How we handle your data.

We are committed to protecting your personal data and respecting your privacy. This Data Privacy Policy explains how we collect, use, disclose and safeguard your information when you visit our application ChatTutor.

We may collect and process the following types of personal data:

• ·Personal identification information — name and email address.
• ·Technical data — IP address, browser type, operating system.
• ·Usage data — information generated when you use the application: chat, interaction with learning material, uploaded files.

• ·To provide, operate and maintain our services.
• ·To improve, personalise and expand our services.
• ·To communicate with you, including customer service and support.
• ·To process transactions and send related information.
• ·To comply with legal obligations.

We do not sell, trade or otherwise transfer your personal data to outside parties except as described in this policy. We may share your information with third-party service providers (including the LLM used), and where required by law or to protect our rights.

We implement a variety of security measures to maintain the safety of your personal data. We monitor security issues for the packages we use, including through open-source intelligence tools.

Note that we use external service providers to generate the output or track performance of our platform — for instance, we allow users to use OpenAI’s ChatGPT to generate chat output, as outlined in section 9. By using our service you agree that we may send data to third-party providers, and this data is subject to their terms of service.

Depending on your location, you may have the following rights regarding personal data stored on our services:

• ·Access — request copies of your personal data.
• ·Rectification — request correction of information you believe is inaccurate.
• ·Erasure — request that we erase your personal data, under certain conditions.
• ·Restrict processing — request that we restrict processing, under certain conditions.
• ·Object to processing — object to our processing of your personal data, under certain conditions.
• ·Data portability — request transfer of collected data to another organisation or directly to you, under certain conditions.

The software is a website (chattutor.dk) which allows students to see their course material as PDF files and get help from an AI agent (a large language model such as ChatGPT). These features are enabled by parsing the PDF files of the course material.

• ·The front-end application uses JavaScript and HTML, executed by the user’s browser.
• ·The back-end application uses Python and handles all user requests — storing and retrieving data, calling external services.
• ·A server runs the back-end.

ChatTutor is written in Python using the Django framework, assessed against CIS Benchmarks. We follow standard recommendations, select packages with widespread commercial use, and avoid trial versions and libraries with controversial licensing or source availability.

ChatTutor is currently hosted on DigitalOcean. The server is physically located in Frankfurt, Germany. The server instance follows a typical Django configuration built on open-source products in widespread commercial use. The four main services are:

• ·NGINX — gateway and hosting of static files.
• ·Gunicorn — main application server.
• ·Daphne — websocket server.
• ·PostgreSQL — database server.

We use the following types of external services which may process user-sensitive data: LLM endpoints for generating answers, PDF OCR services for parsing equations (all PDF documents are stored and served from our own servers), hosting services for sending and receiving email, and bug aggregation and performance monitoring tools. This website also uses HubSpot to run the trial sign-up form and the meeting scheduler; when you open either, HubSpot receives the details you enter and sets its own cookies in your browser to relate your submission to your visit.

ChatTutor is designed to store data centrally on a server we control, and uses third-party dependencies only as demanded. Third-party services in all cases process data stored on our servers; they are never the primary storage medium for user-sensitive data.

• ·AI on-Demand — terms and conditions.
• ·OpenAI paid LLM endpoint — terms of use; accessed through OpenAI’s own library (Apache-2).
• ·Mathpix Convert OCR — terms of use; accessed over HTTP, so no library licence applies.
• ·One.com — domain name hosting and SMTP service (terms).
• ·HubSpot — forms and meeting scheduling on this website, used to handle trial sign-ups and booking requests (privacy policy). Data submitted through these forms is processed in HubSpot’s EU region.

Our system uses the tools, libraries, modules and databases listed at gitlab.compute.dtu.dk/chattutor.

We may update this Data Privacy Policy from time to time. We will notify you of any changes by email. You are advised to review this policy periodically.

If you have any questions about this Data Privacy Policy, please contact our Data Protection Officer (DPO): Kurt Nielsen at kurt@chattutor.io.