Privacy Policy
Last updated: 20 October 2026
This policy explains what personal data Necudah keeps, why, who else receives it, how long we keep it, and how you can see it, correct it or have it deleted. It applies to necudah.com, every school site on it (such as yourschool.necudah.com) and the Necudah mobile app.
Necudah is a free, invite-only beta. There is no advertising, we do not sell personal data, and we do not use it to build profiles for marketing.
1. Who is responsible
Necudah (“we”) runs the platform.
Contact for anything about your data: hello@necudah.com
There are two different roles, depending on whose data it is:
- Your account on Necudah, our own logs and our backups: we decide what happens to this data. In data-protection terms, we are its controller.
- What happens inside a school (its students, classes, lessons, messages, quiz answers, essays, grades, attendance): the school or teacher decides whose data goes in and why, so they are the controller. We store and process it for the school, on its instructions. For that data we are the school’s processor, under our School Data Agreement. If you are a student, the school that invited you is your first point of contact, but you may always write to us too.
2. What we keep, and why
| What | Examples | Why | Legal basis |
|---|---|---|---|
| Account | name, username, email, password (stored scrambled, never readable), language, profile picture, notification settings | to give you an account and sign you in | providing the service you asked for (contract) |
| Profile fields a school adds | for example a student’s grade or a parent’s phone number | the school’s own records | the school’s instructions (see section 1) |
| Learning records | courses joined, progress, quiz answers and uploaded answer files, essays and the teacher’s feedback, game scores, assignments, attendance | so students can learn and teachers can teach and grade | the school’s instructions |
| Messages and notifications | messages between members of a school, class posts, notifications, the emails we send you | communication inside the school | contract / the school’s instructions |
| Content teachers create | courses, lessons, quizzes, uploaded files | to run the school | contract |
| AI requests | the instructions a teacher gives the AI, the lesson text, reference files they upload; questions asked in the Help assistant | to generate what the teacher asked for, or to answer the question | contract |
| Security records | IP address and username of each sign-in attempt; IP address, browser and page of “page not found” visits; the bot check on sign-up forms | to protect accounts against password guessing and abuse | our legitimate interest in keeping the service secure |
| Usage and cost records | which AI features were used, by whom, the cost, and the first 500 characters of the request | to keep AI spending under control | legitimate interest |
| Feedback | bug reports and screenshots you send us | to fix problems | legitimate interest |
| Backups | a nightly copy of everything above | to recover after a failure | legitimate interest |
We do not ask for a date of birth and we do not use your data for automated decisions about you.
3. Children
Students on Necudah may be under 14, which is the age at which a child can consent on their own in Spain (the rule is different in other countries). Students only join through a school or teacher who invites them. The school or teacher is responsible for getting the consent of a parent or guardian where the law requires it; they confirm this when they accept our School Data Agreement. We use students’ data only to run their school on Necudah: no advertising, no profiling, no selling. A parent or guardian may contact the school or us at hello@necudah.com to see or delete a child’s data.
4. Who else receives data
We use a small number of outside services. Each one gets only what it needs.
Services that our server sends data to:
| Service | What it receives | When |
|---|---|---|
| Hostinger (France) | everything, because it hosts our server and sends our email | always |
| Anthropic (Claude, USA) | a teacher’s AI instructions, lesson content and uploaded reference files; Help assistant questions, with the user’s role, page and language | when someone uses an AI feature or the Help assistant |
| OpenAI (USA) | lesson text to be read aloud (narration); the same as Anthropic for schools that choose OpenAI; picture requests | when narration or pictures are created, or a school uses OpenAI |
| Google (Gemini, USA) | the same as Anthropic | only for a school that chooses Gemini |
| Google (Drive) | our nightly backup copy | every night |
| Cloudflare (USA) | your IP address, to check you are not a bot | on sign-up forms |
We do not send names or email addresses to the AI services as part of a request. Please do not type students’ personal details into AI requests or Help questions.
Services your browser connects to directly (they see your IP address and browser details):
- DiceBear, for generated profile pictures;
- Cloudflare, for the bot check on sign-up forms;
- YouTube (privacy-enhanced mode) and Vimeo (do-not-track), only on pages where a teacher has embedded a video, and Google Drive when a teacher embeds a Drive file;
- jsDelivr, only on pages that show a diagram;
- Wikimedia, when you play a pronunciation in the dictionary.
Transfers outside the European Union. Some of these services are in the USA. Where they are, the transfer relies on the safeguards the law provides, such as the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses in the provider’s terms.
We give data to the police or courts only when the law obliges us to.
5. How long we keep it
| Data | How long |
|---|---|
| Your account and a school’s content and learning records | while the account or school exists; deleted within 30 days of a request or of the school leaving Necudah |
| Sign-in attempt records (IP, username) | 7 days |
| Copies of emails we send | 7 days (30 days if sending failed) |
| Notifications | 90 days once read, 180 days if unread |
| “Page not found” records | 30 days after the last visit to that address |
| Files uploaded as AI reference material | 30 days |
| AI requests being processed | 1 day after they finish |
| Help assistant conversations | 30 days. Questions it could not answer are kept 90 days, without who asked, so we can write the missing help page |
| AI usage and cost records | while the school exists |
| Backups | 30 days |
6. Your rights
You may ask us to:
- see the data we hold about you, and get a copy;
- correct it if it is wrong (you can change most of it yourself on your profile page);
- delete it;
- send it to you in a common format so you can take it elsewhere;
- limit what we do with it, or object to how we use it.
How: email hello@necudah.com from the address on your account (or say which school and account you mean). During the beta we handle requests by hand and answer within 30 days. We may ask you to confirm it is really you. If the data belongs to a school (for example a student’s grades), we will involve the school.
You can also complain to a data-protection authority. In Spain that is the Agencia Española de Protección de Datos (www.aepd.es); if you live elsewhere in the EU, you can go to your own country’s authority.
7. Security
The site uses encrypted connections (HTTPS). Passwords are stored scrambled. Sign-in is protected against password guessing. Each school’s data is kept separate from other schools’. Only the platform operator can reach the server and backups. If a security problem puts your data at risk, we will tell the people and schools affected and, where the law requires, the authority.
8. Cookies
Necudah uses only the cookies it needs to work: one that keeps you signed in, and one that remembers your language. Your browser also keeps some settings on your device, such as dark mode, and a backup of a quiz while you are taking it. We use no advertising or tracking cookies and no analytics. Because these cookies are needed for the site to work, we do not ask for consent to them.
9. Changes
If we change this policy in a way that matters, we will tell you by email or in Necudah before the change applies. The date at the top shows the latest version.