Who We Are Welcome to Socolai (socolai.com). We are an AI tutoring web app designed to help students learn maths, chemistry, biology, and physics. Petaminds, operating as a sole trader, operates Socolai from New Zealand.
The Data We Collect We only collect what we need to run the app:
- From Parents (Early Access): Your email address, an optional note about what you need help with, and the age group of your child. The early-access form does not ask for your child’s name or exact birthdate. We keep early-access emails for 12 months, then delete them.
- From Parents (Pilot Consent Form): Your name, your email address, your child’s first name, the version of the consent form you saw, and the time you agreed. We use these only to record your consent, to contact you about your child’s access, and to handle a withdrawal request. We never put them in the tutoring app or send them to the AI provider.
- From Students (In the App): Photos of homework problems, typed questions, chat transcripts with our AI tutor, a first-name label to identify the session, results from follow-up practice problems, and optional student feedback comments (up to 500 characters). Each student signs in using an individual access code; no student emails or passwords are collected or stored.
How We Use and Store Your Data We use this data only to provide the tutoring service and improve the app.
- Photos and Chat Transcripts: We keep these as part of the student's learning history so they can review past problems and solutions. When a geometry figure or other drawing cannot be reproduced faithfully, we keep the original homework photos in private storage so the student can reopen the problem. These photos are removed after 30 days. Other homework photos are not stored once they have been sent for reading. A handwritten answer we can read is kept as text only. Handwriting we cannot read, and any photos stored before this change, are kept as pictures and removed 30 days after they are uploaded. Photos are still sent to our AI provider so it can read them. Chat transcripts are kept until you or your child ask us to delete them, or until 12 months after the last activity on that problem, whichever comes first.
- Feedback and Student Labels: Optional feedback comments are deleted together with the problem session they belong to. A student's first-name label is kept until you ask us to delete the student's data.
- Parent Consent Records: We keep a consent record while the student uses Socolai. We delete it 12 months after we confirm a withdrawal, or 12 months after it was submitted if it was never linked to a student.
- Abuse Prevention & Rate Limiting: To stop spam and abuse on our public forms (early access, parent consent and withdrawal) and in tutoring sessions, we use temporary rate-limit records and a one-way scrambled (hashed) version of your network address to limit repeat submissions. Our database never stores raw IP addresses, and rate-limit records and scrambled values are deleted after 24 hours. Our hosting provider may keep standard server logs.
Who We Share Data With (Our Processors) We do not sell your data. We use secure external services to make Socolai work:
- AI Technology Partners: We securely send text and images to an external AI provider to generate the tutoring responses. Under our AI provider's terms, API data is not used to train their AI models. The AI provider temporarily holds data for up to 30 days solely for abuse-monitoring logs (the Agents API is not Zero Data Retention eligible), but Socolai saves your chat history in our own database until you ask us to delete it, or until 12 months after the last activity on that problem, whichever comes first.
- Secure Cloud Storage: We store our database, chat transcripts, and photos on secure servers provided by a third-party cloud host, located in Singapore.
- Error Monitoring (Sentry): We use Sentry (hosted in the EU region) to catch and fix technical crashes. Sentry receives error names, error codes, and internal session and student identifiers (random IDs, not names) only, with no student chat content, homework images, or personal details.
- Web Hosting and Measurement: We use a web hosting provider that helps our site load quickly and tells us basic, anonymous information about how many people visit the site.
- Donation Provider: We use an external payment service for voluntary donations. We do not process or store your payment details.
International Transfers Because our providers operate globally, your data will be transferred to and processed outside of your home country, primarily in the United States (AI processing and web hosting), Singapore (database and media storage), and the European Union (error monitoring). By using Socolai, you agree to this transfer.
Regional Rights
- New Zealand (Privacy Act 2020) & Australia (Privacy Act 1988): You have the right to ask for a copy of your personal information and to have it corrected. We take reasonable steps to ensure our overseas cloud providers protect your data.
- United States (COPPA & State Laws): We do not knowingly collect personal data from children under 13 without verifiable parental consent. Parents give consent for their child through our online consent form before a child is given an access code, and we confirm each consent with the parent ourselves. Parents control the early-access sign-up.
- European Union & UK (GDPR): Our legal basis for processing is your consent and the performance of our service. You have the right to access, delete, restrict, and export your data. If you wish to know the specific names of our cloud and AI providers, you can request this by emailing us.
- Vietnam (Decree 13/2023/ND-CP & Personal Data Protection Law): You have the right to know how your data is processed, request deletion, and withdraw consent. Data transfers outside Vietnam are conducted strictly to provide the core tutoring service you requested.
Child-Friendly Privacy Notice
How Socolai Protects Your Information
- What we know: We see the homework photos you upload and the chats you have with the AI tutor. We also know your first name, so we can tell students apart, but not your last name or birthday.
- Why we need it: To help you learn and answer your questions.
- Who we share it with: Only the computer systems that run the app (like the AI that powers the tutor). We never sell your information to anyone.
- How long we keep it: We do not keep your homework photos once they have been read. If we cannot read your handwriting, we keep that picture for up to 30 days, then delete it. We keep your chats so you can look back at your past work, until you or your parents ask us to delete them, or until 12 months after you last used that problem.
- Your rights: You or your parents can ask us to delete your chats and information at any time.
Cookies and measurement
No Tracking Cookies Socolai respects your privacy. We do not use third-party tracking cookies, marketing cookies, or advertising pixels.
We only use cookieless, anonymous measurement tools to see how fast our pages load and how many people visit the site. The student sign-in uses one strictly necessary cookie that remembers you entered the access code. It is not used for tracking. Because we do not store personal data on your device for tracking purposes, you will not see a cookie consent banner on Socolai.
Your data rights
Access, Correction, and Deletion Requests If you want to view, fix, or delete your data (or your child's data), email us at support@socolai.com.
- Parents can withdraw consent, and ask for their child’s data to be deleted, with the withdraw form on our website or by email. We confirm every request with the parent by email before we act on it.
- Deletion is by request for now; there is no self-service button inside the app yet.
- We will reply within 14 days.
- If you ask for deletion, we will wipe your email, chat transcripts, and photos from our database within 30 days. The one exception is your consent record (your name, email and your child’s first name), which we keep for 12 months after we confirm a withdrawal as proof of what you agreed to, and then delete.
Data Breach Process If our systems are compromised and personal data is exposed:
- We will close the vulnerability and secure the app immediately.
- We will notify affected parents via email as soon as practicable (we aim for within 72 hours), explaining what data was exposed and what steps we are taking.
- We will notify the relevant privacy authorities (e.g., the New Zealand Privacy Commissioner) if the breach poses a risk of serious harm.