This policy explains how your personal data is processed when you use the AliceAI Learning mobile app (the ”app”). The app is used with a licence obtained by an organisation, such as your employer.
1. Who is responsible for your data
The controller is the organisation that obtained access to the app and gave you a licence code (usually your employer). The organisation decides to whom the app is provided and for what purpose.
AliceAI Learning Oy provides the app and processes your personal data on behalf of your organisation and in accordance with its instructions (processor). The processing is governed by an agreement between your organisation and AliceAI Learning Oy.
AliceAI Learning Oy
Business ID: 3452208-5
Pikonvirrantie 9, 79100 Leppävirta, Finland
Email: support@aliceai.io
You can obtain your organisation’s contact details and its own privacy notice from your organisation.
2. What data is processed
Data you provide:
- email address and password (the password is stored only in encrypted form in the authentication service; we cannot see it)
- the name or nickname you enter when registering
- the licence code you register with
Data generated when you use the app:
- learning progress: completed topics and sessions, exercise answer statistics, placement test answers and self-assessment
- study time, study days, points and study streak
- an internal user identifier
Data obtained through the licence:
- the organisation the licence belongs to, and the licence validity period
Technical data:
- IP address and app installation identifier, processed by service providers in connection with sign-in, security and crash reporting
- crash reports and related device and operating system information (these are not linked to your name or email address)
- a device integrity attestation used to check that requests come from the genuine app
Mandatory data: an email address, password, name or nickname and licence code are required to create an account. Without them the app cannot be used. A nickname is sufficient as the name.
Not processed: location, your device’s address book, your photos or photo library, health data or payment data. Recordings made in pronunciation exercises are stored only on your device and are not transferred to the service. The app contains no advertising and no cross-app tracking.
3. What the data is used for
- creating and maintaining your user account, signing in and resetting your password
- providing learning content and saving your progress so that you can continue where you left off
- adapting exercises: review sessions are built from previously incorrect answers
- study reminders (notifications scheduled on your device; you can turn them off in the app settings)
- service security and preventing misuse
- investigating errors and crashes
The legal basis for the processing is determined by your organisation as the controller, and your organisation describes it in its own privacy notice.
Service development: AliceAI Learning Oy may use data generated by the use of the app to develop the service and its learning content only in anonymised or aggregated form, from which no individual user or organisation can be identified.
Research: data from the app is not used for research. Any participation in research is always agreed separately and comes with its own privacy notice.
No automated decisions with legal or similarly significant effects are made about you.
4. Where the data comes from
The data is obtained from you when you register, from your use of the app, and, based on the licence code, from the organisation that obtained access to the app.
5. Who processes the data
AliceAI Learning Oy uses sub-processors that process data on its behalf:
- Google Firebase (Google Ireland Ltd / Google LLC): authentication, database, file storage, server functions, crash reporting and app integrity verification.
Device integrity checks also use services provided by Apple (App Attest / DeviceCheck) and Google (Play Integrity).
Data is not sold or disclosed to advertisers.
6. Data location and transfers outside the EU/EEA
The database and files are located in Finland, and server functions run in the EU. Account authentication data (email address and encrypted password) is processed in Google’s authentication service, which operates in the United States. Crash report processing may also take place in the United States. Such transfers rely on the EU–US Data Privacy Framework and/or standard contractual clauses approved by the European Commission.
7. Security
All communication between the app and the service is encrypted. Access to data is restricted: each user can read only their own data, and the service checks that requests come from the genuine app. Passwords are never stored in plain text. The database is backed up to protect against data loss.
8. How long data is kept
- Data is kept for as long as your user account exists.
- If your licence expires and is not renewed, your account and data are deleted 12 months after the licence expires.
- If your organisation’s agreement ends, the data is deleted within 30 days of the end of the agreement, as set out in the agreement.
- When you delete your account, your user account and all associated personal data are deleted. Only aggregate data from which you cannot be identified remains (e.g. the organisation’s total study time), together with a record that the licence has been used — without your name, email address or user identifier.
- Deleted data is removed from database backups within 98 days at the latest. Backups are used only to restore data in the event of a failure.
- Service providers’ own deletion periods: the authentication service deletes data from its active and backup systems within 180 days at the latest, and crash reports are retained for 90 days.
9. Your rights
You have the right to:
- know what data is processed about you and receive a copy of it
- request correction of inaccurate data
- request deletion of your data
- object to processing or request its restriction
- transfer the data you have provided to another service
These rights apply in accordance with the conditions of the GDPR; for example, the right to data portability and the right to object depend on the legal basis of the processing.
Deleting your account: you can delete your account and data at any time in the app under Profile → Delete account. If you no longer use the app, see section 12.
Other requests: as your organisation is the controller, you can address your requests primarily to it. You can also send a request to AliceAI Learning Oy at support@aliceai.io — we will forward it to your organisation and assist it in responding.
If you believe your data is processed unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi/en).
10. Age limit
The app is intended for professional use and vocational training. It is not directed at persons under 16. The organisation that issues the licence is responsible for deciding to whom it provides the app.
11. Changes
This policy may be updated. Material changes will be announced in the app before they take effect.
12. Deleting your account
You can delete your AliceAI Learning app (developer: AliceAI Learning Oy) user account and the associated data in either of these ways:
In the app: open the app, sign in and select Profile → Delete account. Confirm with your password. Your account and data are deleted immediately.
By email, if you no longer use the app: send a request to support@aliceai.io with the subject Account deletion request. Include the email address you registered with, and if possible send the request from that address. We will confirm the deletion by email within one month at the latest.
Deletion covers your user account (email address, password and name) as well as your learning progress and other data generated by your use of the app. The aggregate data that is kept and the deletion periods are described in section 8.