Wedapt Privacy Policy

Effective: 3 October 2026 · Version 2.3

Plain-Language Summary for Parents

What we collect, in plain terms: your child's nickname and school email so they can log in; what they learn and how they progress so the AI tutor can adapt; basic technical information like browser type and IP address for security; and how they use the platform — including recordings of how they move through the screens (session replay) — so we can improve it. If your child chooses to, they can also photograph a task or worksheet or dictate a question by voice so the AI tutor can help; both are optional. We do not ask students for home addresses, phone numbers, payment details, photos of themselves, or sensitive information such as health, religion, or political views — and our rules forbid students from typing such information into the platform.

1. Data Controller

Wedapt UG (haftungsbeschränkt)
c/o Mohamed Abdelmetaal, Bundesallee 75, 12161 Berlin, Deutschland
Geschäftsführer: Mohamed Abdelmetaal
Handelsregister: Amtsgericht Charlottenburg, HRB 291388 B
Email: contact@wedapt.ai

Wedapt is a platform provided to students exclusively through their schools. The school is the data controller for student records. Where Wedapt processes personal data on behalf of a school, Wedapt acts as a data processor under Article 28 GDPR.

A Data Processing Agreement (Auftragsverarbeitungsvertrag / AVV) is executed with every school before any user account is created. The DPA covers our security measures, sub-processor list, breach notification timeline, audit rights, and data-deletion obligations. Schools may request a copy at contact@wedapt.ai.

Data Protection Officer (DPO): Given that Wedapt processes personal data of children at scale, we are evaluating whether a formal DPO appointment is required under Article 37 GDPR. Pending that determination, all data-protection queries should be directed to contact@wedapt.ai.

2. What Data We Collect

We may collect and process the following personal data:

• Identity Data: Nickname, school email address, and (for age-verification purposes) age range.
• Educational Data: Learning preferences, skill validation scores, tutoring session history, AI-generated feedback.
• Technical Data: IP address, device type, browser type, operating system.
• Usage Data: Interactions with our platform (e.g., lesson completion, time spent, feature usage), recorded with our product-analytics provider Mixpanel (see Section 6) on the website and in the mobile app. This includes interaction events such as page views, clicks, scrolling and form submissions (without the text typed into input fields). Sessions of students and teachers may also be recorded as a session replay — a reconstruction of the screens shown during a visit, used to find usability problems and errors — in which the content of all input fields and the user's name and email address are masked. A recording ends after 5 minutes of inactivity and lasts at most 30 minutes. Analytics data is linked to a pseudonymous user ID and a device identifier (never the name or email address), together with the school ID, role, grade level and language setting (for teachers, also the school name and the grade levels they teach); as with any web request, Mixpanel also receives the device's IP address. Usage data is only collected after you have agreed in the analytics consent banner (see Section 11); chat messages and chat titles are always masked in session replays.
• Uploaded Images and Documents (optional): Photos of a task, worksheet or homework, or PDF documents, that a user chooses to attach in the AI tutor chat — taken with the device camera or selected from the device. They are used solely so the AI tutor can understand and help with the task: the file is stored in our EU storage (Supabase, Frankfurt), is not publicly accessible, and is sent to Google Vertex AI to generate the response. Please photograph only the task itself — not people, faces, or names.
• Voice Input (optional): When a user taps the microphone to dictate instead of typing, the audio recording is sent to our servers and transcribed into text by Google Cloud Speech-to-Text. The audio is used only to produce the transcript and is not stored by Wedapt: it is processed in memory, and longer recordings are placed in a temporary file that is deleted as soon as transcription is complete. The resulting text appears in the input field, where the user can review it before sending. Microphone access is requested only when the feature is used.
• Profile Picture (optional): An image a user may choose to upload as the picture for their account. It is not required to use the platform.
• Cookies and Tracking Data: Via cookies and similar technologies (see our Cookie Policy).
• Teacher Co-pilot Data: When using the Teacher Co-pilot feature, we additionally collect: conversation threads and messages with the AI assistant; AI-generated materials created through the Co-pilot (lesson plans, worksheets, assessments, rubrics); contextual metadata associated with each conversation (which class, subject, or student overview was active at the time); logs of web searches and URL fetches the AI performed on the teacher's behalf; and curriculum customisations the teacher applies to topics or learning areas.

3. Legal Basis for Processing

We process personal data based on the following legal grounds under GDPR:

• Contractual Necessity (Art. 6(1)(b) GDPR): To deliver the educational services agreed with the school.
• Consent (Art. 6(1)(a) GDPR): For product analytics (Mixpanel, and Google Analytics on the website), which only start after the user agrees in the analytics consent banner on their device, and for other non-essential features where consent is required.
• Legal Obligation (Art. 6(1)(c) GDPR): For compliance with child-protection laws, tax obligations, and other statutory requirements.
• Legitimate Interests (Art. 6(1)(f) GDPR): For platform security and fraud prevention, where those interests are not overridden by users' rights.

4. Children and Parental Consent

Wedapt is provided to students only through their school. Before any student under 16 can access the platform, the school obtains a signed parental or guardian consent form in accordance with Article 8 GDPR and applicable German state school law (e.g., § 64a Berlin Schulgesetz). The school is the data controller for student records and retains the consent documentation.

Parents may request to view or withdraw consent at any time through their school. Wedapt provides schools with a recommended consent-form template to ensure the consent collected includes the date of signature, identity of the parent or guardian, scope of permitted processing, and instructions on how to withdraw consent.

Users aged 16 and 17 may consent on their own behalf under German law. The school's Master Agreement governs the contractual relationship at the institutional level.

5. How We Use Your Data

We use personal data to:

• Deliver and personalize learning paths and AI tutoring support.
• Improve the platform through pseudonymous usage analytics — only where you have consented.
• Respond to support queries and feedback.
• Communicate service updates (with consent where required).
• Fulfill legal and contractual obligations.

We do not sell personal data. We share it only with the sub-processors listed in Section 6 and with schools as part of the agreed service delivery.

6. Data Storage, Hosting, and Sub-processors

All personal data processed through Wedapt is hosted within the European Union, primarily in data centers located in Germany (Frankfurt am Main), and is processed in accordance with GDPR and the German Federal Data Protection Act (BDSG).

We rely on the following sub-processors:

Apart from Google Analytics on the website (only with your consent), no personal data is transferred outside the EEA in the normal course of operation.

Access to personal data is strictly limited to authorized personnel. Servers are encrypted at rest and in transit.

7. Data Retention

We retain personal data only as long as necessary for the stated purpose or as required by law:

After the applicable period, data is securely deleted or irreversibly anonymized.

8. AI Processing and Automated Decision-Making

Wedapt uses artificial intelligence (Google Vertex AI) to generate tutoring content, feedback, and learning recommendations.

• AI is used to generate responses and adapt learning paths — it does not make fully automated decisions with legal or similarly significant effects on students (Article 22 GDPR).
• Teachers retain full human oversight of any AI-generated assessment or grading output.
• Students should not rely on AI answers as the sole basis for graded work without teacher review.
• AI outputs may contain errors or inaccuracies. Wedapt makes no warranty as to their accuracy.

Important rule for users: Do not type personal information — such as full names, addresses, phone numbers, ID numbers, or health information — into the AI chat or any input box. The AI tutor does not need this information to help you learn. See our Terms of Use for the full rule.

Teacher Co-pilot and Student Data: When teachers use the Teacher Co-pilot, the AI assistant may retrieve student progress data (class overviews, individual topic completion rates, focus area status) at the teacher's instruction. This retrieval is scoped strictly to the teacher's own assigned classes and subjects. Student data processed in this way is sent to Google Vertex AI solely to generate the teacher's response; it is not used by Google to train AI models and is not retained by Google beyond the scope of service delivery. The teacher remains responsible for all decisions made on the basis of Co-pilot outputs — no grading or disciplinary decision is made automatically.

In accordance with the EU AI Act (progressive enforcement from August 2026), Wedapt discloses that its AI tutoring system is used in an educational context. The system is designed to support, not replace, teacher judgment. Users always have the right to request human review of any AI-generated recommendation or assessment outcome.

9. Your Data Protection Rights

Under GDPR, you (or your parent/guardian if you are under 16) have the right to:

• Access the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure ("right to be forgotten") — request deletion where legally permissible.
• Restriction — request that we limit processing in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise these rights, contact us at contact@wedapt.ai. We will respond within 30 days. Students and parents should also contact their school, which holds the primary data-controller role for student records.

Users in Türkiye additionally have the rights set out in Section 14.

10. Data Breaches

In the event of a personal data breach affecting school users, we will notify the affected school(s) within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR. We will provide details of the nature of the breach, categories of data affected, likely consequences, and measures taken or proposed to address it.

11. Cookies and Tracking Technologies

We use cookies to support essential functionality and, with consent, to analyze platform usage. See our Cookie Policy for the full list of cookies, their purposes, durations, and how to manage or withdraw consent.

For product analytics, the website and the mobile app also use the Mixpanel software development kit, which stores a pseudonymous device identifier and analytics settings in the browser's or app's local storage (not in a cookie). This is how the usage events and session replays described in Section 2 are collected. Nothing is stored or sent for analytics before you agree in the analytics consent banner. You can change your choice at any time — on the website under "Cookie Settings", in the app under Profile > Privacy.

12. Links to External Websites

Our platform may include links to third-party websites. This Privacy Policy applies only to Wedapt. We encourage you to review third-party privacy practices separately.

13. Complaints and Supervisory Authority

If you believe your rights under GDPR have been violated, you have the right to lodge a complaint with a supervisory authority.

Primary authority for Wedapt (Berlin-based controller): Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) Alt-Moabit 59–61, 10555 Berlin www.datenschutz-berlin.de

Federal alternative: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) www.bfdi.bund.de

Users in Türkiye: Kişisel Verileri Koruma Kurumu (KVKK) — Turkish Personal Data Protection Authority www.kvkk.gov.tr See Section 14 for details.

14. Users in Türkiye (KVKK)

Where Wedapt is used by schools in Türkiye, the processing of personal data is additionally governed by Law No. 6698 on the Protection of Personal Data (Kişisel Verilerin Korunması Kanunu, "KVKK").

• Roles: The school is the data controller (veri sorumlusu). Wedapt acts as the data processor (veri işleyen) and processes personal data only on the school's behalf and in accordance with its instructions. Where processing requires explicit consent (açık rıza) under Article 5 KVKK — for example from a parent or legal guardian — the school obtains it.
• Your rights under Article 11 KVKK: You have the right to (a) learn whether your personal data is processed; (b) request information about the processing; (c) learn the purpose of the processing and whether the data is used in line with that purpose; (d) know the third parties in Türkiye or abroad to whom your data is transferred; (e) request rectification of incomplete or inaccurate data; (f) request erasure or destruction of your data under the conditions of Article 7 KVKK; (g) request that rectification, erasure or destruction be notified to third parties to whom the data was transferred; (h) object to a result to your detriment arising from analysis of your data exclusively through automated systems; and (i) claim compensation for damage arising from unlawful processing.
• How to exercise your rights: As the data controller, your school is your first point of contact. You may also write to contact@wedapt.ai; we will forward your request to your school and support it in responding. Under Article 13 KVKK, requests are answered as quickly as possible and at the latest within 30 days, in principle free of charge.
• Transfer abroad: Wedapt's systems are hosted in the European Union (see Section 6), so personal data of users in Türkiye is transferred abroad. These transfers are based on Article 9 KVKK (as amended by Law No. 7499 of 2024). Before a school in Türkiye begins using Wedapt, the standard contracts announced by the Personal Data Protection Board are concluded with the school and notified to the Personal Data Protection Authority within five business days of signature. The recipients are the sub-processors listed in Section 6.
• Complaints: If your application is rejected, the answer is unsatisfactory, or no answer is given in time, you may lodge a complaint with the Personal Data Protection Board (Article 14 KVKK) via the Kişisel Verileri Koruma Kurumu, www.kvkk.gov.tr.

15. Changes to This Policy

We may update this Privacy Policy periodically. All changes will be posted here with an updated effective date. Significant changes will be communicated to schools in advance via email or platform notification.

Questions? Email us at contact@wedapt.ai.