about 90 days online and up to 12 months in controlled archives; and backups up to 35 days. Billing and tax records follow statutory periods.

Not every cleanup is automatic yet. The binding school schedule and configured school policy apply, and deletion execution is verified and recorded. Read the fuller Retention and Deletion Schedule.

10. Children and students

A paid subscription purchaser must be an adult or otherwise have legal capacity. Direct personal accounts are not intended for children under 13. A minor above 13 may use a personal account only with the authorization required in their country and must not independently buy a subscription without legal capacity.

For a US school-managed child under 13, the school may authorize collection on the parent’s behalf only for the school-requested educational purpose, as COPPA permits. The operator remains responsible for its COPPA duties. The school receives direct notice and can inspect, correct, export, stop collection and request deletion. For Europe and Switzerland, the school identifies the appropriate education-law basis and supplies child-appropriate information. Read the Student and Family Notice.

11. Privacy rights and choices

Depending on where you live, you may ask for access, a copy, correction, deletion, restriction, portability, or information about recipients; object to processing based on legitimate interests; withdraw consent for future use; opt out of sale, sharing or targeted advertising; or appeal a denied request. Ekadem does not currently sell data or run targeted advertising, so there is nothing to opt out of on those points.

For a school record, contact the school first. We support the school’s response and do not change a grade or education record without its direction. For Ekadem-controlled data, download a copy instantly from Privacy requests, or email privacy@ekadem.com from the address on your account for any other request. We verify the requester, do not discriminate for using a right, and normally respond within 30 days; another statutory period or a lawful extension may apply. Authorized agents must provide authority and may still require identity verification.

You may complain to your local data-protection authority. EU/EEA users may contact the authority where they live or work; Swiss users may contact the FDPIC. California and other US residents may also contact their state Attorney General where applicable.

12. Security and incidents

Safeguards include encryption in transit and at rest, tenant and role separation, least-privilege access, protected secrets, audit trails, dependency and vulnerability management, backups, incident response and vendor review. These measures reduce risk but cannot make any internet service risk-free. Security issues belong at security@ekadem.com. If an incident creates a legal notice duty, we notify the responsible school or affected people as required and provide information in phases as the investigation develops.

13. Automated decisions and profiling

Ekadem does not authorize solely automated decisions that determine admission, final grades, discipline, special-education eligibility, placement or access to an educational opportunity. For new school classes, AI scoring is enabled by default after the required compliance gate, but it is support rather than a decision and requires meaningful teacher review. A person must be able to disregard the suggestion, correct the record and consider a challenge. The indicator may be inaccurate, incomplete, biased or misleading, creating a risk of unfair conclusions if it is treated as a grade or used without considering the underlying work.

Where a class has AI scoring enabled, turned-in work is evaluated automatically to produce a progress indicator — a percentage and colour that tell the teacher, at a glance, how a student is getting on. Because this is an automated evaluation of a person’s performance, data protection law calls it profiling, and we describe it here even though it is not a decision about the student. Specifically:

• It is not a grade, and it does not become one. Only the teacher can grade.
• It is shown to the teachers of that class and to school staff with teacher access to it. It is not shown to the student it describes, and not to their classmates.
• It is not written into a report, transcript or school record, and teachers cannot export it.
• It is not used to group, rank, level, advance or flag students, and it is not sent to parents.
• Coaching written for the student — such as writing feedback — is separate, is clearly identified as AI-generated, and is shown to that student only.

A school can switch AI scoring off for a class or for the whole school, and can ask us how any indicator was produced. Students and parents may ask their teacher or school to review, explain or disregard one.

14. Changes, contacts and language

We date material changes and give notice where law or a school agreement requires it. A new purpose for previously collected school data requires a valid school instruction and any additional notice or authorization. Archived versions are available on request.

Privacy: privacy@ekadem.com
Security: security@ekadem.com
General support: hello@ekadem.com

The legal operator and postal address appear in the Legal Notice. Translations may be supplied for convenience; mandatory local-language terms and the signed school documents control where applicable.