Privacy Policy

1. Introduction

Aimnova ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our educational platform ("the Service").

Because many of our users are students and may be minors, we take extra care with their personal data. We comply with the data protection law that applies to us, including the GDPR.

Who is responsible for your data. For students and teachers who sign up themselves, Aimnova is the data controller: we decide what is collected and why, and this policy is the account of it. Where a school enrols its pupils— importing a roster rather than having each pupil join a class themselves — the school is the controller and Aimnova is its processor, acting on the school's instructions under a written data-processing agreement. Section 6 explains what changes in that case.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, school name (optional), and selected IB subjects.
• Profile Information: Profile photo, exam dates, timezone, study preferences.
• Study Data: Your answers to questions, study session activity, AI feedback, custom notes, and progress information.
• Communications: Messages sent to customer support or feedback forms.
• Payment Information: Billing details processed securely by Stripe (we do not store your full payment information).

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken, time spent studying, click activity.
• Device Information: Browser type, device type, operating system.
• Log Data: IP address, country/region, access times.
• Cookies & Tracking Technologies: As described in our Cookie Policy (preferences, authentication, analytics).

2.3 Information from Third Parties

• Authentication Providers: If you sign in through Google or another provider, we receive limited information such as your name and email.
• Analytics Services: Usage statistics, in aggregate, to see how the platform performs. Analytics identifiers are pseudonymous rather than anonymous — they do not carry your name, but they are not nothing.

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the Service
• Personalize your learning experience
• Generate AI-powered study recommendations
• Deliver practice questions, predictions, and analytics
• Create personalized study plans
• Communicate about updates, account changes, and support
• Process payments and manage subscriptions
• Improve our platform and develop new features
• Protect the security and integrity of the Service
• Comply with legal obligations and enforce policies

We do not sell your personal information.

3.1 Our lawful bases (GDPR Article 6)

• Performance of a contract — running your account, storing your work, marking your answers, and showing your progress. This is the bulk of what we do, and it does not rest on consent.
• Legitimate interests — keeping the Service secure, preventing abuse, and improving it. We balance these against your interests and you may object at any time.
• Consent — non-essential cookies, analytics that use them, and marketing email. You can withdraw it at any time without affecting anything else.
• Legal obligation — tax and accounting records for payments.

4. AI and Machine Learning

Aimnova uses AI systems to:

• Analyze study patterns and performance
• Generate feedback on written answers
• Predict likely exam performance
• Create adaptive study plans
• Suggest weak areas and learning priorities

Your study data is processed by these AI models to provide insights and recommendations. We do not sell or share personal learning data with advertisers or commercial third parties.

Who processes this data. Written answers and free-text you type, along with related study context, are sent to OpenAI (our AI provider) for grading and tutoring. This means that data is transferred to and processed on servers in the United States. We do not send your email or account identifiers to OpenAI (only your first name is included in tutor chat), and our agreement with OpenAI does not permit your data to be used to train their models.

Automated decisions. Our AI grades written answers and predicts likely performance automatically, without a human reviewing each result. These are study indicators, not decisions about you. They are not official IB marks, they do not determine your grade, your qualification, whether you progress, or whether any school or university admits you, and nobody outside Aimnova receives them except a teacher you have joined. They exist to tell you what to revise next. Where you are in a teacher's class, that teacher can open any written answer, see the AI mark and the feedback behind it, and change the mark. Their mark then replaces the AI's everywhere it is used — your progress, the topic mastery figures and the readiness estimate. We do not currently show you that a teacher changed a mark, so if you want to know whether one was reviewed, ask your teacher or us. If you have no teacher on Aimnova, there is no override, but you can report a mark you disagree with from the result itself. Those reports go to a person at Aimnova who reviews them, and if a mark changes we email you. We do not publish a deadline for that, because we would rather not promise a turnaround we cannot reliably keep. You can also write to us, or object to automated processing, at privacy@aimnova.app.

5. Data Sharing and Disclosure

We may share your information with:

✔ Service Providers (sub-processors)

We share the minimum data needed with the providers that run the platform. Our current sub-processors are:

The current list is published at aimnova.app/subprocessors, and was last reviewed 17 September 2026. Each provider may engage sub-processors of its own; those chains are published by the provider and linked from that page. A school with a data-processing agreement is additionally notified of relevant new or replacement sub-processors in accordance with that agreement.

✔ Legal Compliance

When required by law, in response to valid requests, or to protect our rights.

✔ Business Transfers

If Aimnova is involved in a merger, acquisition, or sale of assets, your information may be transferred with appropriate protections.

✔ With Your Consent

When you explicitly agree to share information — for example linking your account to a parent, or joining a teacher's class with their code. Section 6 sets out exactly what each of them can then see.

We NEVER:

• Sell personal information
• Share student data for targeted advertising
• Allow data brokers to access your information

6. Teachers, classes and schools

A teacher can create a class and invite students to it. Joining one is something you do yourself, with a code or a link — nobody is added to a class without acting on that invitation.

What your teacher can see, once you are in their class:

• Your name and the subjects you study with them
• How much of each topic you have covered, and where you are strong or weak
• The work they set you: whether you finished it, and how you scored
• Written answers you gave to their work, the AI mark, and the feedback — and they can change that mark, as described in section 4

What your teacher cannot see: your password, your billing details, anything you study in subjects outside their class, or your conversations with the AI tutor.

Leaving a class ends that teacher's access to your work from then on. Contact us if you want a class removed from your account.

When a school enrols pupils itself. A school can buy Aimnova for its pupils and enrol them centrally instead of having each pupil join a class. In that arrangement the school decides who is enrolled and why, so the school is the data controller and Aimnova is its processor: we act on the school's written instructions under a data-processing agreement, we do not use pupil data for our own purposes, and requests to see or delete a pupil's data go to the school first. The school is responsible for telling pupils and parents that it has enrolled them. If a school's agreement ends, we return or delete the pupil data it is responsible for within 30 days of being asked, and in any case within 90 days.

A teacher who studies here as well keeps both: the class they teach and the work they do as a student are separate, and their own study data is not visible to anyone through the teaching side.

7. Data Security

These are the measures actually in place:

• Traffic to and from the site is encrypted (TLS).
• The database is encrypted at rest by our hosting provider, and passwords are stored hashed, never in a readable form.
• Row-level security in the database: a student's own account can only reach that student's rows.
• Administrative access to production data is limited to the people who run Aimnova, and is not granted for support unless it is needed to answer a specific request.
• Rate limits on the endpoints that cost money or could be abused.

What we do not claim. Aimnova holds no external security certification — no SOC 2, no ISO 27001, no Cyber Essentials — and has not commissioned an independent penetration test. We would rather say that than imply an audit that has not happened.

No online transmission is ever completely secure, so we cannot promise the impossible. What we can say is that these measures are ours to maintain, and that if personal data is breached we act on it — including telling you and the regulator where the law requires.

8. Data Retention

We retain your data only as long as necessary to provide the Service.

After you delete your account:

• Personal data is removed within 30 days
• Backups may persist for up to 90 days
• Aggregate figures that identify nobody — how many people answered a question, and how often it was answered correctly — may be kept indefinitely
• Transaction information may be retained for legal/tax purposes

Pupils enrolled by a school. Where the school is the controller, it decides how long we keep the data and we act on its instruction. If its agreement with us ends, we return or delete that data within 30 days of being asked, and within 90 days in any case. See section 6.

9. Your Rights

Depending on your location, you may have rights to:

• Access your personal data
• Correct inaccurate information
• Delete your data ("Right to be Forgotten")
• Download/Port your data
• Object to or restrict certain processing
• Opt out of marketing communications
• Withdraw consent where consent is the legal basis

You can exercise these rights by contacting: privacy@aimnova.app

How long we take. We answer within one month of receiving your request. If a request is unusually complex, or you have made several, the law lets us take up to two further months — if that happens we will tell you within the first month, and why. Answering costs you nothing unless a request is manifestly unfounded or excessive, and we will say so rather than quietly charging you.

We may need to verify your identity before processing requests. If you are unhappy with how we have handled something, you can complain to the data-protection authority in the country you live in — you do not have to come to us first.

If your school enrolled you. Where your school is the controller, the school answers these requests, not us. A request that reaches us about school-held data is passed to your school and we act on their instructions — section 6 explains why.

10. Young People

Aimnova is built for the IB Diploma Programme, which is studied at 16 to 19, and our users are typically 16–20.

• You must be 16 or over to create an Aimnova account. We do not offer accounts to under-16s. There is no parental permission route, because we would rather not process a younger child's work at all than build consent machinery around it.
• You confirm your age at sign-up. We do not verify it — no document check, no age-estimation technology — so it is a declaration you make, and we say that plainly rather than implying a check that does not happen.
• If we learn that an account belongs to someone under 16, we delete it and the work in it promptly.
• Pupils enrolled by a school are different. Where a school deploys Aimnova, the school decides which pupils use it and on what legal basis, and the school is the controller — section 6 explains that arrangement. The 16+ rule above is our own rule for accounts people open themselves; it is not a statement about what a school may lawfully do for its own pupils.
• Parents or guardians can request access to or deletion of their child's information at: privacy@aimnova.app

11. International Data Transfers

Your account and your work stay in the EU. The database that holds them, and the servers that run the site, are in Ireland. Nothing you study, answer or are marked on leaves the EU in the ordinary course of using Aimnova.

Three things do go further. Written answers and tutor messages go to OpenAI in the United States, as section 4 sets out. Analytics, if you accept analytics cookies, go to Google in the United States. Payment details go to Stripe, which processes in Ireland and the United States.

What protects those transfers. Where a transfer outside the EEA requires a safeguard, we rely on an applicable GDPR transfer mechanism — an adequacy decision, or the European Commission's approved Standard Contractual Clauses. Each provider's data-processing agreement sets out the mechanism that applies to it, and we keep a record of them. Our sub-processor page lists every provider and where it processes, and further detail is available on request.

Where your school is the controller, it may instruct us differently; section 6 explains that arrangement.

12. Third-Party Links

The Service may include links to external websites. We are not responsible for the privacy practices or content of third-party sites. We encourage you to review their privacy policies separately.

13. Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be communicated via email or in-app notifications.

This policy is a notice, not a contract: it tells you what we do rather than asking you to agree to it. Where a change needs your consent, we will ask before it takes effect.

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, contact us at:

Privacy: privacy@aimnova.app

General inquiries: hello@aimnova.app