Privacy Policy
1. Introduction
AIRA ("we", "us", "our") is an educational platform that helps students and teachers by personalising learning progress, enabling self-paced study, and providing teachers with performance insights. This Privacy Policy explains what personal data we collect, why we collect it, and how we handle it in accordance with the EU General Data Protection Regulation (GDPR / DSGVO).
2. Data Controller
The data controller responsible for this website is:
Constantin Keschmann / Ceshy
Trading as: AIRA
Email: support@aira.school
Address: Sieveringerstraße 15, 1190 Vienna, Austria
3. Data We Collect
When you register and use AIRA, we collect the following personal data:
| Data | Purpose | Legal Basis |
|---|---|---|
| Username | Account identification | Art. 6(1)(b) GDPR – contract performance |
| Display name | Shown to teachers and in duels | Art. 6(1)(b) GDPR – contract performance |
| Password (hashed) | Account authentication | Art. 6(1)(b) GDPR – contract performance |
| Question answers | Personalising difficulty and tracking progress | Art. 6(1)(b) GDPR – contract performance |
| Activity timestamps | Showing last active status to admin | Art. 6(1)(f) GDPR – legitimate interest |
| Test monitoring & mouse tracking (focus events, tab switching, mouse cursor leaving test window) | Ensuring exam integrity and preventing cheating during teacher-administered online tests | Art. 6(1)(e) GDPR (educational task in the public interest) / Art. 6(1)(f) GDPR (legitimate interest in fair test administration) |
We do not collect real names, email addresses, or payment information during registration.
4. Cookies
AIRA uses the following cookie:
- session: Maintains your secure login session and stores session-based user settings (technically necessary).
This cookie is strictly necessary for the platform to function. It is set automatically upon login and session creation. No tracking, advertising, or analytics cookies are used.
5. Hosting & Third-Party Services
AIRA is hosted on Amazon Web Services (AWS), with servers located in Sweden (Stockholm region / EU-North-1, European Union). AWS acts as a data processor under a DPA in accordance with Art. 28 GDPR.
6. Data Retention
We retain your personal data for as long as your account is active. If you request deletion of your account, all associated personal data will be permanently deleted within 30 days.
All account-related data will be permanently deleted.
This excludes answered questions. However, answered questions are only marked with a user_id and do not display or link to any personal data.
Test monitoring event records (such as early test terminations triggered when focus or mouse position leaves the test window) are retained alongside the associated test submission results for as long as the test record or student account is kept by the teacher.
7. Who Can See Your Data
Your teacher or class administrator can see your display name, your learning progress, which questions you answered correctly or incorrectly, and exam proctoring events (such as mouse-out or window switch infractions during tests) — this enables test verification and curriculum guidance.
8. Your Rights
- Right of access: Request a copy of all data we hold about you.
- Right to rectification: Request correction of inaccurate data.
- Right to erasure: Request deletion of your account.
- Right to restriction: Limit how we process your data.
- Right to object: Object to processing based on legitimate interests.
To exercise any of these rights, contact us at: support@aira.school
9. Children's Data
AIRA is intended for use in school environments. In line with Art. 8 GDPR, where AIRA is deployed through a school, it is the school's responsibility to ensure appropriate parental consent has been obtained.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The date at the top of this policy reflects the most recent update.