Privacy Policy

1. Data Controller

The data controller for information processed through Asgard Learn is Asgard World Ltd, a company registered in England and Wales. If you have questions about how your data is handled, contact us at legal@asgard.world.

2. Information We Collect

We collect the following categories of personal data when you use the Platform:

Account information: name, email address, age group, curriculum selection, and account preferences (such as teaching persona and voice settings).

Learning data: subjects studied, lesson progress, quiz scores, Aureus points earned, time spent on activities, and performance metrics.

Session transcripts: text and voice interaction records with AI tutors, including questions asked and responses provided.

Technical data: IP address, browser type, device information, operating system, and access timestamps.

Payment data: billing information is processed by our payment provider (Stripe) and we do not store full payment card details on our servers.

3. How We Use Your Data

We use the information we collect for the following purposes:

Providing the service: delivering personalised AI tutoring, tracking learning progress, maintaining your account, and processing subscriptions.

Personalisation: adapting lesson difficulty, suggesting topics, and tailoring the AI tutor's approach based on your learning history and preferences.

Analytics and improvement: understanding how users interact with the Platform, identifying areas for improvement, and developing new features.

Communication: sending service-related notices, responding to support requests, and (with your consent) sending educational tips or product updates.

Safety and compliance: detecting and preventing fraud, abuse, or violations of our Terms, and complying with legal obligations.

4. Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we process your personal data on the following legal bases:

Contract: processing necessary to perform our contract with you (providing the tutoring service you have signed up for).

Consent: where you have given explicit consent, such as for marketing communications or, in the case of children under 13, parental consent for account creation and data processing.

Legitimate interest: processing necessary for our legitimate interests (such as improving the Platform, analytics, and fraud prevention) where those interests are not overridden by your rights.

Legal obligation: where we are required to process data to comply with applicable law.

5. Children's Privacy

We take the privacy of children seriously. Asgard Learn is designed for users aged 7 and above, and we have implemented specific safeguards for younger users.

For users under the age of 13, we require verified parental or guardian consent before creating an account and processing any personal data. Parents or guardians may review, modify, or request deletion of their child's data at any time by contacting us.

We comply with the Children's Online Privacy Protection Act (COPPA) and the UK Age Appropriate Design Code (Children's Code). We collect only the minimum data necessary to provide the educational service, we do not serve behavioural advertising to children, and we apply privacy settings at the highest level by default for users identified as under 18.

AI interactions involving users under 13 are subject to additional content filtering and safety measures. Session transcripts for child accounts are retained for a shorter period and are not used for general model training.

6. UK GDPR Compliance

We are committed to compliance with the UK GDPR and the Data Protection Act 2018. We maintain appropriate technical and organisational measures to protect personal data, conduct data protection impact assessments where required, and maintain records of processing activities.

We have appointed a data protection point of contact who can be reached at legal@asgard.world.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Active account data is kept for the duration of your account. When you delete your account, your personal data is deleted within 30 days, except where we are required by law to retain certain records. Learning data and session transcripts are retained for up to 24 months after your last activity to allow you to resume where you left off, but are removed within 30 days of account deletion.

For child accounts (under 13), session transcripts are retained for no more than 12 months. Aggregated, anonymised data that cannot be used to identify you may be retained indefinitely for research and improvement purposes.

Payment records are retained for 7 years in accordance with accounting and tax obligations.

8. Third-Party Services

We use the following third-party services to operate the Platform. Each processes data in accordance with their own privacy policies and our data processing agreements:

Supabase: database hosting and authentication services. Data is stored on servers within the European Economic Area.

Anthropic: provides the AI models powering our tutoring interactions. Conversation data is sent to Anthropic for processing and is subject to their data use policies. We have a data processing agreement in place that restricts the use of student data.

Stripe: payment processing. Stripe handles all payment card data and is PCI DSS compliant. We do not store your full card number.

Vercel: hosting and content delivery. Technical data such as IP addresses may be processed by Vercel's infrastructure.

Google Cloud: provides text-to-speech services for voice-based tutoring. Audio requests are processed through Google Cloud APIs.

Sentry: error tracking and performance monitoring. Technical error data (not personal learning content) may be sent to Sentry to help us identify and fix issues.

Resend: email delivery service used to send transactional emails such as verification messages, password resets, and account notifications.

9. Cookies

We use cookies and similar technologies to operate the Platform. For full details on what cookies we use and how to manage them, please see our Cookie Policy.

10. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

Right of access: you may request a copy of the personal data we hold about you.

Right to rectification: you may request that we correct inaccurate or incomplete data.

Right to erasure: you may request that we delete your personal data, subject to legal retention requirements.

Right to restrict processing: you may request that we limit how we use your data in certain circumstances.

Right to data portability: you may request a copy of your data in a structured, commonly used, machine-readable format.

Right to object: you may object to processing based on legitimate interests or for direct marketing purposes.

Right to withdraw consent: where processing is based on consent, you may withdraw that consent at any time.

To exercise any of these rights, contact us at legal@asgard.world. We will respond within one month. If you are dissatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

11. International Transfers

Some of our third-party service providers may process data outside the United Kingdom. Where data is transferred internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO, or transfers to countries that have been deemed to provide an adequate level of data protection.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice on the Platform. The “Last updated” date at the top indicates when the policy was last revised.

13. Contact

For any questions about this Privacy Policy or your personal data, contact us at:

Asgard World Ltd
Email: legal@asgard.world
Website: asgardlearn.ai