This English translation is provided for convenience. In the event of any discrepancy between the English and Spanish versions, the Spanish version prevails. Read the original in Spanish.
When material changes are made to this Policy, LERNIX will communicate them to users through appropriate means (such as a notification on the platform or by email) and, where applicable, will request a new acceptance.
At LERNIX we take the protection of your personal data seriously. That is why, before you create an account, accept an invitation or use the platform, we want to explain clearly how we will use your personal information.
LERNIX is a technology platform for academic support that seeks to strengthen meaningful learning through conversations guided by artificial intelligence, and it was created by LEANDEV S.A.S. Through the platform, students can upload assignments, essays, projects or other academic work, explain and defend their ideas through text or voice interactions, receive adapted questions and obtain feedback. For their part, teachers and educational institutions can configure activities and rubrics, review evidence of students’ reasoning and understanding, access transcripts, generate diagnostics and consult academic statistics.
To provide these features, it is necessary to collect and process certain personal information of students, parents or representatives, teachers, academic coordinators, administrators of educational institutions and persons who contract for or manage the service.
1. Data controller
LEANDEV S.A.S. (hereinafter, “LERNIX”) is the data controller. Its contact details are as follows:
- Address: Martín Carrión y Alpallana, Edificio Titanium Plaza, Oficina 207, Quito, Ecuador.
- Telephone: 0998524769.
- Email: [email protected].
- Personal Data Protection Officer: Ing. Carlos Fabián Ocampo Lucero, appointed through the company Corvant Data. Email: [email protected].
When a person contracts for the subscription directly, LERNIX will act as data controller with respect to the creation and administration of the account, provision of the service, billing, support, security and the other purposes described in this Policy.
When the platform is contracted by an educational institution, the institution may act as data controller with respect to the academic purposes it determines, including the creation of courses, assignment of students, configuration of activities, assessment and use of reports. In these cases, LERNIX may act as data processor and will process the data following the institution’s instructions, without prejudice to those operations it carries out on its own behalf to administer, support, protect and comply with the legal obligations related to the platform.
LERNIX carries out large-scale processing of personal data, including data of children and adolescents; it has therefore appointed a Personal Data Protection Officer.
2. Processing of data of children and adolescents
Access by children and adolescents to the platform requires the prior authorization of their parent or legal representative, which the contracting educational institution must obtain and document. LERNIX, on behalf of and under the instruction of the institution, applies an additional layer of age request and verification before enabling access.
If the authorization is not completed, or is rejected or revoked, LERNIX may keep the account pending, block it or terminate its enablement. When the revocation occurs during the academic period, the student’s access will be suspended, while the academic evidence already generated will be retained.
In all processing of data of children and adolescents, LERNIX will observe the best interests of the child and their progressive autonomy: the involvement of the representative does not limit the adolescent’s right to receive appropriate information, express their opinion and exercise their rights directly in accordance with their maturity.
LERNIX makes available to the Student a summary, in plain language appropriate to their age, of the use of the Platform and the processing of their information, available at lernix.ai/en/privacy/summary-for-teens.
3. For what purposes will we use your personal data?
Your personal data will be used for the following purposes:
- To create, activate and administer accounts of students, teachers, academic coordinators and administrators, as well as to manage profiles, roles, organizations, courses, classes and invitations.
Legal basis: Performance of pre-contractual and/or contractual obligations. - To verify the student’s age and, when the student is a minor, to manage the authorization, rejection or revocation by their parent or representative before enabling access to the platform.
Legal basis: Consent; performance of legal and contractual obligations. - To enable the uploading, storage, organization and submission of assignments, essays, projects, syllabi, educational materials, rubrics and other academic content.
Legal basis: Performance of contractual obligations. - To provide the features of the Socratic tutor through text or voice, process the conversations, formulate questions adapted to the student’s answers, generate transcripts and deliver feedback.
Legal basis: Performance of contractual obligations; consent (when necessary for optional features or for the processing of special categories of data). - To generate assessments, grade ranges, diagnostics, recommendations, alerts and performance profiles in accordance with the rubrics and criteria configured by teachers or institutions.
Legal basis: Performance of contractual obligations. - To allow authorized teachers and administrators to review activities, submissions, conversations, transcripts, progress, results, grades and statistics of the courses or institutions that correspond to them.
Legal basis: Performance of contractual obligations. - To prepare individual or group reports, statistics and academic analytics at the student, course, institution or platform level in order to identify trends, comprehension gaps and opportunities for improvement.
Legal basis: Performance of contractual obligations. - To integrate LERNIX with academic systems or other authorized services in order to import users, courses or academic information, and to export grades, reports or other results.
Legal basis: Performance of contractual obligations; consent. - To manage the contracting, subscription, billing and administration of the relationship with educational institutions, sponsors, parents, students or other customers.
Legal basis: Performance of pre-contractual, contractual and legal obligations. - To handle requests, inquiries, complaints, incidents, support requests and exercises of rights related to the platform.
Legal basis: Performance of contractual and/or pre-contractual obligations; performance of legal obligations. - To maintain the authentication, availability, continuity and security of the platform; to manage permissions and access and activity logs; and to prevent unauthorized access, misuse, fraud, abuse or security incidents; and to verify the academic integrity of sessions by means of technical signals from the session itself, without recording the content inserted by the student or observing their device.
Legal basis: Performance of contractual and legal obligations. - To diagnose errors, evaluate technical performance and develop functional improvements by means of technical, aggregated, pseudonymized or anonymized information, as applicable.
Legal basis: Performance of contractual obligations. - To comply with legal obligations and valid requests from public, administrative, judicial, tax or oversight authorities.
Legal basis: Performance of legal obligations; performance of a task carried out in the public interest; court order. - To initiate, exercise or defend legal claims, rights or actions.
Legal basis: Performance of legal and contractual obligations; legitimate interest.
Within the academic features, LERNIX may analyze the student’s assignments, materials, answers and conversations in order to formulate questions, generate feedback, identify aspects that require reinforcement and suggest grade ranges or performance profiles. This processing may involve artificial intelligence tools and the creation of academic profiles.
Users’ personal data will not be used by LERNIX to train, fine-tune or improve general artificial intelligence models, unless it is irreversibly anonymized information, which LERNIX may use for statistics, evaluation and improvement of its artificial intelligence components, including model training. LERNIX does not sell or assign personal data to third parties for commercial or advertising purposes. The platform does not make final academic decisions based solely on automated assessments. The teacher may review the evidence, modify, validate or reject the recommendations generated by the tool, and assign the final grade they consider appropriate. The logic applied consists of comparing the student’s conversation against the rubric configured by the teacher in order to generate a suggested grade range and a performance profile; the intended consequence is a suggestion that the teacher can review, never a sanction, final grade or automatic exclusion.
4. What personal data may we process?
To provide its services, LERNIX may process, as applicable, the following categories of personal data:
- Identification and profile data, such as name, email address, date of birth, preferred language, institution, role, courses, classes enrolled in or assigned, and account status.
- Data of the parent or representative, such as email address, name where applicable, declared relationship with the student, and evidence of the acceptance, rejection or revocation of the authorization.
- Sensitive or optional data, such as sex, or other preferences that may come to be enabled. These data shall only be collected for a specific, proportionate and previously disclosed purpose, and will require the explicit consent of the data subject where applicable.
- Academic data, such as assignments, essays, projects, materials, syllabi, answers, rubrics, grades, performance ranges, progress, alerts, diagnostics, feedback, learning history, and individual or group reports.
- Conversation and interaction data, such as text messages, questions and answers generated during the interaction with the Socratic tutor, uploaded files and transcripts.
- Voice data, when the student activates the microphone to interact with the Socratic tutor, including the audio and the generated transcript. The audio is not used for biometric identification or identity verification. Legal basis: performance of contractual obligations.
- Technical and usage data, such as IP address, identifiers, access and activity logs, authentication, sessions, connection time, attempts, errors, security events, device or browser data, and technical session-integrity signals as detailed in the Terms and Conditions.
- Contracting, billing and payment data related to the subscription, the institution, the sponsor or the person responsible for payment, where applicable.
The mandatory data will depend on the profile and the feature used. Sensitive data and preferences that are not indispensable shall be optional. If you decide not to provide the required information, do not accept the applicable terms, or request that an indispensable processing operation not be carried out, LERNIX may not be able to create or maintain the account, enable a particular feature or allow access to the platform.
LERNIX will not use your personal data for purposes incompatible with those disclosed in this Policy. If it needs to use the data for a different or additional purpose, it will inform you in advance and, where applicable, request your authorization.
5. Source of the personal data
As a general rule, personal data are obtained directly from the data subject when they accept an invitation, create an account, complete their profile, use the platform, upload content, take part in a conversation or communicate with LERNIX.
The information may also be obtained or supplemented by:
- The educational institution, the organization administrator or the teacher, through individual registration, bulk file upload or assignment of the user to a course or class.
- The parent or representative of the minor student, during the authorization process or the exercise of rights.
- Third-party academic systems, when there is an authorized integration to import users, courses, materials or academic information, or to export grades and reports.
- The activity carried out within the platform, including interactions, submissions, conversations, transcripts, results, reports and technical logs.
- The analyses, questions, diagnostics, feedback or reports generated by the artificial intelligence components to provide the requested features.
When an educational institution, teacher or third party provides personal data of another person, it represents that it is authorized to do so, that it has fulfilled the corresponding duty to inform, and that the information provided is relevant, accurate and necessary for the applicable academic or contractual purpose.
6. Transfers and communications of personal data
To manage and operate the platform, LERNIX may communicate or allow access to personal data to the following categories of recipients, depending on the feature used:
- Educational institutions, organization administrators, academic coordinators and authorized teachers, within the scope of the courses, classes, students and purposes that correspond to them. In this case, LERNIX applies controls based on profiles, roles, classes and organizations. For this reason, each teacher shall access only the classes assigned to them; each institution, the information of its own organization; and each student, their own data, assignments, sessions, submissions, transcripts and feedback.
- Technology providers that support the operation of the platform, including infrastructure, hosting, database, web distribution, voice interaction, speech transcription and synthesis, artificial intelligence, email and technical observability. Up-to-date details of these providers, with their purpose, location and the data involved, are available at lernix.ai/en/privacy/subprocessors.
- Technical observability providers receive the content processed by the models, with restricted access and limited retention.
- Billing, payment, professional advisory or support providers that are necessary to administer the contractual relationship.
- Public, administrative, judicial, tax or oversight authorities, when there is a legal obligation or a valid request.
Personal data may be stored or processed outside Ecuador, mainly in the United States of America, because the technology infrastructure and several providers are located in that country. When international transfers or communications take place, LERNIX will implement the contractual, organizational and technical safeguards required by the applicable regulations, such as data processing agreements, data protection clauses, provider assessments, security measures or other legally permitted mechanisms.
7. Retention period
Personal data will be retained for as long as necessary to fulfill the purposes disclosed in this Policy. Retention periods may take into account the duration of the contract or subscription, the academic period, the validity of the account, the need to keep evidence of authorizations and consents, limitation periods, and the applicable accounting, tax, contractual or regulatory obligations.
When an invitation is not accepted, the account remains pending, the representative rejects or revokes the authorization, the person stops using the platform, or the relationship with an educational institution ends, LERNIX may retain certain information for the period necessary to support the action taken, handle inquiries or complaints, and comply with legal obligations.
Once the purposes and the corresponding retention periods have been fulfilled, LERNIX will proceed with the deletion, blocking, return or anonymization of the information, as applicable. Anonymized information may be retained to produce statistics or analyses that no longer allow a person to be identified.
In addition, please note that LERNIX adopts reasonable security, confidentiality and control measures to protect personal data against unauthorized access, loss, alteration, misuse or unauthorized disclosure. These measures include authentication, profiles and roles, access controls by organization and class, security rules at the database and API level, access and activity logs, separation of environments and the use of synthetic data in testing, as well as backup and recovery mechanisms in accordance with the capabilities of its providers.
In the event of a security breach affecting personal data, LERNIX will notify the Superintendency of Personal Data Protection (Superintendencia de Protección de Datos Personales) and the affected data subjects, where applicable, without undue delay and within the time limits provided for in the applicable regulations. When LERNIX acts as data processor, it will notify the responsible educational institution within forty-eight (48) hours following confirmation of the incident, so that the institution can coordinate the notification to the authority and to the data subjects as appropriate.
8. Your rights over your personal data
Personal data protection regulations grant rights to data subjects, and LERNIX guarantees channels for exercising them. Without prejudice to the provisions of the regulations, the rights are:
- Right to information: to be informed about the personal data we process, how and for what purposes we use them, their recipients, transfers, and the retention period or criteria.
- Right of access: to know and obtain access to your personal data free of charge.
- Right to rectification and updating: to rectify and update any of your personal data when they are incomplete, out of date or inaccurate. The information you provide must be true, complete, accurate and up to date. If you provide incorrect, incomplete, out-of-date or inaccurate data, this could affect the service.
- Right to deletion: to request the erasure of your personal data in the situations provided for by law.
- Right to object: to object to or refuse certain processing in the cases established by personal data protection regulations.
- Right to data portability: to request your personal data in a compatible format or require their transfer to another controller where applicable.
- Right to suspension of processing: to request the temporary or permanent suspension of the processing of all or part of your personal data when the legal conditions are met.
- Right to revoke consent: to withdraw your authorization at any time, without affecting the lawfulness of the processing carried out before the revocation.
- Right not to be subject to decisions based solely on automated assessments: to request information, express your point of view, challenge the result and request human review where applicable.
- Right to file a claim or complaint with the Superintendency of Personal Data Protection.
To exercise these rights or revoke your consent, the procedure will depend on the role LERNIX plays in each processing operation. When LERNIX acts as data processor, the data subject must address their request to the educational institution or organization that acts as data controller and that has determined the purposes and means applicable to the use of the platform. If LERNIX receives a request directly, it will notify and forward the request to the corresponding data controller, without undue delay, so that the controller can analyze and handle it in accordance with the applicable regulations. Where applicable, LERNIX will cooperate internally with the controller.
When LERNIX acts as data controller, the data subject may submit their request by email to [email protected], attaching the form for the exercise of rights available at lernix.ai/en/privacy/rights-request-form. LERNIX may request additional information when necessary to validate the identity of the requester, prove their representation or clarify the scope of the request. If the request is incomplete, the requester will be asked to remedy it, and the procedure will remain suspended until the necessary information is provided.
Requests will be handled within the time limits established in the personal data protection regulations. When the request concerns a student who is a minor, it may be submitted by their parent or representative, without prejudice to the adolescent’s direct and progressive exercise of their rights, in accordance with the applicable regulations.
With respect to requests or complaints that you submit to the Superintendency of Personal Data Protection, it will be necessary to follow the procedures determined by that authority.
9. Cookies and similar technologies
LERNIX uses cookies and similar technologies that are strictly necessary for its operation, such as maintaining the session, authenticating the user, securing access and preserving preferences configured by the user (such as language). The materials of an activity may include embedded third-party videos (for example, YouTube); when they are played, the user’s browser communicates directly with that third party, which may receive the user’s IP address. The public LERNIX website (lernix.ai) is governed by its own cookie policy and notice, available on that site.