Privacy Policy
How DeepVect AI collects, uses, shares and protects personal data of teachers, school staff, students and parents.
1. Who is responsible
The data controller for DeepVect AI (the "Service") is DeepVect AI Technologies Kong, DeepVect AI Technologies Kong, Im Feld 7, 5452 Oberrohrdorf, Switzerland. Privacy enquiries: support@deepvect.ch.
When a school (the "Institution") creates student accounts or invites students with a class code, the Institution decides why and how student data is processed and DeepVect AI processes that data on the Institution's instructions (processor role). For accounts that staff create for themselves and for purchases made by a parent or guardian, the operator acts as controller.
2. What we collect
- Account data: name, e-mail address, password hash, role (teacher/owner/student), school, language, optional phone number (for verification only), sign-in method (password, Google).
- Content you create: chat messages and AI replies, uploaded documents and images (and text extracted from them), generated media, assignments, homework submissions, study material, notes and announcements.
- Teacher controls and monitoring: model access rules, schedules, word filters, moderation flags, and – where the Institution enables it – teacher review of student conversations within their classes.
- Usage and security data: timestamps, approximate location derived from IP address (country/city), browser and device type, sign-in alerts, audit log entries, token/usage counters needed for fair-use limits and billing.
- Billing data (schools and Student Premium): plan, seats, invoices, payment status. Card details are entered on Stripe's pages and never reach our servers.
- Product analytics (platform staff only, aggregated): page views and feature usage via PostHog for the operator's own staff accounts. Teachers and students are excluded from analytics. Platform staff see a notice on first visit and can decline with one tap. Session replay is OFF by default and, if the operator ever enables it for platform staff, every input and all text are masked.
3. Why we process it and on what legal basis
- Provide the Service, keep accounts secure, deliver AI answers and school controls (performance of a contract; for Institutions: processing on their documented instructions).
- Child safety and school oversight: moderation, teacher review and audit trails requested by the Institution (legitimate interest of the Institution / public-task basis for public schools).
- Billing, receipts, tax and accounting (legal obligation and contract).
- Service e-mails such as verification, password reset, sign-in alerts, plan reminders and weekly digests. Optional e-mails can be stopped with the unsubscribe link in every message or in Settings → Notifications.
- Product analytics for the operator's platform staff accounts only (legitimate interest; one-tap opt-out; disabled for teachers and students).
4. AI providers
To answer a prompt we send the prompt, selected conversation history, attached documents and generation settings to the AI provider of the model that was chosen (for example OpenAI, Anthropic, Google, xAI, DeepSeek, Moonshot AI or fal.ai). We use business API terms under which providers do not use the content to train their models. Which providers are available is controlled by the Institution's model-access rules. Web search sends only the search query text to the search provider.
5. Children and students
Students never create accounts on their own on DeepVect AI: student accounts are created by their school or with a class code issued by a teacher. The school therefore provides the authorisation required by COPPA (US) and, where applicable, by Art. 8 GDPR (EU/EEA). Public self-registration (for staff) requires confirmation that the person is at least 13 years old.
We do not show advertising, do not sell personal data and do not build marketing profiles of students. Students are excluded from analytics tooling. Parents and guardians can exercise the rights below through the school, or directly for a Student Premium subscription they purchased.
7. International transfers
Some providers process data outside your country (for example in the United States). Where EU/EEA or UK data is transferred, we rely on adequacy decisions (including the EU–US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses with supplementary measures.
8. Retention
- Account data: for the life of the account and up to 30 days after deletion (backups).
- Conversations, uploads and generated media: until deleted by the student/teacher, or according to the retention period configured by the Institution; audit logs are kept as long as the Institution requires for oversight.
- Billing records: as long as tax and accounting law require (typically 6–10 years).
- Security logs and sign-in alerts: up to 12 months.
9. Your rights
Depending on where you live you can access, correct, export, restrict or delete your personal data, object to processing based on legitimate interest, and withdraw consent at any time. Write to support@deepvect.ch or use the Contact page. Students and parents should normally contact the school first, which is the controller of school-managed accounts. You can also complain to your data-protection authority.
US residents (including under CCPA/CPRA and state student-privacy laws): we do not sell or "share" personal information for cross-context advertising and do not use student data for targeted advertising.
10. Security
Encryption in transit (TLS), hashed passwords, optional two-factor authentication for staff, re-authentication for sensitive admin actions, role-based and school-scoped access, append-only audit trails and least-privilege API keys.
11. Changes
We will announce material changes in the app and by e-mail where appropriate. Last updated: 2026-10-14.