Privacy Policy

MirrorBuddy is an educational app for students with learning differences, developed by an international team with UK representation. This privacy policy explains how we collect, use, and protect your personal data. As your data controller, we are responsible for protecting your personal information in compliance with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

To provide our service, we collect these personal data:

• Email - Used for login and notifications
• Name - Used to personalise your experience
• Conversations - Saved to continue learning from where you left off
• Flashcards - Used to track your learning via FSRS algorithm
• Learning Progress - Recorded to give you personalised feedback
• User Preferences - Saved to remember your accessibility and language choices

To protect your privacy, we never collect sensitive data such as:

• Health information (unless you voluntarily share it in a conversation)
• Direct payment details (we use certified third parties)
• Personal photos or videos
• Your geographical location

We use your data only for these legitimate purposes:

• Make the app work - Load your conversations, flashcards and progress
• Personalize your experience - Adapt the maestri to your interests and learning level
• Improve MirrorBuddy - Understand how you use MirrorBuddy to add new features (with optional analytics)
• Help you if you have problems - Help you if you experience technical or pedagogical issues

We do not use your data for automated profiling, targeted advertising, or decisions about you without human involvement.

As a user, you can choose to participate in our analytics to help us improve the app.

What We Collect: Pages visited, time spent, features used, errors encountered. No personal data is stored in logs.

Why: To understand which features are helpful, where students struggle, and how to make MirrorBuddy better for everyone.

How Long: Analytics data is retained for 12 months, then aggregated and removed.

How to Refuse: You can disable analytics in privacy settings without losing any functionality.

Your personal data is accessible to:

• You - You have complete control of your data and can download, modify or delete it
• Parents - Your parents can monitor your progress via the Parent Dashboard (if you are a minor)
• MirrorBuddy Team - The MirrorBuddy team accesses data for technical support, only when necessary

Trusted Partners

We use these certified services to run MirrorBuddy safely:

• Vercel (server hosting, GDPR compliant, EU-based)
• Supabase (PostgreSQL database, encrypted, GDPR compliant)
• Azure OpenAI (conversational data processing, GDPR compliant)
• Resend (transactional email sending, GDPR compliant)
• Upstash (Redis cache, GDPR compliant)
• Brave (optional privacy-first search, doesn't collect IP)
• Google Drive (optional for document uploads, only when you choose to connect)
• Grafana (system metrics only, no personal data)
• Ollama (optional local AI models, all on-device)

No other service has access to your data. We do not sell data to third parties.

Note: Azure OpenAI processes some conversational data in the USA with Standard Contractual Clauses (SCC) as per UK GDPR Art. 46.

We process your personal data on these legal bases under UK GDPR: (1) Contractual necessity (Art. 6.1.b) - to provide the service; (2) Explicit consent (Art. 6.1.a) - for optional analytics and communications; (3) Legitimate interest (Art. 6.1.f) - for security, fraud prevention, service improvement.

Data transfers to non-UK countries (such as the USA) only occur for services with approved Standard Contractual Clauses (SCC) or UK adequacy decisions.

Your legal basis for data processing is consent to the service (contract) and, where applicable, explicit consent you have given in settings.

MirrorBuddy is the data controller. However, some services are processed by data processors who process data on our behalf under DPA (Data Processing Agreements) compliant with UK GDPR Art. 28.

Our certified data processors:

• Vercel: Hosting and global CDN - EU-based, SOC 2 Type II certified
• Supabase:: Managed PostgreSQL database - EU-based, ISO 27001 certified
• Resend:: Transactional email service - EU-based, with UK GDPR compliant DPA
• Azure: Conversational AI processing - USA-based but with SCC and OneTrust compliant

All data processors have signed DPA contracts compliant with UK GDPR Art. 28 and 32. You can request a copy of our DPAs by writing to info@fightthestroke.org.

• Account attivo - - While your account is active, we retain all your data (email, conversations, flashcards, progress) to provide the service
• Conversazioni - - Conversations with maestri are retained for 90 days of inactivity, then archived for 1 year, then deleted
• Web Vitals - - Technical data (Web Vitals, errors) is retained for 12 months for improvement, then aggregated and deleted
• Account cancellato - - When you delete your account, all data is deleted within 30 days (backup: 90 days by law). Aggregated research data remains pseudonymised

You have the right to exercise your privacy rights at any time. These rights include access, rectification, erasure, portability, objection, and restriction of processing.

• Right to Access - You can request a copy of all your personal data in a readable format
• Right to Rectification - You can request correction of inaccurate or incomplete data
• Right to Erasure - You can request complete deletion of your personal data
• Right to Portability - You can receive your data in a structured format (JSON, CSV)
• Right to Object - You can object to processing your data for certain purposes

To exercise your rights, contact us at: info@fightthestroke.org

We use cookies and analytics services to improve your experience.

• Essential Cookies - Required for website functionality (authentication, security)
• Analytics Cookies - Optional - help us understand how you use MirrorBuddy

Vercel Analytics: Vercel Analytics collects technical data to monitor site performance

• No Cookies - Does not use tracking cookies
• Anonymous Data - All data is anonymous and aggregated
• GDPR Compliant - Compliant with GDPR and doesn't require consent
• Technical Data Only - Collects only technical metrics, no personal data

Sentry (Monitoraggio Errori e Performance): Sentry monitors errors and performance to ensure service reliability

• Error Monitoring - Detects and logs errors for quick fixes
• Performance Monitoring - Measures speed and responsiveness
• AI Monitoring - Monitors AI interactions for quality
• Session Replay - Records sessions (only with explicit consent)
• No PII - Does not collect personally identifiable data
• EU Servers - Data remains on European servers
• Service Improvement - Helps improve global reliability

MirrorBuddy does not use advertising tracking or commercial profiling.

If you choose to connect Google Drive to upload documents, you must read Google's privacy policy.

• Grant MirrorBuddy permission to access your files
• Read Google Drive's privacy policy
• MirrorBuddy only accesses files you choose to upload

We recommend reviewing Google's privacy settings before connecting your account.

We implement technical and organisational security measures to protect your data:

• We use HTTPS/TLS for encryption in transit
• Passwords are hashed with secure algorithms
• We perform regular backups for disaster recovery
• Data access is limited to our necessary team members

While we implement strong security measures, no system is completely immune from risks. We encourage you to use strong passwords and protect your account.

We may update this privacy policy from time to time. We will notify you of significant changes via:

• Email to your registered address
• Banner in our app
• You may be asked to accept the updated version

If you have questions about our privacy policy or wish to exercise your rights, contact us at: info@fightthestroke.org

We appreciate your trust in protecting your privacy and remain available for any questions you may have.

AI Systems in Use

MirrorBuddy uses artificial intelligence systems to personalize your educational experience. All our AI systems are transparent, controllable, and designed with integrated human oversight. We do not make automated decisions that significantly impact your education without human review.

Which Data We Process with AI

The following personal data is processed by our AI systems:

• Conversation Messages - Your conversations with teachers are analyzed to personalize the tone and difficulty level
• Educational Context - Your grade level, subjects of interest, and learning style are used to adapt content
• Educational Profile - Your progress data (flashcards, quizzes, exercises) is used to recommend the next topic to learn

Non elaboriamo con AI: Your sensitive information (health data, location, biometric information) is never processed with AI, even if shared voluntarily.

How We Make Decisions with AI

AI-based decisions affect your learning experience in these ways:

• Teacher Access: AI recommends which teachers might be most helpful to you based on your interests
• Educational Benefits: AI identifies your strengths and areas where you might need extra support
• Learning Path: AI suggests which topic to learn next to optimize memory retention

Note: None of these decisions are final without human intervention. Parents and teachers can always override AI suggestions.

Your Rights on AI-Based Decisions

According to the EU AI Act, you have the following rights regarding automated decisions:

• Right to Human Review - You can request that a person (teacher or parent) review any AI-based decision
• Right to Feedback - You can share feedback on how AI has impacted your learning, and we will use this feedback to improve
• Right to Transparency - You can request an explanation of how and why AI made a particular decision about your learning
• Right to Object - You can object to the processing of your data with AI systems at any time

How We Stay Transparent

We implement these measures to remain transparent about our AI systems:

• Regular Review - We review our AI systems quarterly to ensure they work correctly and fairly for all students
• Quality Monitoring - We continuously monitor AI outcomes to detect and correct any bias or errors
• Public Reports - We publish quarterly reports on our Model Card that describe how our AI systems work
• Data Retention - We retain logs of AI decisions for 90 days for review and improvement, then delete them

Want to Know More?

Leggi la nostra AI Policy completa for complete information about our AI architecture, bias testing, and how we use conversational data.