Privacy Policy for Schools

Last updated: 2026-10-28

This policy applies to use of Alfa by schools, municipalities, and teachers (collectively, the “School”) operated by Alfa Kennsla ehf., reg. no. 481225-1320 (“Alfa”, “we”, “us”).

This policy is a general transparency notice describing how personal data is processed under the EU General Data Protection Regulation (GDPR) and Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data. Schools receive a separate data processing agreement under Article 28 GDPR upon contract signing.

1. Definitions

• Controller: The School, which determines the purposes and means of processing personal data.
• Processor: Alfa Kennsla ehf., which processes personal data on behalf of the School.
• Sub-processor: A third party engaged by Alfa to deliver the Services.
• Data Subject: A student or teacher using Alfa.
• Personal Data: Any information relating to an identified or identifiable individual.
• Services: The Alfa website, the student app, the student web app (nemandi.alfakennsla.is), the teacher portal, and the backend.

2. Roles of the parties

The School is the Controller of student and teacher personal data. The School determines the purposes and means of processing, including which students access the Services, which assignments they complete, and how their work is assessed.

Alfa is the Processor and processes personal data only on documented instructions from the School, which are expressed in this policy and in the agreement in force with the School.

3. Personal data processed

Students

• Identity: An internal identifier generated by Alfa, a sign-in code issued by the School (never stored as such, only as a hash), and an account label such as “Nemandi 0142”. Alfa does not receive students’ names, email addresses or national ID numbers. A student’s name appears only on the printed sign-in slip and, if the teacher chooses, in the teacher’s own browser
• Educational data: Answers to math problems, up to three images of the handwritten working per answer, the teacher’s mark on each problem (correct/wrong), points on assignments and tests, and feedback. The student may crop the image before submitting it, to leave out neighbouring exercises or a classmate’s sheet
• Questions to the teacher: A student’s question about a specific problem and the teacher’s reply, where the teacher has switched this on for an assignment. No AI is involved
• Enrolment: Which courses and assignments the student is enrolled in
• Attendance, where the School has chosen it: The teacher’s record of a student’s attendance (present, late, absent, sick, excused)
• Technical data: Attempt timestamps, error logs, and session records. For each session we retain a hash of the session token, which surface created it, whether the student marked the device as their own, browser information, and a truncated part of the IP address

Teachers

• Identity: Name and email address. Google ID only where the teacher signs in with Google; a teacher can also sign in with a code sent to their email address
• Access credentials: Encrypted Google OAuth tokens, for teacher Google sign-in
• Administrative data: School association, courses, teacher notes, and grading actions
• Use of the teacher portal: Which pages a teacher opens and which actions they take, without automatic click capture and without session recording

Alfa does not process special categories of personal data (e.g. health, race, political opinions), with two exceptions: a sick status where the School has chosen attendance, and anything a student may write themselves in a question to the teacher.

4. Purpose and duration of processing

Purpose: To provide a mathematics learning service: students solve problems and submit their work, teachers create assignments, review work and give feedback, and where the School chooses it, AI reads handwritten work for the teacher.

Legal basis for the School: The School’s statutory duty under the Compulsory Education Act No. 91/2008 and general education law.

Duration: Processing continues while the agreement with the School is in force. Processing ends when the agreement is terminated.

5. Retention and deletion

The School may request deletion of data at any time by writing to alfa@alfakennsla.is. Specific timelines and procedures are set out in the data processing agreement with the School.

6. Sub-processors

The following sub-processors are engaged to deliver the Services. The same list is in Article 7 of the data processing agreement with each School.

Alfa will notify the School in writing at least 30 days before adding or replacing a sub-processor. The School may object within that period. If the objection cannot be resolved, the School may terminate the part of the Services that the sub-processor serves.

7. International transfers

Student personal data is stored and processed within the European Economic Area (EEA). Some sub-processors are established outside the EEA and may access data for operations and support, although the data is stored within the EEA. Such access relies on the EU Standard Contractual Clauses (SCC) or the EU–U.S. Data Privacy Framework.

Actual processing outside the EEA happens in three flows only: Resend’s logs of email to teachers, teacher Google sign-in, and analysis of worksheets a teacher uploads. None of them carries student data.

Alfa’s reading of handwritten work is optional and takes place within the EEA only. The School chooses it in the data processing agreement. Alfa reads the work with its own model at RunPod in Iceland and, where needed, again with a model through Amazon Bedrock from Amazon Web Services within the EU. Alfa chooses which model reads each submission.

• Only the image of the work, the problem text and the answer format are sent to the models. No name, email address, identifier, school, course or assignment is included.
• Alfa’s software refuses any processing in AWS regions outside the EU.
• Alfa uses Amazon Bedrock under the Amazon Web Services data processing agreement (GDPR Data Processing Addendum), which includes the EU Standard Contractual Clauses. Bedrock is configured to retain no data (zero data retention), the makers of the models have no access to it, and it is never used for training.
• Student data is never used to train third-party models. De-identified copies for training Alfa’s own model are made only where the School has specifically permitted it in the data processing agreement; by default it is not permitted.
• To test the quality of grading, Alfa may keep a limited set of submissions, the image of the work and the problem text only, with nothing that links them to a student, school or course. An image showing a name, a face, a login code or any other identifier is deleted rather than kept. The set is kept by Alfa within the EEA, is only read by the same models that grade the School’s work, and is deleted at the School’s request or when the agreement ends.
• The School may at any time ask that only Alfa’s own models be used. Grading will then generally be less accurate, and may be delayed on the rare occasions when Alfa’s own infrastructure is unavailable.

8. Security measures

Alfa implements appropriate technical and organisational measures in accordance with Article 32 of the GDPR, including:

• All communications encrypted with HTTPS/TLS
• Application-level access scoping: teachers and students can only access their own data
• Row-Level Security (RLS) enforced on database tables as defence in depth
• Google OAuth tokens encrypted at rest with AES-256-GCM
• Student sessions are held server-side and each one can be revoked individually. Only a hash of the session token is stored, the token is rotated on every use, and logging out invalidates the session. On a device used by more than one student the session lasts at most 12 hours and expires after 45 minutes of inactivity
• Student and teacher sign-in codes are never stored as such, only as a hash
• Private, access-controlled storage bucket on Supabase in Ireland for handwriting images; access only via short-lived signed URLs
• Role-based access control for staff accessing production systems
• Regular security monitoring, audit logging, and backups
• No analytics or marketing software is used for students. In the teacher portal, usage is analysed with PostHog within the EU, without automatic click capture and without session recording. No third-party marketing tools (e.g. Google Analytics, Meta) are used. Error tracking uses pseudonymous identifiers only (ID and role; email addresses are not transmitted)

All staff and contractors with access to personal data are bound by confidentiality obligations.

9. Artificial intelligence

The following specific provisions apply to Alfa’s AI components:

• Models within the EEA: Alfa’s reading of handwriting runs on AI models within the EEA, Alfa’s own model in Iceland and models through Amazon Bedrock within the EU, as described in section 7. It is used only where the School has chosen it, and the teacher decides whether Alfa reads images as they arrive or only when the teacher asks.
• The reading is for the teacher only: The AI reading of handwriting is shown only to the teacher. The student receives no AI-generated feedback and no AI-generated result on their image. Answers the student types are graded by a fixed rule in the backend, not by an AI model.
• Human review (Art. 22 GDPR): AI grading results do not constitute automated decision-making with legal effect. Teachers retain final responsibility for grading and must review AI grading before it is used in formal assessment. Students may request human review of any result.
• No identifiers sent to the model: Only the student’s submitted image, the problem text and the answer format are sent to the model. The correct answer is not sent with the image. No identifier of the student is sent.
• Images that are not schoolwork: If an image is not recognised as handwritten mathematics it is deleted automatically, and only the rejection event is retained.
• No AI chat: Students cannot chat with an AI in the Services.

About questions to the teacher. The student writes the question themselves as free text, and it goes only to the teacher. Students should not share sensitive personal information (e.g. about health, family circumstances, or anything outside the maths problem) in questions. The School is responsible for informing students of this, for example as part of usage instructions or in a classroom introduction.

Terms relating to the training of AI models on the School’s data are set out in the data processing agreement with each School.

10. Data subject rights

Data subjects (students and teachers) have the following rights under the GDPR:

• Right of access to their personal data
• Right to rectification of inaccurate data
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object

As the School is the Controller, requests should be directed to the School. Alfa will assist the School in fulfilling these obligations within reasonable time and at no additional cost, to the extent feasible.

Data subjects may lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd): personuvernd.is.

11. Breach notification

If Alfa becomes aware of a personal data breach affecting the School’s data, Alfa will notify the School within 48 hours of becoming aware of the breach. The notification will include:

• The nature of the breach
• The categories and approximate number of data subjects and records affected
• The likely consequences
• The measures Alfa has taken or proposes to take in response

Alfa will assist the School in fulfilling its own notification obligations to Persónuvernd and to data subjects as required. Further procedural detail is set out in the data processing agreement with the School.

12. End of the agreement

The treatment of data at the end of the agreement, including data return, deletion, and retention of backups, is set in the data processing agreement with each School.

13. Informing parents and guardians

Schools that use Alfa are encouraged to inform parents and guardians about the service through their school curriculum document (skólanámskrá) or by other means the school deems appropriate. On request, Alfa provides ready-to-use information text in Icelandic that schools can adapt for this purpose.

14. Changes to this policy

Alfa may update this policy. Material changes will be communicated to the School in accordance with the data processing agreement. Non-material changes, such as wording clarifications, may be made without prior notice. The latest version is always available on this page.

15. Governing law and jurisdiction

This policy is governed by the laws of Iceland. Any dispute shall be referred to the Icelandic courts, with Reykjavík District Court having first-instance jurisdiction.

16. Contact

Alfa Kennsla ehf.
Reg. no. 481225-1320
Email: alfa@alfakennsla.is

Icelandic Data Protection Authority: personuvernd.is