Privacy policy

Version 1.0 (free launch) — 2026-11-15

Summary

• We process the data needed for teachers to create, assign and grade worksheets and for students to complete them. We do not sell data, show ads or use anyone's content to train AI models.
• We are the controller of teacher account data. Student data in classes we process on behalf of the school, or of the teacher who uses AI Worksheets with their class.
• AI (Google Gemini) helps build worksheets and check written answers. The teacher can turn it off for any assignment, and always reviews and can change AI scores and feedback.
• You can delete your account from your profile and exercise your rights by writing to privacy@aiworksheets.online.

1. Who is the controller

The controller of the personal data described in this policy, except in the cases of section 2, is Cristian Matias Christensen, a private individual in Spain, NIF Y5486077Q, Passeig dels Platans 6-0, 43205 Reus (Tarragona). Privacy contact: privacy@aiworksheets.online.

We have not appointed a data protection officer because our activity is not one of the cases where the law requires one (article 37 of the General Data Protection Regulation, GDPR, and article 34 of Spanish Organic Law 3/2018, LOPDGDD). For any privacy question, write to privacy@aiworksheets.online.

2. Scope, and who decides about student data

This policy covers AI Worksheets: aiworksheets.online, app.aiworksheets.online and api.aiworksheets.online. It explains what we collect, why, on which legal basis, who processes it, how long we keep it and how to exercise your rights.

Student data in classes. When a teacher uses AI Worksheets with students, the school (or the teacher themselves when teaching on their own, for example at a private academy or as a tutor) decides which student work is collected and why; it is the controller of that data. We process it on its behalf, following its instructions and the data processing terms in annex 2 of our terms of service. This covers student accounts the teacher creates, class membership, answers, grades and feedback. Students, and their parents or guardians, can contact the school or teacher to exercise their rights over that data; if they write to us, we pass the request on and help answer it. The school or teacher is responsible for its students' data: for deciding to use AI Worksheets with them, informing the families and obtaining any permission the law requires. We act only on its instructions.

We are the controller of teacher account data, the public library, AI cost records and usage analytics not linked to an account. Security records, error reports, logs and backups that contain student data are part of running the service for the school or teacher (annex 2 of the terms), not a purpose of our own.

3. Information we collect

• Account information: email address, name and role (teacher, student or admin). Teachers can also create student accounts with a name, username and password (or a code), with no student email. A teacher may add a parent or guardian email to a student account.
• Profile: optionally a short bio and a profile picture. Profile pictures are stored so that anyone with their link can view them.
• Terms acceptance: which version of the terms of service each teacher accepted, and when.
• Age statement: when a student creates their own account, their statement that they are 14 or older or have permission from a parent, guardian or their teacher, and when they made it. Student accounts a teacher creates have none.
• Worksheets and files: the worksheets you create and the PDFs, images and audio files you upload.
• Student work: the answers students submit, plus grades and feedback, including those the AI proposes (section 6).
• Classes and assignments: class rosters, assignment settings and grade records.
• Full classes: when a student's attempt to join a class was refused because the class was full under the teacher's plan, and when the teacher dismissed that notice. We do not record who the student was.
• Plan usage: how much of each Free plan limit you have used (pages turned into worksheets, worksheets made by hand, images and audio generated, AI grading and feedback, AI explanations, classes and students, library worksheets taken), to apply the limits and show you a meter. We use your account's creation date to work out your month. Our admins can see who is near a limit.
• Public library (teachers): which library worksheets you took (copied, assigned or downloaded), when and how it was counted (your monthly allowance or an earned credit); the record of library credits you earned and spent; when you confirmed you had the right to share a worksheet you made public; for a copy, which library worksheet it came from; and, if you choose, the name shown on your public worksheets (optional; without it your worksheets show no name). Other teachers see how many teachers took each public worksheet ("used by N teachers"), not who.
• Reports and moderation: reports about public worksheets or library names (who reports, what and why) and our decisions (what we did, the reason and the explanation we give the author).
• Notices sent with the report form (anyone, with or without an account): the sender's name and email address; the address, title or author of the content; the reason, the explanation and the good-faith statement; the language to answer in; and our decision, with when we confirmed receipt and when we told the sender. The notice is not linked to any account, even if the sender is signed in. Only our admins see it, to decide and to answer by email.
• Usage analytics: events about how exercises are used. Each event is stored with a shortened network address (only the first three parts of the IP address) and without the browser type. We keep per-question totals (for example the most common wrong answers) with no IP address and not linked to any account. Our application logs note each event only by account id and event name.
• AI usage records: who ran an AI task, the file name and which AI model was used, to track cost and quality.
• Logs and error reports: our logs identify users by account id, not by email.
• Web server log: a shortened IP address (the last part removed), the time, the page or API address requested (without query parameters or class join codes), the response status and size, how long it took and the host name. It records no browser or device details and no referring page. If a request fails at the server, the error record can include the full IP address.

We do not ask for or want special categories of data (health, religion and similar). We ask teachers not to put more student data into worksheets, prompts or uploads than the task needs.

4. Google Classroom

Google Classroom is optional. When a teacher connects it, we ask for one fixed set of Google permissions. We use them to:

• List the courses the teacher can pick from.
• Import course rosters: student names, Google user IDs and email addresses.
• Create coursework in the courses the teacher picks.
• Post grades back to Google Classroom.

We encrypt the Google access and refresh tokens (AES-256-GCM) before storing them. All Google calls are made from our servers, and the tokens never reach the browser.

We do not sell Google user data or use it for advertising. We do not use it to train AI models, and Google Classroom data is not sent to AI providers.

Teachers can disconnect Google Classroom in the app at any time. We then ask Google to revoke our access and permanently delete the tokens we stored, even if Google can't be reached. Grades not yet sent stop, and are sent only if the teacher reconnects and retries them. Imported classes, links to shared coursework and grades already sent stay as history.

You can also revoke access in your Google Account settings, or email privacy@aiworksheets.online and we will delete the stored tokens.

Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Why we use data, and the legal basis

Where we rely on legitimate interest, you can object (section 15). We do not sell data or use it for advertising, and we never send marketing to students.

6. AI and student work

AI Worksheets uses Google's Gemini models to build worksheets from documents and prompts, create images and audio, check students' written answers and propose grades and feedback. With student work it works like this:

• The teacher's switch. Each assignment has a main AI switch, on by default. When the teacher turns it off, nothing from that assignment is sent to Google: the teacher marks the answers. When it is on, the answer check is on by default and grade drafts and feedback are off until the teacher turns them on.
• AI answer check. Unless the teacher turns it off, when a student submits, the AI reviews short and open answers that do not match the teacher's answer key and proposes a score and a short comment.
• AI grade drafts. If the teacher turns it on, the AI writes a draft grade.
• AI feedback. If the teacher turns it on, the AI writes feedback for each submission.
• The teacher releases them. AI scores, drafts and feedback reach the student only after the teacher reviews and releases them, always; there is no setting that shows them to students unreviewed.

The teacher can review and change any AI score or comment, and decides the grades. AI Worksheets makes no decisions based solely on automated processing that produce legal effects on a student or similarly significantly affect them (article 22 GDPR): AI scores help the teacher, and we ask teachers not to use them as the only basis for important decisions. If you are a student and think the AI got it wrong, tell your teacher.

Google processes this content as our processor. Under its terms for our paid account it does not use it to train or improve its products, and keeps it only for a limited time to detect abuse and meet legal obligations.

7. Who processes your data

We share data only with the providers that run the service. Most process it only on our behalf (processors), under a contract that obliges them to protect it. YouTube and Vimeo (videos you choose to play) also use data for their own purposes, under their own policies.

• Hosting and email: Arsys (Arsys Internet S.L.U.), which runs our servers in Spain and holds the email you send to our support, privacy and notices addresses.
• Supabase: database, sign-in and file storage.
• Cloudflare (Turnstile): checks that sign-up, sign-in and password reset are done by a person, not an automated program. For that it receives your IP address and details of your browser (TLS fingerprint and user agent) on our behalf; it also uses them as an independent controller to improve its bot detection (Turnstile privacy addendum).
• Resend: sends account emails (sign-up confirmation and password reset) for us, from Ireland; it keeps the email records in the United States.
• Google (Gemini API): receives uploaded documents to build worksheets and, where needed, students' written answers for AI checking and feedback; creates images and the audio of listening exercises (section 6).

• Sentry: receives error reports and a sample of page-load timings. We send no personal data by default and scrub the reports.
• Embedded videos: YouTube (Google) and Vimeo. Teachers can attach YouTube or Vimeo videos to a worksheet. Nothing is loaded from YouTube or Vimeo until you press "Play" on a video. Then your browser connects to them; they receive your IP address and browser details and may store data on your device, as independent controllers under their own policies (Google, Vimeo). We use the most private mode each offers: YouTube's privacy-enhanced mode (youtube-nocookie.com) and Vimeo with "do not track" on.

We may also disclose data when the law requires it (for example to courts, tax authorities or authorities that request it) or to protect the security of users and the service.

8. International transfers

Our servers are in Spain. Some providers process data outside the European Economic Area or belong to companies outside it. In those cases we rely on an adequacy decision of the European Commission (the one for the United Kingdom, or the EU-U.S. Data Privacy Framework for certified companies) or on the standard contractual clauses approved by the European Commission:

• Supabase: the database is hosted in London (United Kingdom, covered by an adequacy decision); Supabase uses the standard contractual clauses.
• Cloudflare, Google, Sentry, Resend, Vimeo: companies in the United States or that may process data from there; they rely on the EU-U.S. Data Privacy Framework and the standard contractual clauses in their data processing agreements.

You can ask us for more information about these safeguards, or a copy, at privacy@aiworksheets.online.

9. Security

We encrypt Google tokens, check access on every request, limit what logs keep and scrub error reports. If a security breach affects personal data, we will notify the supervisory authority and, where the law requires, the people affected; if it affects student data, we will tell the responsible school or teacher without delay. No system is completely secure.

10. Deleting your account

You can delete your account from your profile: choose "Delete account", then type the word it asks for. The account is deleted straight away and this can't be undone. To protect you, you must have signed in during the last 10 minutes; if not, we ask you to sign in again first.

A student account that a teacher created is deleted by that teacher, from the class. Students with such an account ask their teacher.

What is deleted:

• Teachers: your worksheets, workbooks, classes and assignments, with your students' work on those assignments. Student accounts you created are deleted too, unless another teacher also has the student in a class. Public worksheets other teachers use are not lost: each of those teachers first gets their own private copy, so their assignments keep working. Copies other teachers already took from the library stay in their accounts, and their records of taking them stay with them, no longer linked to you.
• Students: your answers and results, and your place in your classes.
• Every account: your profile (including your public library name), the files you uploaded, your plan, your usage history, your library takes and credits and, if you connected it, your Google Classroom connection (we ask Google to revoke our access and delete the tokens). Library credits cannot be transferred or cashed.

What is kept:

• Blocked, to answer possible claims (article 32 LOPDGDD): the version of the terms you accepted and when, with your account id and email. It can be used only to deal with claims or requests from courts and authorities, and is deleted 5 years after the account is deleted.
• Records of AI usage, without your account id or file names; the log of admin and moderation actions, with account ids but no names or emails; usage analytics, not linked to any account; and server logs and AI response logs, until they are deleted on their schedule (section 11).

If a deletion stops partway, try again: anything already deleted stays deleted, and trying again finishes the job. If you can't, write to privacy@aiworksheets.online.

11. How long we keep data

• Accounts and their content: until the account is deleted (section 10).
• Worksheets: a worksheet that has assignments cannot be deleted. Assignments: an assignment with student work is archived and deleted permanently only if the teacher confirms.
• Grade-sync records: deleted together with their assignment.
• Google tokens: until the teacher disconnects Google Classroom, asks us to delete them or the account is deleted.
• Record of the terms version you accepted: while the account exists; then blocked for 5 years (section 10).
• Plan usage records: 13 months; limits need only the current month, and the rest lets us answer questions about usage.
• Library takes and credits: while the account exists, because each worksheet costs you only once.
• Rights confirmation of a public worksheet: with the worksheet; deleted with it.
• Reports and moderation decisions: while the content or account concerned exists and at most 5 years from the decision. When a worksheet is removed from the library, the removal itself (its date and reason) stays while the worksheet exists, because it keeps the worksheet out of the library; its explanation is deleted after those 5 years.
• Notices sent with the report form: 5 years from the decision; a notice not yet decided is kept until it is decided. It is kept when the content it names is deleted.
• Log of admin and moderation actions: 5 years.
• AI usage records (who ran an AI task, the model and the cost): 13 months.
• AI response logs (the AI's raw answer when a worksheet is made from a file, kept to investigate errors; without a copy of the file): 30 days.
• Full-class notice: only the latest date, stored with the class.
• Usage analytics events: 90 days after we receive them. Per-question totals, with no IP address and not linked to any account, are kept.
• Web server logs: 14 days.
• Application logs on our servers (errors and events, by account id): 14 days.
• Sign-in sessions (the IP address and browser of each device where you are signed in): until you sign out, the account is deleted, or the session has not been used for 90 days. Signing out ends all your sessions.
• Sign-in and request records at Supabase, with IP addresses: at most 7 days.
• Error reports (Sentry): at most 90 days.
• Backups of the database: encrypted, made daily and deleted after at most 30 days. Data you delete from the service stays in the backups until they are deleted.
• Messages to support and privacy: 1 year after the matter is closed; messages about a rights request, 3 years; about a complaint, 5 years, to answer possible claims.

12. Children and education data

AI Worksheets is made for schools, teachers and students, and many students are minors. Students join a class with a code from their teacher, with an account the teacher creates or one of their own.

• In Spain, only people aged 14 or over can consent to the processing of their data themselves (article 7 LOPDGDD). Students under 14 should use AI Worksheets only with an account their teacher created or with the permission of a parent or guardian.
• The school or teacher responsible for the class informs families and obtains any permission the law requires.
• Students never see ads and receive no marketing. If a class is full under the teacher's plan, the student is told to speak to their teacher.
• Students do not publish to the library and their work is not visible to other teachers.
• Schools and teachers can ask us at privacy@aiworksheets.online for a summary of our data protection impact assessment, to help with their own.
• Parents and guardians: the school or teacher is responsible for their children's data in AI Worksheets, so requests about it go to them. If they write to us, we pass the request on and help answer it (section 15).

13. Notifications

We send no assignment emails; assignment reminders appear inside the app. The emails you may receive are account emails, sent for us by Resend (sign-up confirmation and password reset); and, for teachers, notices about important changes to the service or these policies, or about a moderation decision that affects their account (its suspension or closure). Decisions about a worksheet or a library name are explained in the app.

14. Cookies

We use one language cookie and browser storage only for what is necessary and to remember your choices. Details are in our cookie policy.

15. Your rights

You can ask us to access, correct or delete your personal data, restrict or object to its processing, and receive the data you gave us in a structured, commonly used format (portability). Where we use data because you chose it (such as your public library name), you can withdraw that choice at any time, without affecting what was done before. Write to privacy@aiworksheets.online; we may ask you to confirm your identity. It is free.

If you are a student and we process your data on behalf of your school or teacher (section 2), you can contact them; if you write to us, we pass it on and help them answer.

If you think we have not handled your data lawfully, you can complain to the Spanish Data Protection Agency (aepd.es) or the data protection authority of the country where you live.

16. Changes to this policy

When we make important changes, we will email teachers and show a notice in the app before they apply. Students with username accounts have no email, so they will see the notice in the app. Each version shows its number and date.

17. Contact

Questions, or a request about your data? Write to privacy@aiworksheets.online. We reply within one month. If the request is complex or we receive many, we may need up to two more months, and we will tell you why within the first month.