Privacy and cookies

The data controller is:

EDUKAI S.R.L.S. (an Italian società a responsabilità limitata semplificata, a simplified limited liability company with a sole shareholder), registered office at Via Pandosia 13, 00183 Rome (RM), Italy. Tax code, VAT number and Rome Companies Register number 17352961001, REA RM-1712755. Share capital €500.00, fully paid up.

For any question about your data, write to info@edukai.app or by certified email (PEC) to edukai@pec.it.

This notice concerns visitors to edukai.app, users of PrismaX (prismax.edukai.app), with or without an account, and anyone who contacts us.

If you use PrismaX through a school, university or company that has signed a contract with us, for the data processed on its behalf the organisation is the controller and we act as processor, under an agreement pursuant to art. 28 of Regulation (EU) 2016/679 (GDPR). For that data, please contact the organisation first.

When you visit edukai.app

Technical connection data (IP address, browser, pages requested, date and time), needed to show you the website and protect it from automated attacks. If we enable analytics or marketing tools, we will do so as described in the sections on profiling and cookies.

When you contact us

The data you write to us by email or WhatsApp (name, contact details, content of the message). On WhatsApp, Meta processes your data as an independent controller under its own terms.

When you try PrismaX without an account

• The request you write and the choices you make, sent to the artificial intelligence to prepare the page. We do not store them in our systems: the page stays in your browser for 24 hours.
• A code derived from your IP address with a hash function, different every day, used to count trials and apply limits. The IP address is not stored.
• The technical signals of the Cloudflare Turnstile bot check (see the section on cookies).

When you create an account

• First name, last name, email and password (stored only in encrypted form). If you sign in with Google, we receive the name, email and identifier of your Google account.
• Optional: profile photo, description and country.
• How you came to PrismaX, for example from a shared course.

When you use PrismaX

• Your content: requests to the artificial intelligence, courses, lessons, figures and exercises. For each course we keep the history of the last 30 changes, with the request that produced them.
• Artificial intelligence usage data, without the text: date, feature, model used, amount of text processed, cost and duration. They are used to calculate plan limits and costs.
• When you open someone else’s course with your account, the date of the first and last opening.
• In restricted courses, your study activity: chapters opened, guided solutions viewed, answers to exercises and their outcome.
• If you create a restricted course, the emails or domains of the people you authorise and, if you set one, the course password (stored only in encrypted form).
• Information derived from use, for example the subjects and level of the lessons you create or study, the features you use and your results in exercises.

When you purchase Pro

Payment takes place on Stripe: card details are processed by Stripe and we do not see them. We keep billing data (name or company name, address, tax code, VAT number, recipient code or certified email), the plan, the subscription status, the amounts and the invoices.

For security

Technical server logs and a log of sensitive operations by our staff, for example account blocks or deletions.

Account and payment data are necessary: without them we cannot provide PrismaX. Other data are optional.

We do not sell your personal data. We may share or commercialise only aggregated or anonymous data that does not identify you.

To prepare lessons, figures and exercises, PrismaX sends the artificial intelligence models your request and the parts of the course you are working on (for example the text of a chapter or the code of a figure). We do not send your name or email. Avoid including your own or other people’s personal data in requests.

Requests go through OpenRouter, which forwards them to the chosen model. Today we mainly use Google’s Gemini models and, as a fallback when they are unavailable, models from OpenAI. The list may change when we add or replace models: we keep it up to date on this page.

Under these providers’ current terms, data sent through their application programming interfaces (APIs) is not used to train their models. Providers may retain it for a limited period for security and abuse prevention.

We may reuse elements generated by artificial intelligence, such as figures, animations and code, to provide the service to other users and to build Edukai’s library, without your texts and without your personal data. We do not currently use your content to train artificial intelligence models: if we wish to do so in the future, we will tell you beforehand and you will be able to object or, where the law requires it, we will ask for your consent.

Content generated by PrismaX is produced by artificial intelligence and may contain errors. You can object to processing related to artificial intelligence that is based on our legitimate interest, as explained in the section on your rights.

We may use information derived from your use of PrismaX (for example subjects, level, features used and results in exercises) to adapt the service to you: explanations at your level, exercises, suggestions of content and features. This is a form of profiling that serves to provide you with a better service; you can object at any time by writing to us.

Profiling for marketing and personalised advertising, including through third-party platforms such as Meta and Google, and analytics with third-party tools are enabled only with your consent, collected beforehand, which you can withdraw whenever you wish.

We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you (art. 22 GDPR): the automatic checking of exercises only serves to give you feedback.

• Public courses: anyone, including through search engines, can see the course with the author’s name, photo and description. Public courses join Edukai’s library, may appear in the gallery and be copied by other users, as provided in the terms of service. If you withdraw a public course, we remove the public page and your name; the content may remain in Edukai’s library in anonymous form.
• Link courses: visible to anyone with the link, with the same information about the author.
• Restricted courses: the author sees the name, email and study activity of the authorised people (chapters opened, solutions viewed, answers and their outcome). We state this in the course.
• The author of a course can see which users with an account opened it and when.

Our authorised staff may access content, including unpublished content, only for support, security, moderation and legal obligations.

We rely on providers that process data on our behalf as processors, under a contract governing its use, or, where indicated, as independent controllers.

Data may also be disclosed to our tax advisor and, where required by law, to the authorities.

Corporate transactions. In the event of a merger, acquisition or transfer of all or part of the business, data may be disclosed, under confidentiality obligations, to prospective buyers and their advisors to assess the transaction, and transferred to the new controller, who will continue to process it for the purposes set out in this notice. This is not a sale of data: we will inform you of the change.

Some providers are based in the United States. Transfers take place on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework, where the provider is certified, and otherwise on the basis of the standard contractual clauses approved by the Commission (arts. 45 and 46 GDPR). Since the Data Privacy Framework is under review, we also rely on the standard contractual clauses where available.

You can ask us for information about the safeguards used by writing to info@edukai.app.

We may keep some data longer if the law requires it or to defend our rights in case of disputes, for no longer than strictly necessary.

PrismaX and edukai.app are not directed at minors. Accounts and artificial intelligence features are reserved for people aged at least 18, as provided in the terms of service.

If we find that we have collected a minor’s data, we delete it. If you are a parent and believe your child has provided us with data, write to us at info@edukai.app.

Today we use only technical cookies and similar tools, necessary to run the services you request: these do not require consent, which is why we do not show a banner.

If we enable analytics, profiling or marketing cookies, including third-party ones (for example Google Analytics or the Meta pixel), we will use them only after your consent, requested through a banner where you can accept, refuse or choose them, and we will list them in this section.

edukai.app

PrismaX

PrismaX also stores some preferences and working copies in your browser (local storage): the trial without an account (24 hours), unsaved copies of the courses you are editing (14 days), the chosen artificial intelligence mode and the state of the sidebar. They stay on your device.

The Cloudflare Turnstile bot check runs in a Cloudflare frame and collects the technical signals needed to tell people and bots apart, such as the IP address and browser characteristics (Cloudflare’s notice).

You can delete or block cookies in your browser settings; if you block technical cookies, some features, such as signing in to your account, stop working.

We protect data with encrypted connections, passwords stored only in encrypted form, limited staff access logged for sensitive operations, isolated execution of the code of generated figures, and backup copies. If a personal data breach affecting you occurs, we handle and notify it as required by the GDPR.

You may ask us at any time to:

• access your data and receive a copy;
• correct or complete it;
• delete it, including the whole account;
• restrict its processing;
• receive it in a commonly used format to transfer it elsewhere (portability);
• object to processing based on our legitimate interest, including personalisation and communications about our services;
• withdraw your consent, where processing is based on consent.

Write to info@edukai.app or by certified email to edukai@pec.it. We reply within one month; to protect you, we may ask you to confirm your identity, for example by writing to us from the account’s email address.

If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the authority of the country where you live or work.

We update this notice when our services, providers or the law change. The date at the top shows the latest version. We inform you of significant changes by email or in the app.

This is a translation of the Italian notice, which is the original version: in case of differences, the Italian version prevails.