Privacy Policy

Effective date: 30 October 2026

Version 2026-11-01 · replaces the notice of 31 October 2026

This notice explains how Axiom Intelligence Partners LLC ("EdSmartly", "we", "us") handles personal data in the EdSmartly service at edsmartly.com and app.edsmartly.com. It describes what the platform actually does — not what it might one day do.

1. Who we are, and who is responsible for your data

Axiom Intelligence Partners LLC is a limited liability company registered in the State of Wyoming, United States, at 30 N Gould St #68017, Sheridan, WY 82801. edsmartly.com and app.edsmartly.com are services of Axiom Intelligence Partners LLC.

Responsibility depends on how EdSmartly is being used, and this is not a technicality — it changes who you go to.

• Your school is the Data Controller for the accounts and teaching content inside its EdSmartly workspace. Your school decides who may use the service, what role each person holds, how long teaching history is kept, and whether an account is closed. We act as the Data Processor, on your school's documented instructions.
• We are the Data Controller for website enquiries (the waitlist and school set-up requests) file downloads and pack purchases on our website, for contacts a referral partner registers with us, and for our own business records. In those cases there is no school standing between you and us — you come to us directly.
• A personal workspace, where you use EdSmartly on your own rather than through a school, has no school behind it either, so we are the Data Controller for that account and its content. The rules for personal accounts that are not used, in section 8, apply only there.

2. The laws we follow

EdSmartly serves schools in the Gulf. This notice is written to meet Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016) and the United Arab Emirates Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

We are not established in the European Union and we do not offer the service to people in the EU or EEA, so the GDPR does not apply to us as a matter of law. We hold ourselves to GDPR-grade standards anyway — data minimisation, purpose limitation, transparency, and accountability we can actually demonstrate — because a school should not have to take our word for how its teachers' data is handled.

3. What we collect

• Website enquiries — your name, email address, role, country, organisation and stated interest, when you join the waitlist or ask us to set up a school. These reach us as an email, and we also keep a record of the enquiry itself so that we can answer it and see that it has been answered — a request that is only an email is one we can miss. We do not add you to a mailing list and your details are not stored in a marketing platform. The record is deleted automatically 24 months after our last contact, and sooner if you ask: write to privacy@edsmartly.com.
• File downloads — when you download a file from our website, such as the brochure or a product sheet, we ask for your name, work email address, role, country and, if you choose, your school or organisation, and we keep them with the name of the file and the date. We do this so that we know who is interested in EdSmartly. You can also tick a box to let us email you about EdSmartly; we write only if you ticked it, one message at a time and never to a mailing list, and you can tell us to stop at any time by replying or writing to privacy@edsmartly.com. Ticking it is never a condition of the download. The record is deleted automatically 24 months after our last contact, and sooner if you ask.
• Buying a pack — when you buy a ready-made teaching pack on our website, Stripe takes the payment and tells us your email address, the pack you bought, the amount and the date. We never see your card number. We keep that record so that we can send you the download link, let you download the pack again, and help you if something goes wrong. We email you the link once, as part of the purchase. Buying a pack does not add you to any list, and we do not send you marketing because you bought one.
• Reviewing a pack — if you apply to review one of our packs, we keep your application as an enquiry (as above), and the replies we exchange, including what you tell us about your teaching. If we accept you, we send you the pack and keep the review you return, with the pack and the date, as the record that a teacher checked it. When we accept your review we add free time to your personal EdSmartly workspace, and keep a record of that: how much, when and why. Your reward never depends on what your review says. Your name appears in a pack only if you ask us to put it there, and you can ask us to take it out of the next edition at any time.
• Support requests. When you contact support from inside the app, we keep your message, the topic you chose, a reference number and the workspace you were in, so that we can answer you and see that you have been answered. If you ask to recover a lost two-factor device, we also record when you asked, when you confirmed it by email, and the country the request came from (never your exact location or IP address), so that support can check the request is really yours.
• Ask Edi support chat — if you use the "Ask Edi" bubble on this site, we receive the question you type, and — only if you choose to give them — your name and email address. No account or sign-up is needed. We use these solely to answer your question and, if you left an email, to reply to you. We do not build a profile from it, and the conversation is not used to train AI models.
• Account data — your name, email address, password (stored only as a secure hash by our authentication provider), interface language, and your role and school membership.
• A record that a trial was used — when a free trial starts, we keep a one-way, keyed fingerprint of your email address, written in a standard form, and never the address itself, so that each person receives one trial. We cannot read an address back from it; we can only tell whether the same address has had a trial before.
• School and role you tell us — if you choose to, the name of your school and your role there, given on a card in the workspace or on your Account page. Both are optional, and you can change or clear them at any time on your Account page. They are a description, not a permission: they never change what you can see or do in EdSmartly, which only your school's administrator sets.
• Teaching content — the lesson plans, assessments, question ladders, report drafts and weekly modules you generate, the inputs you provide to create them, and any rating you give an output. These are stored in your account history. When you approve a draft, we record that you approved it, when, and a fingerprint of the approved text, and keep that record with the draft for as long as your school keeps its teaching history. For an assessment, we also keep a fingerprint of each question the AI produced, so we can record whether you changed any question before approving it and how many you changed. School leaders see how many drafts are approved and, for assessments, how many of those were edited before approval, never their content.
• Student practice data — when you run a Student Practice session, the student's first name (transient; no surname or identifier required), the text of each answer they give, and the AI's automated diagnosis and misconception label are stored in your account for as long as your school's data retention policy allows. No student email address, password, roster or persistent record is created. School administrators can see aggregate misconception statistics on the dashboard, but cannot read individual student responses.
• Assessment results — when you record a class's results in Assessment Studio, the marks are stored against a seat number, never a name. Your own class list is what connects a seat to a child, and it never enters EdSmartly. Results are stored in your account and only you can see them.
• Live Check — when you run a Live Check, each student joins on their own device with a code and gives a first name. We store that first name, the student's answers, the marks and, for written answers, the AI's diagnosis, in your account, and only you can see them. No student account, email address, password or device identifier is created: the student's device holds a random token for that one check, and we keep only a one-way hash of it. First names are erased automatically 30 days after the check closes, and a check left open is closed after 24 hours. The answers and marks stay, recorded against a seat number. To stop code-guessing, join attempts are counted against a one-way hash of the network address, never the address itself.
• Referred contacts — if one of our referral partners registers your school as a lead, we receive your school's name, your name, your role and your business contact details before you have heard from us. Partners are contractually required to register only people they already have a business relationship with or whose agreement they have, and are forbidden from sending us any teacher's or student's personal data. We use these details for one purpose: to assess and pursue that referral. If you would rather we did not hold them, tell us and we will erase them — see section 9.
• Staff lists for invitations — a school administrator can invite many teachers at once from a spreadsheet: a file on their computer, a list they paste in, or a file they choose from their school's Google Drive or Microsoft OneDrive. The spreadsheet is read in the administrator's own browser and never reaches our servers. Only the email addresses found in it are sent to us, each as an invitation like one typed in by hand, kept until it is accepted or expires. Names, departments or anything else in the file are not sent or kept. See section 7 for what Google and Microsoft see when a file is chosen from them.
• Usage and administrative records — generation counts against fair-use quotas, and an audit log of administrative actions (for example, when a school or group administrator assigns an administrator or changes a quota).

4. Children's privacy and minor data

We treat anyone under the age of 18 as a minor. This section sets out our position now, and the commitments we make before anything changes.

Today: students have no accounts

EdSmartly is a tool for teachers and school staff. There are no student accounts, and students never sign in. A student's own work reaches EdSmartly in two ways, and a teacher starts both: Student Practice, a guided dialogue the teacher runs with a student, and Live Check, where students answer a classroom assessment on their own devices. In both, a student gives a first name at most. What is kept, and for how long, is in sections 3 and 8.

One more case, stated plainly rather than buried. The Report Writer lets a teacher type a student's first name so that a report reads naturally. Before the request leaves EdSmartly, that first name is replaced with a neutral placeholder, so the AI provider never receives it; it is put back into the draft when the reply arrives, and it is stored in the generated report in the teacher's history. In the context of a single class, a first name can identify a child — so we treat it as personal data and say so, rather than claiming we hold none.

What we never do with a minor's data

• No advertising, and no profiling for commercial purposes.
• No sale, and no sharing beyond the processors listed in section 6.
• No use for training AI models — ever, under any tier.
• No automated decision that produces a legal or similarly significant effect about a child. Every output is a draft, and a teacher reviews and decides.

Student-facing features: the commitments that apply

Live Check is the first feature a student uses on their own device. We published the commitments below before we built anything a student would touch, and this version of the notice is the update we said would come first. They apply to Live Check and to anything student-facing that follows:

• Students reach it only through their school, and only when a teacher opens a check. Theschool remains the Data Controller, and is responsible for the lawful basis for processing a child's data and — where the law requires it — for obtaining the consent of a parent or guardian. Both Qatar's PDPPL and the UAE PDPL impose heightened obligations on the processing of children's data. A school can switch Live Check off by switching off Student Practice.
• We act only as Processor, on the school's documented instructions.
• We collect the minimum needed: a first name, the answers, and the marks. No account, no email, no surname, no device identifier.
• Student answers are never used to train AI models.
• First names are erased 30 days after a check closes (section 8). Nothing is timed, nothing is proctored, and a student is never shown a score on screen.

If you believe a child's data has been entered into EdSmartly in a way this notice does not permit, write toprivacy@edsmartly.com and we will remove it.

5. Why we use it, and on what basis

We do not rely on your consent to process your teaching account data, and we do not ask for it.Where someone uses a product because their employer provides it, consent is rarely a free choice — so it would be the wrong basis to claim. We do not sell personal data, and we do not use it for advertising.

6. AI processing

Generation requests are processed by third-party AI model providers — Anthropic, withOpenAI and Google (Gemini) as fallbacks — under agreements that do not permit them to train models on your content. A request carries the teaching context you enter: subject, grade, topic and your notes. Before any request leaves EdSmartly, student names are replaced with neutral placeholdersand email addresses and telephone numbers are removed; names are put back only in the draft you see.

Teaching content only: DeepSeek and Moonshot AI (Kimi). Requests to draft a lesson, an assessment or a questioning ladder, and to turn an assessment into questions, carry no student names and no student work. They may also be processed by DeepSeek (Hangzhou DeepSeek Artificial Intelligence, China) or Moonshot AI (Kimi, Singapore), so that teaching can continue when other providers are unavailable. Their published API terms state that API content is not used to train their models. We do not have a data-processing agreement with either, and that is why they never receive anything from the Report Writer, Plan & Review, Student Practice, Live Check or Ask Edi. Your school can switch either off in Settings → AI providers.

Anything that carries a student's name or a student's own words goes to Anthropic or OpenAI only — the Report Writer, Plan & Review, Student Practice and Live Check. If neither is available, those requests wait or fail; they never pass to another provider.

When a teacher closes a Live Check, students' written answers are sent to Anthropic or OpenAI to be marked, identified only by seat number, never by name, under the same no-training terms. Live Check marking never falls back to any other provider: if neither is available, the answers wait for the teacher to mark.

Questions asked through the Ask Edi support bubble are answered the same way: the text of your question is processed by Anthropic, OpenAI or Google under the same no-training terms, grounded in the official EdSmartly manuals. Your optional name and email are not sent to the AI provider.

Outputs are drafts. They are produced by a model, they can be wrong, and you remain responsible for reviewing and personalising them before they are used with, or about, any student. EdSmartly makes no automated decision about any student.

7. Who processes data for us, and where

Cross-border transfers. Your school's database is hosted in the European Union. Several of the providers above operate from the United States, so data reaches them there. Every provider that may receive personal data is bound by a written data-processing agreement that permits them to process it only to provide their service to us, prohibits them from using it for their own purposes — including training AI models— and requires appropriate security. DeepSeek (China) and Moonshot AI (Singapore) are not, and so receive teaching content only, as section 6 explains. Qatar's PDPPL and the UAE PDPL both regulate transfers of personal data across borders, and we transfer only to providers that are contractually bound to the protections described in this notice.

8. How long we keep it

This is the section most privacy notices get wrong, so we are being exact. EdSmartly does not simply "delete on request" — it archives first, and here is what that means.

• Teaching history. Your school chooses how long generation history is retained — 12 months, 36 months, or indefinitely. History older than the school's chosen period is removed automatically.Items your school has approved into its School Library are kept as school assets and are not purged.
• When an account is closed. Your school administrator approves the request, and we thenarchive the account. Archived data is immediately removed from every view, dashboard and roster — nobody at your school, and nobody at EdSmartly, sees it in the product. It is then retained for up to 10 years for audit, legal and contractual-defence purposes, and is permanently deleted at the end of that period. It is not used for anything else in the meantime.
• School and role you tell us are kept with your account until you change or clear them, and are archived and deleted with your account as described above.
• Personal accounts that are not used. These rules apply to personal workspaces only, and never to an account your school manages.
  • A sign-up whose email address was never confirmed is deleted after 7 days.
  • A trial account in which nothing was ever created is deleted 60 days after the trial ends, unless you sign in before then. We email you 30 days before. Like referred contacts below, it is erased outright rather than archived, because there is nothing in it to keep.
  • Any personal account without a current subscription is closed after 12 months without a sign-in: archived as above if it holds work, and deleted outright if it holds none. We email you 60 days and again 14 days before, with a link to download your work, and signing in keeps the account.
  • If you also belong to a school, only your personal workspace is closed. Your sign-in and your school's workspace are not affected.
• The trial record (the fingerprint in section 3) is deleted 24 months after the trial started.
• Live Check. A student's first name is erased automatically 30 days after the check closes, and a check left open is closed after 24 hours. The answers and marks stay in the teacher's account against a seat number, until the teacher deletes them or the account is archived as below.
• Assessment results recorded by seat number stay in the teacher's account until the teacher deletes them or the account is archived as below.
• Website enquiries are kept while they remain relevant to our correspondence with you, and for up to 24 months after our last contact.
• Support requests are kept for up to 24 months after our last contact, as website enquiries are.
• File downloads are kept for up to 24 months after our last contact, and deleted sooner if you ask.
• Pack purchases are kept for as long as tax and accounting rules require, and then deleted.
• Pack reviews are kept while the pack they checked is sold and for 24 months after, as the record that it was checked. A review application that we do not take further is kept like any enquiry: up to 24 months after our last contact.
• Two-factor recovery requests are deleted 180 days after they are closed.
• Referred contacts. A partner's registration protects their claim for six months. If the school does not become a customer we erase the contact details within 24 months of the last contact, and sooner if you ask. If it does, the record becomes part of the account and contractual records above. This is one of the few things we erase outright rather than archive: there is no audit or contractual reason to keep the details of someone who never became a customer.
• Backups persist for a limited period after deletion.

9. Your rights, and how to exercise them

You may ask for access to your personal data, its correction, itserasure, a copy in a portable form, and you may object to or ask us to restrict certain processing.

Three of these you can exercise yourself, immediately, inside the app:

• Access and portability — Account → Download my data. You get a copy of your profile and memberships, everything in your personal workspace, and everything you created in the schools you currently belong to. For work you created in a school you have left, the export lists what exists, and the content itself is available from that school, because the school controls it.
• Erasure / account closure — Account → Request account closure. Yourschool administrator reviews it, because your school is the Controller. Once approved, we archive the account as described in section 8.
• Object to marketing contact — use the opt-out link in any such email, or write toprivacy@edsmartly.com. Emails about your account itself, such as a trial extension, support or security, are not affected.

Otherwise, write to privacy@edsmartly.com. We respond within 30 days.

Complaints. If you are not satisfied with our response, you may complain to the competent data-protection authority — in Qatar, the national authority responsible for Law No. 13 of 2016; in the United Arab Emirates, the UAE Data Office.

10. Security

Data is encrypted in transit. Each school's data is isolated at the database level by row-level security, and access is restricted by role. Two-factor authentication is available to every user, not only administrators. If you lose your two-factor device, you can ask for it to be reset. We send a link to your account's email address and wait 24 hours, so you can cancel a request you did not make. Only then does EdSmartly support remove the device; nobody at your school can do it. Administrative actions across a school group are written to an audit log that the group's administrator can read and export.

The app's sign-up form is protected by Cloudflare Turnstile, which checks that a person, not an automated program, is creating the account. Most people see nothing; some are asked to tick one box. There are no picture puzzles. Our server confirms the result with Cloudflare before any account is created.

11. Cookies and analytics

We use only the cookies needed to sign you in and to remember which campus you are working in. For visitor numbers we use Cloudflare Web Analytics, which is cookieless: it sets no cookies, stores nothing on your device, and cannot follow you to other websites. Because nothing is stored on or read from your device, no consent is required — but you can still switch it off in Cookie preferences, and the script will not load at all. On the app's sign-up form only, Cloudflare Turnstile (section 10) reads technical details of your browser to check that you are a person. That is strictly necessary to keep sign-up safe, so it needs no consent, and it does not run anywhere else. If a school administrator chooses a staff list from Google Drive or OneDrive (section 7), Google's or Microsoft's own sign-in and file windows open on their sites and use their cookies there; they set none on ours. Full detail is in our Cookie Policy.

12. Who owns what you create

You do. The school and its teachers retain full ownership of the inputs they provide, the outputs they generate and any curriculum framework loaded for them. Axiom Intelligence Partners LLC takes no ownership of that content and no right to use it for any purpose other than running the service for you — expressly including no AI model training. The full clause is in the Terms of Service.

13. Changes to this notice

When this notice changes we publish it as a new version with a new effective date, and record that version in the app, where you will be asked to confirm you have read it. We do not silently edit a version that people have already been shown.

14. Contact

Axiom Intelligence Partners LLC
30 N Gould St #68017, Sheridan, WY 82801, United States
privacy@edsmartly.com