Privacy policy
Last updated:
This policy explains what personal data Lexora collects, why, how long we keep it and what your rights are under the EU General Data Protection Regulation (GDPR / AVG). It covers the meeting simulation, school reports, meeting notes and recordings, and messages with teachers. In short: we collect as little as possible, we never sell your data, and we do not use advertising or tracking cookies.
1. Who is responsible for your data
The controller of your personal data is:
Lexora Contact form2. What we collect and why
| Data | Purpose | Legal basis (GDPR art. 6) | How long we keep it |
|---|---|---|---|
| Account: name, email address, password (stored only as a secure hash) or your Google account ID if you sign in with Google | Creating and securing your account | Performance of our agreement with you (b) | Until you delete your account |
| Profile (all optional): Dutch level, home language, the language for explanations, city, your child’s first name and school stage. We also remember the language you last used the website in, so our emails reach you in it | Adjusting the practice and explanations to you, and suggesting relevant meetings | Performance of our agreement (b) | Until you change it or delete your account |
| Educator profile: school, your role at school and your link code | Letting families recognise you and link with you | Performance of our agreement (b) | Until you change it or delete your account |
| Practice results: scenario, level, teacher style, readiness score, a short summary and the date | Showing your progress on your profile | Performance of our agreement (b) | Until you delete your account |
| Practice conversations: the text you type during a simulation | Generating the AI teacher’s replies and your feedback | Performance of our agreement (b) | Not stored by Lexora. Sent to our AI provider only to generate the reply (see section 5) |
| School reports: the title, your child’s first name, the school year, the file you upload (PDF or photo) or the text you paste, the AI explanation and its language | Explaining the report to you in your language | Performance of our agreement (b) | Until you delete the report or your account. The file is deleted together with the report |
| Meeting notes: the title, date and linked teacher, and a voice recording, an uploaded file or the notes you type; the transcript of a recording and the AI summary | Writing down what was said and summarising it in your language | Performance of our agreement (b) | Until you delete the meeting note or your account. The recording or file is deleted together with the note |
| Messages with teachers: the messages you and the teacher write, translations of them, whether a message has been read, and the teacher’s name, email address, school and role that you enter | Letting you and the teacher talk, translating messages and emailing new messages | For account holders: performance of our agreement (b). For a teacher without a Lexora account: our and the parent’s legitimate interest in communication between home and school (f) | Until the parent deletes the conversation or their account. “Is typing…” is kept for a few seconds only |
| Reports and meeting notes shared by an educator: the same data as above, placed in the family’s account | Giving the family the document with an explanation in their own language | Performance of our agreement (b) | Until the family deletes it, the educator removes it, or the family deletes their account |
| Pilot sign-up: name, email, role, city, interface language | Contacting you about the pilot | Your consent (a), which you can withdraw at any time | Until the pilot ends or you withdraw, at most 24 months |
| Contact messages: name, email, topic and message | Answering your question | Our legitimate interest in answering questions (f) | 12 months after our last reply |
| Technical data: IP address, browser type, time of request, a counter of AI requests per hour | Running the website securely, preventing abuse and protecting the AI budget | Our legitimate interest in a secure service (f) | Session data: up to 2 weeks. Server logs: as long as our hosting provider keeps them, normally a few weeks |
Please do not type sensitive information into the simulation, such as health details, diagnoses or full names of your child, teachers or other people. The scenarios are fictional and do not need real details.
3. Sensitive information, recordings and other people
We do not ask for special categories of personal data (GDPR art. 9). Your home language is optional and used only to adapt the service; we never use it to infer ethnic origin.
A school report or a meeting can still contain sensitive information about your child, such as learning support, dyslexia or a health condition. When you upload or record it, you choose to have Lexora process it for you, only to make your explanation or summary (art. 9(2)(a)). You can delete it at any time, and we never use it for anything else.
Reports, recordings, meeting notes and messages also contain information about other people, such as the teacher’s name and voice. Always ask everyone in the meeting before you record it. Lexora reminds you of this on the recording screen. Recordings, files and transcripts are stored privately in your account and are never shared with the school or anyone else unless you share them yourself.
4. Who can see your reports, notes and messages
- You see everything in your own account.
- An educator you link with sees your name, your child’s first name and school stage, your conversation with them, and the reports and meeting notes they shared with you. They do not see your practice scores, your own reports and meeting notes, or Lexora’s explanations.
- A teacher without a Lexora account receives each of your messages by email, with a private reply link. Anyone with that link can read and reply in that one conversation, so the teacher should not forward it.
- If an educator ends the link, they can no longer see the conversation. It stays in your account, together with what they shared, until you delete it.
- Nobody else sees your reports, notes or messages. Lexora staff only look at them if you ask us for help or if the law requires it.
5. Who receives your data
We only share data with service providers (processors) that we need to run Lexora, under a data processing agreement:
- Hosting provider — stores the website, the database and uploaded files and recordings.
- OpenAI — generates the AI teacher’s replies and your feedback; reads the school reports and meeting files you upload; turns recordings into text; writes explanations and summaries; translates chat messages; and turns your draft into polite Dutch when you ask. Under OpenAI’s API terms, this data is not used to train their models and may be kept for up to 30 days for abuse monitoring.
- Email delivery provider — sends account emails, notifications of new messages and shared documents, and messages to teachers without a Lexora account. Those emails contain the message text.
- Google — only if you choose “Continue with Google”: Google confirms your identity and shares your name, email address and Google account ID with us.
We never sell your data and never share it for advertising. Fonts and photos on this website are served from our own server, so visiting a page does not send your data to font or image services.
6. Transfers outside the EU
OpenAI and Google may process data in the United States. These transfers are covered by the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and/or the European Commission’s Standard Contractual Clauses.
7. Automated scores and explanations
The readiness score, feedback, report explanations, meeting summaries and translations are generated automatically by AI. They can contain mistakes and are meant to help you understand and prepare. They have no legal or similarly significant effect on you, so GDPR article 22 does not apply. Nobody at a school or authority sees your score or your explanations.
8. Your rights
You have the right to:
- access your data and receive a copy (art. 15);
- correct inaccurate data (art. 16);
- delete your data (art. 17);
- restrict processing (art. 18);
- data portability — receive your data in a machine-readable format (art. 20);
- object to processing based on legitimate interest (art. 21);
- withdraw your consent at any time, without affecting earlier processing (art. 7).
If you have an account, you can do most of this yourself. Delete a single report, meeting note or conversation on its own page. On your profile you can edit your details, download your data (including your reports, meeting notes, explanations and messages; open the original files in your account) or delete your account, which deletes all of it, including files and recordings. For anything else, contact us. We respond within one month.
Teachers without a Lexora account can also contact us to see, correct or delete their data.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens; you can also contact the authority in the EU country where you live.
9. Children
Lexora is meant for parents and carers aged 18 or older. We do not knowingly collect data from children. Reports and meeting notes are about your child, but they are kept in your account and you decide what you upload and when you delete it. Your child’s first name and school stage are optional; you can leave them empty.
10. Security
We use encrypted connections (HTTPS), store passwords only as salted hashes, keep uploaded files and recordings in private storage that is not reachable through a public link, limit access to personal data to the people who need it and delete data when it is no longer needed.
11. Cookies
We only use cookies that are strictly necessary for the website to work. See our cookie policy.
12. Changes
We may update this policy when our service changes. The date at the top shows the latest version. If a change is important, we will tell account holders by email or on the website.