Privacy Policy

For any privacy-related questions or requests, please contact us:

Email: hello@chalkie.ai

Address:

Chalkie AI Ltd.

71 - 75 Shelton Street

London

WC2H 9JQ

United Kingdom

We collect and process information necessary to provide, maintain, and improve Chalkie AI. This includes:

Information You Provide Directly:

Account Information: Your name, email address, password, and potentially your institution or role (if applicable) when you register an account. Why: To create and manage your account, provide access to the service, and communicate with you.

Payment Information: Billing details when you subscribe to paid services. Note: Payment processing is handled by our secure third-party partner Stripe. We do not directly store your full credit card or bank details. Why: To process payments for subscriptions.

User-Generated Content: The prompts you enter, text, lesson plans, presentation content, and other information you create or upload while using Chalkie AI (e.g., generating slides). Why: To provide the core functionality of the service (generating content based on your input).

Communications: Information you provide when you contact us for support or other inquiries. Why: To respond to your requests and provide assistance.

Marketing Preferences & Consent: Your preferences for receiving marketing communications and records of consent you have provided. Why: To send relevant updates and offers (where consented) and respect your choices.

Information Collected Automatically:

Usage Data: Information about how you interact with our website and service, such as features used, pages visited, clicks, time spent, and user journeys. This may involve tools like PostHog. Why: To understand user behaviour, improve the service, troubleshoot issues, and enhance user experience.

Device and Connection Information: IP addresses, browser type, operating system, and other technical details about your device and connection. Why: For security purposes, analytics, and optimizing service delivery.

Cookies and Similar Technologies: We use cookies and similar tracking technologies. For detailed information, please see our "Cookies" section below. Why: To enable website functionality, remember preferences, perform analytics, and potentially for marketing.

Live Activities let students join a teacher-led lesson using a code or link at https://chalkie.live. Students do not need a Chalkie account, email address, password, or school login, and we do not create a student profile across lessons.

When a teacher runs Live Activities with a class, the school, trust, district, or other organisation is the controller of student information in that lesson. Chalkie is the processor under the Data Processing Agreement at https://chalkie.ai/dpa. A teacher who turns answering on does so for that organisation, not as a personal account. If a parent or student asks about student data, they should ask the school first. Chalkie will help the school.

When answering is enabled, Chalkie stores that lesson's display name, participant ID, activity responses, scores, and timestamps on our servers so the teacher can run the activity and review results. The join screen gives each student a made-up display name. Students can change it and can type anything, including a real name. If they type a real name, we treat that display name as personal data. Please do not type real names, and do not share the lesson with anyone who should not see the class. We never use this information for advertising. Follow-along viewing does not require an answering profile. Those lesson records remain on our servers after the session ends. Ending the session does not delete them, and there is no automatic deletion period. The teacher can delete that session's results in the app, or the school can ask us to delete them at hello@chalkie.ai.

The browser keeps a reconnection token and participant details in local storage on that device for up to 12 hours, including after the tab is closed, so the same device can rejoin that lesson. We do not link participant identities across sessions. These records are pseudonymous, not necessarily anonymous: a teacher may know who used a nickname, and a nickname may be a real name.

Hosting and the real-time connection provider process the technical data needed to run the lesson, such as IP addresses, browser details, and session or connection identifiers. We also process temporary connection, tab-visibility, and slide-synchronization information to show the teacher classroom connection counts.

The teacher can see participants, responses, scores, and class results during the session and review saved results afterward. Ending a session or closing a browser does not delete those stored records. Nicknames are shared within the session, and nicknames and scores may be shown to other participants when the teacher enables the leaderboard.

Student data is not sold, used for advertising, or used to train AI models. Student answers are not sent to AI providers for assessment: scoring uses the activity answer key and fixed scoring rules. AI may help the teacher create the activity before students answer it.

No analytics, advertising, session-replay, or support-tracking scripts run on the chalkie.live student surface. Essential browser storage and real-time connections support participation. Separate server-side service events record teacher/session usage and operational counts without student names, answers, scores, or participant tokens.

For school-directed use, the school determines the educational purpose and applicable legal basis, provides required notices, and obtains any required authorization. Chalkie processes student participation data on the school’s behalf. For younger students, the school provides those notices and any required authorization, including school authorization where COPPA applies. Relying on school authorization does not remove Chalkie’s remaining operator obligations under COPPA or similar children’s privacy laws. Joining a lesson is not consent to advertising or AI training. Parents and eligible students should contact their school about access, correction, or deletion; schools can contact hello@chalkie.ai for assistance.

We rely on the following lawful bases under GDPR to process your personal data:

Contract: Processing necessary to perform our service contract with you (e.g., managing your account, generating content, processing payments).

Legitimate Interests: Processing necessary for our legitimate interests, provided these do not override your fundamental rights and freedoms (e.g., improving our service, security monitoring, analyzing usage trends, limited marketing communications about similar services).

Consent: Where required by law, or for certain marketing communications, we will rely on your explicit consent. You can withdraw consent at any time.

Legal Obligation: Processing necessary to comply with our legal obligations (e.g., financial record-keeping).

We process your data only when we have a valid legal basis, applying the appropriate basis depending on the specific processing activity.

Directly from you: When you sign up, use the service, make payments, or contact us.

Automatically: Through your use of our website and service (e.g., usage data, cookies).

Third Parties: Such as Google for authentication purposes if you choose to sign in via Google.

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Our retention periods are as follows:

You may request deletion of your data at any time, subject to legal or operational requirements. See "Your Data Protection Rights" below.

Account Information: While account is active + up to 7 years after closure. Reason: Service provision, legal and operational purposes.

Payment Records: Up to 7 years. Reason: Financial compliance, tax laws, and audit purposes.

Marketing Preferences: Until you opt-out or withdraw consent. Reason: Respecting user choices and service relevance.

User-Generated Content (Prompts, Slides, etc.): While account is active, or until deleted by user. Reason: Core service provision, user control.

Deleted User Content Backup: Up to 90 days after deletion request is processed. Reason: Data recovery, system integrity (then permanently deleted).

Website Analytics & Usage Data: Up to 26 months (often anonymized or aggregated sooner). Reason: Analytics, trend analysis, and service improvement.

Live Activities student data: Saved participation and results remain on our servers after a session ends. Ending a session does not delete them, and there is no automatic deletion period. The teacher can delete a session's results in the app. Schools can also ask us to return or delete them by emailing hello@chalkie.ai; we fulfil those requests manually. Where the National Data Privacy Agreement (NDPA) applies, we return or delete student data from production systems — including copies we can instruct service providers to delete — within 60 days of the school’s written request, and dispose of it on termination in accordance with that agreement and applicable law. Database backups remain recoverable for about 90 days (7 daily, 4 weekly, and 3 monthly copies), plus DigitalOcean managed backups and 7-day point-in-time recovery. Deleted student records can remain in those backups until they expire. If a backup is restored, we re-apply any later deletion so restored data does not revive deleted student records.

The following table provides detailed information about the third-party sub-processors we use to deliver Chalkie AI:

Google Vertex AI (Global endpoint): Prompts, lesson content (no personal identifiers). Primary AI content generation (Gemini models), diagram generation, and text-to-speech. Lawful basis: Contract.

OpenAI (United States): Prompts, lesson content (no personal identifiers). Content moderation, audio transcription, and diagram image generation (accessed via Runware). Contract.

Runware (US / Germany / Romania): AI image-generation prompts (no personal identifiers). Diagram image generation. Contract.

OpenRouter (United States): Prompts, lesson content (not stored, no personal identifiers). Contingency fallback used only if our primary AI provider is unavailable. Contract.

DigitalOcean (Netherlands, EU, for the live database; encrypted database backups in London, United Kingdom, covered by the European Commission's adequacy decision for the United Kingdom): Account data, user content, logs, user-generated files (via Spaces), and Live Activities lesson participation and results. Cloud hosting, data storage, file storage. Contract.

SnapShooter (Ireland, EU; part of DigitalOcean): Orchestrates encrypted database backups from our own server. It keeps a root SSH key for the backup worker, and that SSH trust stays in place between backups. The dump includes teacher account data and Live Activities participation and results. Backup contents are not sent through SnapShooter, and it does not hold the encryption key. DigitalOcean stores the encrypted backup in London. Contract.

Vercel (United States): Website traffic in transit (no personal data stored server-side). Frontend hosting and content delivery. Contract.

Stripe (United States): Billing name, email, payment details (tokenised). Payment processing. Contract.

Google (United States): Email, name, profile picture; exported content. Authentication, Google Slides/Docs export. Contract / Consent.

PostHog (EU): Usage data, page views, device and browser information, and pseudonymous user IDs with account attributes such as country, language, locale, access tier, and subscription metadata (no name or email; IP-based geolocation disabled). Product analytics and service improvement. Legitimate Interests / Consent.

Intercom (United States): Device and browser information, IP address, language preference, and any contact details or message content you choose to submit via support chat. Customer support and messaging. Legitimate Interests / Consent.

Brevo (France, EU): Email, name, country, usage events. Transactional and product email delivery (marketing email is opt-in with one-click unsubscribe). Contract / Consent.

SendGrid (United States): Name, email address, and message content submitted through the website contact form. Delivery of contact-form emails to Chalkie. Legitimate Interests.

Attio (United Kingdom): Name, email address, job role, school name and location, the content of enquiry and contact-request messages, licence numbers, and (for school and organisation accounts) trial usage metrics and quote details. Customer relationship management for school enquiries, pilots and quotes. Contract / Legitimate Interests.

Zapier (United States): Pseudonymous user ID and subscription-cancellation details (no name or email). Internal workflow automation. Legitimate Interests.

Sentry (EU): Pseudonymous user ID, browser/OS info, error stack traces (no name or email). Error tracking and performance monitoring. Legitimate Interests.

Cloudflare (Global): IP addresses, request headers, and, for Live Activities, the participant token, display name, registration key, and answer while the request is proxied to the API. CDN, DDoS protection, DNS proxy. Legitimate Interests.

Pusher (United States supplier; EU cluster for production real-time traffic): User, session, participant, and connection identifiers; technical connection data; real-time lesson content and room events; participant display names; and scores when the teacher enables the leaderboard. Real-time delivery for Live Activities and other service features. Contract. Transfers are covered by Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA). The EU cluster is the processing region, not a finding of no transfer.

Ably (United Kingdom; processed on Amazon Web Services in several regions): User ID, IP address, browser information, and AI chat replies while they are delivered, including edits to your resources and any personal information you include in the chat. Real-time delivery of AI chat replies. Contract.

Meta Conversions API (United States): SHA-256-hashed email, hashed user ID, connection metadata (IP address and browser user agent), and conversion events (sign-up and subscription only), sent server-side. Ad conversion measurement. Consent / Legitimate Interests.

Google Ads (United States): SHA-256-hashed email, ad-click identifiers, and conversion events (sign-up and subscription only), sent server-side. Ad conversion measurement. Consent / Legitimate Interests.

Microsoft Advertising (United States): SHA-256-hashed email, ad-click identifiers, and conversion events (sign-up and subscription only), sent server-side. Ad conversion measurement. Consent / Legitimate Interests.

OpenAI Ads (United States): SHA-256-hashed email, hashed user ID, OpenAI ad-click references, connection metadata (IP address and browser user agent), and conversion events (sign-up and subscription only), sent server-side. Ad conversion measurement. Consent / Legitimate Interests.

A note on advertising: no advertising or ad-network scripts run inside the Chalkie product. Ad conversion measurement is server-side only, limited to sign-up and subscription events, and uses a hashed email rather than your email address. In the UK, EEA and Switzerland it is enabled by default, and you can opt out at any time. In some US states you can also opt out at any time. Users belonging to school or organisation accounts are excluded from ad conversion reporting.

Safeguards for International Transfers: Where sub-processors are located outside the UK/EEA (e.g., United States), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office and/or the European Commission.

We do not sell your personal data. We only share information with trusted third-party partners who help us operate and provide Chalkie AI, under strict confidentiality and data processing agreements:

Google Vertex AI: We send the prompts and content you provide to Google's Vertex AI API to generate lessons, worksheets, and other outputs as requested by you. No personal identifiers (like your name or email) are sent with this content, and under the API terms this data is not used to train models.

OpenAI: We use OpenAI's API to screen the content you submit (content moderation), for audio transcription, and to generate diagram images. No personal identifiers are sent with this content. Please review OpenAI's policies for how they handle data received via their API: https://openai.com/policies/usage-policies/

DigitalOcean: Hosts our application servers, website, and stores service data securely.

Google: Manages authentication if you sign in with Google. Used for exporting content to Google Slides if you use that feature. We comply with the Google API Services User Data Policy, including the Limited Use requirements.

PostHog: Provides product analytics and service usage insights. This uses a pseudonymous user ID and account attributes such as country, language, locale, access tier, and subscription metadata — your name and email are not sent to PostHog.

Intercom: Provides customer support and messaging tools. If you contact us via Intercom, it may process device and browser information, your contact details, and the contents of your message.

Stripe: Handles payment processing securely. We do not store your full card details.

We may also share data if required by law, to protect rights and safety, or in connection with a business transfer (e.g., merger or acquisition), ensuring appropriate safeguards are in place.

Our primary servers, hosted by DigitalOcean, are located in Amsterdam, Netherlands 🇳🇱. Encrypted database backups of that data are stored in London, United Kingdom, covered by the European Commission's adequacy decision for the United Kingdom. Data storage and processing comply with GDPR standards.

If we transfer personal data outside the UK, EEA, or Australia (e.g., through our use of third-party services based in the US, such as our payment processor or AI providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the relevant authorities or verifying the recipient's participation in a recognized adequacy framework, to protect your data in accordance with UK GDPR, EU GDPR, and the Australian Privacy Principles (APPs).

Notification of Infrastructure Changes: If we make material changes to where your data is hosted or processed—such as relocating to a different country or changing our primary AI service providers—we will email you when we make the change. This includes changes to our primary hosting location or the addition of new sub-processors in different jurisdictions.

We use cookies (small text files placed on your device) and similar technologies (like web beacons or pixels) to operate our website, remember your preferences, analyze performance, and potentially for marketing purposes. These may include:

Essential Cookies: Necessary for the website and service to function (e.g., login sessions).

Analytics Cookies: Help us understand how users interact with our service (e.g., PostHog; Google Analytics is used on our public marketing website only, not inside the Chalkie product).

Support Cookies: Help us provide support and messaging functionality (e.g., Intercom).

Preference Cookies: Remember choices you make (e.g., language).

Marketing Cookies: Used on our public marketing website only (e.g., the Meta Pixel and the OpenAI Ads pixel for visitors). No advertising or ad-network scripts run inside the Chalkie product itself.

In the UK, EEA and Switzerland, analytics and marketing cookies are enabled by default. You can disable either category at any time via "Cookie settings" in the website footer, and we delete the related cookies. In some US states you can opt out of marketing cookies via "Your Privacy Choices" in the footer; we also honour the Global Privacy Control browser signal as an opt-out.

For the full list of cookies we use, their purposes and durations, see our Cookie Policy at https://chalkie.ai/cookies.

Providing Consent: You provide consent for AI processing of your content when you create an account and use Chalkie AI's generation features. This is clearly indicated during the signup process.

Withdrawing Consent: You may withdraw your consent for AI processing at any time by emailing hello@chalkie.ai with the subject line "Withdraw AI Consent". We will process your request within 5 business days.

Effect of Withdrawal: If you withdraw AI consent, you will no longer be able to use AI-powered features (lesson generation, worksheet creation, etc.). Your account and any previously generated content will remain accessible. You may reinstate AI consent at any time by contacting us.

If Chalkie AI is used by a U.S. school or district ("School"):

School Official Status: Where the FERPA school-official exception applies, Chalkie performs an educational service for the School under its direct control regarding the use and maintenance of education records, with a legitimate educational interest and restrictions on use and redisclosure (34 CFR §§ 99.31(a)(1) and 99.33).

Educational Purpose: We use student data only to provide the educational service for the School. Student data is not sold, used for advertising, or used to train AI models. Student answers in Live Activities are scored against activity answer keys, not assessed by AI.

Student Data: Students do not create Chalkie accounts or a profile across lessons. Live Activities store that lesson's display names, participant IDs, responses, scores, and timestamps on our servers so the teacher can review results. The join screen starts with a made-up display name. Students can change it and can type a real name. If they do, that name is personal information and may be an education record. Pseudonymous records may still be education records or personal information. Teachers should avoid placing real student names, student ID numbers, or sensitive education-record information in prompts, teaching materials, or display names. The School retains control of its student data.

Data Access, Return & Deletion: The teacher can delete a session's results in the app. Schools may also contact hello@chalkie.ai to access, correct, return, or delete their student data. We fulfil these requests manually and support the School in responding to parents and eligible students. Where the NDPA applies, we return or delete student data from production systems — including copies we can instruct service providers to delete — within 60 days of the School’s written request and dispose of it on termination under the agreement and applicable law, subject to any shorter applicable deadline. Database backups remain recoverable for about 90 days. Deleted student records can remain in those backups until they expire. If a backup is restored, we re-apply any later deletion.

Data Security: We implement administrative, physical, and technical safeguards to protect any data processed, consistent with industry standards.

Data Breach: In the event of a data breach potentially involving student data, we will notify the affected School(s) promptly.

For users in Australia, we are committed to complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs):

Collection: We only collect personal information reasonably necessary for our functions and activities.

Notification: As outlined in this policy, we inform you about the types of data collected, purposes, third-party sharing, and that data is primarily stored securely in Amsterdam, Netherlands.

Access and Correction: You have the right to request access to and correction of your personal information we hold (see "Your Data Protection Rights").

Data Security: We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorized access, modification, or disclosure.

Cross-border Disclosure: We take reasonable steps to ensure overseas recipients (like OpenAI or DigitalOcean) handle your data in accordance with the APPs, typically through contractual clauses.

Notifiable Data Breaches (NDB): We comply with the NDB scheme requirements in case of eligible data breaches.

Depending on your location and applicable law (particularly under GDPR and similar regulations), you have rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you. 📥

Right to Rectification: Ask us to correct inaccurate or incomplete information. ✏️

Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data under certain conditions (e.g., it's no longer needed for the purpose it was collected). 🗑️

Right to Restrict Processing: Ask us to limit how we process your data in specific circumstances. ⛔

Right to Object: Object to processing based on legitimate interests or for direct marketing. 🙅

Right to Data Portability: Request your data be transferred to you or another organization in a structured, commonly used, machine-readable format (where processing is based on consent or contract and automated). 🔄

Right to Withdraw Consent: If processing is based on consent, you can withdraw it at any time (this won't affect past processing). ❌

There is usually no fee to exercise these rights. We aim to respond to verifiable requests within one calendar month. 🕓

To make a request, please contact us using the details at the top of this policy. We may need to verify your identity before fulfilling your request. 📬

We hope to resolve any concerns you have directly. Please contact us first using the details provided above.

However, if you are unsatisfied with our response or believe we are not processing your data in accordance with the law, you have the right to lodge a complaint with your local data protection supervisory authority:

In the UK: Information Commissioner's Office (ICO). Website: https://www.ico.org.uk/make-a-complaint Helpline: 0303 123 1113 ☎️

In Australia: Office of the Australian Information Commissioner (OAIC). Website: https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us

In the EU: Contact the data protection authority in your member state.

In the U.S.: FERPA complaints are typically handled through the educational institution or the U.S. Department of Education's Student Privacy Policy Office (SPPO).

We may update this Privacy Policy and our Terms of Service from time to time. When we make a material change, we will notify you by email and an in-service notice. The notice states the date the change takes effect.

The Last Updated date on this page records when the text was last edited. It is not the change notice. When we update the Data Processing Agreement, materially change how we process school personal data, or add a new sub-processor, we email you when we make the change. Your continued use of Chalkie.ai after the effective date stated in that notice constitutes your acceptance of the revised terms.

🙏 Thank you for using Chalkie AI!