Privacy notice

1. Who is responsible

The controller responsible for the processing described here, within the meaning of Art. 4(7) GDPR, is:

2. Two different roles

Lanas AI is used along two routes, and our data protection role differs between them. Which one applies to you decides who you address your rights to.

• Teachers and other users who register themselves: we are the controller. We decide the purposes and means of processing, and this notice describes that processing in full.
• Schools that use Lanas AI under a contract for their pupils: the school is the controller for its pupils' data and we act only as a processor under Art. 28 GDPR, on the school's documented instructions and under a data processing agreement. In that case the school's own privacy notice governs, and pupils, parents and guardians should address their requests to the school.

3. What data we process

• Account data: your name, email address, role, the school you belong to, a salted hash of your password, and the time of your last sign-in. We never store passwords in readable form.
• Lesson and course data: the topics, materials, courses, tests and audio lessons you create, and the lesson codes used to open a session.
• Learner input: the name a learner types when joining a lesson, their chat messages, written answers, uploaded content, exercise attempts and results. Learners can join with a lesson code and a name of their choosing; that name is shown to the teacher and does not have to be a real one.
• Voice input: if a learner uses the speech function, the recording is transcribed on our own server by local speech recognition software and the audio file is deleted afterwards. Voice recordings are not sent to any third party.
• Support requests: the name, subject and message text of a support ticket, plus the account or lesson code it was raised from.
• Technical usage figures: how many AI requests an account causes and how large they are, so that usage can be attributed and costs can be billed.
• Reach measurement: the pages viewed per day and a daily visitor count. See section 6 for how this is kept from identifying anyone.

4. Legal bases

• Art. 6(1)(b) GDPR - performance of a contract: operating your account, running lessons, courses and tests, and handling support requests.
• Art. 6(1)(f) GDPR - legitimate interests: keeping the service secure and available, preventing misuse, and measuring reach in the aggregated, non-identifying form described in section 6.
• Art. 6(1)(a) GDPR - consent: where we ask for it separately, for instance before optional functions that go beyond running the lesson. Consent can be withdrawn at any time with effect for the future.
• Art. 6(1)(c) GDPR - legal obligation: retention duties under commercial and tax law.
• Where we act as a processor for a school, the legal basis for the underlying processing is determined by the school, usually by the applicable state school legislation.

5. AI processing and transfer outside the EU

Lanas AI generates lesson content, feedback and exercises with language models. Depending on the function, this runs on one of two paths, and which path is used decides whether data leaves our server.

• Self-hosted models on our own server: the text stays with us. Speech recognition and speech output always run this way.
• OpenAI: for some functions, the text of the request - which can include a lesson topic, a learner's question or a written answer - is transmitted to OpenAI, Ireland and the United States, and processed there. This is a transfer to a third country under Chapter V GDPR. It takes place under a data processing agreement including the EU Standard Contractual Clauses, and OpenAI does not use data sent through its API to train its models.

The transfer takes place under a data processing agreement concluded with OpenAI, which includes the European Commission's Standard Contractual Clauses as the safeguard required by Chapter V GDPR.

OpenAI stores the content of API requests for a limited period, currently up to 30 days, so that misuse can be detected, and deletes it afterwards unless a longer period is legally required.

Please do not enter more personal data into a lesson than the task needs. AI output can be wrong and should always be checked before it is used in teaching.

6. Cookies and reach measurement

We set one strictly necessary cookie, which keeps you signed in after you log in. Without it the service cannot work, so no consent is required for it under § 25(2) TDDDG. We use no advertising cookies, no tracking pixels and no third-party analytics service.

Reach is measured without cookies and without storing your IP address. A visitor is counted using a one-way hash of your IP address, your browser identifier, a secret held on our server and the current date. Because the date is part of it, the value changes every day and cannot be used to follow anyone over time or be turned back into an IP address. We only ever see totals per day and per page.

7. Who receives data

We do not sell personal data and do not pass it on for advertising. Data is disclosed only to service providers who process it for us on our instructions under Art. 28 GDPR, and to public authorities where we are legally required to do so.

• Our hosting provider, which operates the server the application and its database run on.
• Our email provider, which delivers transactional messages such as password reset emails.
• OpenAI, for the AI functions described in section 5.
• Within a school, teaching and administrative staff see the lesson data of the classes and sessions they are responsible for.

8. How long data is kept

• Account data: for as long as the account exists. After deletion it is removed, except where a retention duty requires otherwise.
• Lesson, course and test data: until the account or the school's contract ends, or until it is deleted in the application.
• Sign-in sessions and password reset tokens: until they expire, and they are deleted automatically afterwards. A password reset link is valid only for a short time.
• Voice recordings: deleted immediately after transcription. Generated audio files are removed automatically once the cache period ends.
• Reach measurement: only aggregated daily figures are kept, and they no longer relate to any identifiable person.
• Where commercial or tax law requires it, the data concerned is retained for the statutory period, normally six or ten years, and blocked from other use.

9. Your rights

You have the following rights in relation to your personal data. To exercise them, contact us at the address in section 1. If a school is the controller for the data in question, please contact the school.

• Access to the data we hold about you (Art. 15 GDPR).
• Correction of inaccurate data (Art. 16 GDPR).
• Erasure (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Portability of the data you provided, in a machine-readable format (Art. 20 GDPR).
• Objection, at any time and on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR).
• Withdrawal of a consent you gave, at any time and with effect for the future, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work or the alleged infringement (Art. 77 GDPR). The authority responsible for us is:

10. Children and use in schools

Lanas AI is a teaching tool and is used by children. It is designed so that a learner can take part in a lesson without an account and without giving their real name: a lesson code and a chosen display name are enough. We ask teachers not to have pupils enter more personal data than a lesson requires.

Where a school deploys Lanas AI for its pupils, the school is the controller and we act as its processor under a data processing agreement. Information for parents and guardians, and the legal basis for the processing, then come from the school.

11. Data security

We take appropriate technical and organisational measures under Art. 32 GDPR. Traffic is encrypted in transit with TLS, passwords are stored only as salted hashes, pages carrying account or school data are refused to anyone not signed in and entitled to see them, and access to the database is restricted to what operating the service requires.

12. Changes to this notice

We update this notice when the service or the legal position changes. The current version always applies and is available on this page.

Last updated: 2026-08-23