Privacy Policy

Who we are

Didache is a workplace learning platform for teaching AI prompting skills. This policy explains what we do with personal data. It distinguishes between data we decide about ourselves and data we handle on behalf of the organizations that use us, because different people are accountable in each case.

«TO CONFIRM: registered company name, GEMI number, VAT number and registered address» You can reach us about anything in this policy at info@didache.ai.

«TO CONFIRM: whether a Data Protection Officer has been appointed, and their contact details if so»

In short

We collect very little about visitors to this website. There is no analytics, no advertising and no third-party tracking of any kind, which is why you are not asked to accept cookies.

If your employer gave you a Didache account, your employer decides what happens to your learning data. We handle it on their instructions. Requests about that data should go to your employer first, and we will help them answer you.

The prompts you write and the responses they produce are sent to our AI provider to be scored. Your name and email address are not sent with them.

We do not permit our AI provider to use your content to train its models.

Part A — Data we decide about

This part covers personal data for which we are the controller: visitors to this website, people who contact us, and the administrators who set up an organization.

Visiting this website

Our public pages load no analytics, no advertising pixels and no third-party scripts. We do not build a profile of visitors and we do not share visitor data with anyone.

The only information stored in your browser is what the site needs to work: your language choice, and once you are signed in, which organization you are currently viewing. In production the application does not write your sign-in token to browser storage at all. None of this requires consent under the ePrivacy rules, which is why you are not asked for any.

Our hosting providers keep short-lived technical logs, including IP addresses, to keep the service secure and available. «TO CONFIRM: the retention period applied by each hosting provider»

If you contact us

When you email us we receive your address, your message and anything else you choose to include. We use it to answer you and to keep a record of the exchange.

Our lawful basis is our legitimate interest in responding to people who get in touch and, where the exchange concerns a possible contract, taking steps at your request before entering into one.

«TO CONFIRM: how long enquiry correspondence is kept»

Administrator accounts

When someone sets up an organization on Didache we hold their name, email address, chosen language and time zone, and a record of the organization they administer. We use this to provide the service, to keep the account secure and to contact them about it.

Our lawful basis is performance of the contract with the organization.

Part B — Data we handle for your employer

If you use Didache because your organization gave you an account, your organization is the controller of your learning data and we are its processor. Your organization decides why the data is collected and how long it is kept; we act on its documented instructions under a written data processing agreement.

In practice this means we cannot delete your submissions or change your role simply because you ask us to. Ask your employer first. We will support them in responding to you.

What we hold about learners

Who you are: your name, email address, a profile picture if you upload one, your language and your time zone.

What you write: the prompts you submit for challenges and any prompts you save in your library. These are free-text fields, so they contain whatever you type. Please avoid putting other people's personal details into them.

How you did: the response produced from your prompt, your score against each rubric criterion, quiz answers, lesson progress, experience points, badges and daily streaks.

How you used the platform: when you were active, what is due for practice, and the notifications sent to you.

Administrative records: your membership of the organization, the roles you hold, and an audit log of significant changes recording who changed what.

What your manager can see

This deserves its own section rather than a footnote.

Managers in your organization can see, for the people they manage: individual and average challenge scores, how many attempts were made, a heatmap of activity over time, how many submissions sit at each stage of review, and progress against assigned tracks. They can export this to a spreadsheet.

This is monitoring in the workplace. Your employer, not Didache, decides to use it and is responsible for telling you about it and for justifying it. If you want to know how your employer uses this information, ask your employer.

How AI is used on your work

When you generate a response or submit work for scoring, we send our AI provider the challenge title and brief, the scoring rubric, the prompt you wrote and the response produced from it.

We do not send your name, your email address or your user identifier. The provider receives your work, not your identity — although if you type personal information into a prompt, that information travels with it.

We do not permit the provider to use this content to train its models.

Scoring is automated. The section on automated scoring below explains what that does and does not mean.

Who else processes the data

We use a small number of providers to run the service. Each is bound by a contract limiting it to processing data on our instructions.

Two of them are easy to overlook and are listed for that reason. Our error tracker receives an account identifier and a technical description of what failed — never your name, your email address or anything you wrote. Our release platform holds a backup of the database taken before each release, which is kept for thirty days and then deleted.

«TO CONFIRM: the exact processing region for Railway and Sentry, and the name of the email provider»

Sending data outside the EEA

Our AI provider processes data in the United States under the Standard Contractual Clauses approved by the European Commission. Alongside that legal mechanism we rely on a technical one: your identity is not sent with your content.

Our release platform holds the pre-release database backup in the United States, also under Standard Contractual Clauses.

Everything else is processed within the European Union, «TO CONFIRM: subject to confirming the regions marked above».

How we protect it

Every table in our database is protected by row-level security enforced by the database itself rather than by the application. One organization's data is not reachable from another, even if the application were to ask for it.

Profile pictures are held in a private storage area with type and size limits, not at a public address.

Traffic is encrypted in transit. In production, sign-in tokens are held in memory rather than written to browser storage.

«TO CONFIRM: who holds administrative access to production systems, and under what controls»

How long we keep it

Data we control — enquiries and administrator accounts — is kept while we have a relationship with you and for a reasonable period afterwards, as described above.

Learning data is kept for as long as your organization remains our customer. When the contract ends we return or delete it within «TO CONFIRM: number» days, unless your organization asks us to act sooner or the law requires us to keep something longer.

If your account is deactivated while your organization remains a customer, your record is kept so the organization retains its own history. Your organization can ask us to delete it.

«TO CONFIRM: this section commits to deletion periods that are not yet automated in the product. Either implement scheduled deletion before publishing, or narrow this section to describe deletion on request»

Your rights

Under the GDPR you may ask for access to your personal data, correction of it, deletion, restriction of processing and portability, and you may object to processing carried out on the basis of legitimate interests.

For data we control, write to info@didache.ai and we will respond within one month.

For learning data your organization is the controller, so please ask them. If you ask us, we will pass the request on and help them answer it.

If you are not satisfied you may complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, www.dpa.gr), or to the supervisory authority where you live or work.

Automated scoring

Your submissions are scored automatically against a rubric published before you begin. The score is feedback on a learning exercise.

Scores are not intended to be the sole basis for decisions about your employment, and our contract with your organization says so. If you believe a score has been used that way, raise it with your employer: you have the right to ask for human involvement in decisions that significantly affect you.

Children

Didache is a workplace tool. It is not directed at children and we do not knowingly collect data from anyone under 18. Accounts are created by an organization for its own people, not by members of the public.

Changes to this policy

If we change this policy we will update the date at the top. Where a change materially affects how personal data is handled, we will tell the organizations that use us before it takes effect.

Contact

Questions about this policy: info@didache.ai.

«TO CONFIRM: postal address for formal notices, and an EU representative if one is required»