Privacy Policy

Effective Date: 26 May 2026

This Privacy Policy outlines how Wurksy AI ("Wurksy", "we", "us", or "our") processes personal data when you use the Wurksy AI platform, websites, browser extensions, and associated educational services (collectively, the "Service").

Wurksy AI provides a controlled AI environment (or "sandbox") deployed by educational institutions (schools, colleges, and universities) to support academic integrity, prevent plagiarism or contract cheating, and enable controlled, transparent use of artificial intelligence in assessments.

1. Data Controller and Data Processor Relationship

Depending on your relationship with the Service, data protection laws (such as the UK GDPR and EU GDPR) distinguish between a "Data Controller" and a "Data Processor":

• Educational Institution as Controller: When you use the Service through your university, college, or school (e.g., to complete coursework, write assessments, or manage assignments), the Educational Institution is the Data Controller. They determine the purposes, policies, and parameters of the processing. Wurksy AI operates strictly as a Data Processor on behalf of and under the explicit, documented instructions of the deploying institution, governed by a DPA (Data Processing Agreement).
• Wurksy AI as Controller: We act as a Data Controller only for limited personal data related to administrative accounts, platform configuration logs, billing details, and marketing or direct communication initiated directly with us.

If you are a student or staff member using the Service through an educational institution, please consult your institution's privacy policy or contact their Data Protection Officer (DPO) for information regarding how they handle your personal data.

2. Data We Process

We only process the personal data necessary to provide the Service, monitor academic integrity, and secure platform performance:

• Identity & Authentication Data: Name, email address, institutional student identifier (UID), role (e.g., student, instructor, administrator), password hashes, and LTI integrations credentials.
• Academic Context: Course name, module codes, assessment details, assignment briefs, and deadlines.
• AI Sandbox Interactions: Message logs, prompts submitted to the AI assistant, model outputs, file uploads (such as lecture slides and research papers), and citation logs.
• Integrity & Behavior Metrics (Telemetry): Typing speed, writing progression snapshots, copy-paste events, local file upload metadata (rubric checks), window activity indicators, and session lock records. This data is collected to detect plagiarism and third-party contract cheating.
• Technical Data: IP addresses, browser agent details, operating system information, cookie identifiers, and platform error diagnostics logs.

Special Category Data: The Service is not designed or intended to collect special category data (e.g., health, racial, ethnic, political, religious, or biometric data). You must not upload or input such data.

3. Legal Bases for Processing (EEA/UK Users)

Under the UK and EU GDPR, we (or your educational institution as the Controller) process your personal data based on the following legal grounds (Article 6 GDPR):

• Public Task (Article 6(1)(e)): Where the processing is necessary for the performance of a task carried out in the public interest, specifically the administration of higher education, student assessments, and ensuring academic integrity.
• Contractual Performance (Article 6(1)(b)): Where processing is necessary to perform a contract with you or your institution to deliver the Service.
• Legitimate Interests (Article 6(1)(f)): To secure the platform against fraud or security threats, debug platform errors, and improve system performance.
• Legal Obligation (Article 6(1)(c)): To comply with applicable administrative, tax, or statutory laws.

4. Data Minimisation and Storage Model

We adhere strictly to the principle of data minimisation. Wurksy AI incorporates a zero-access architecture:

• We do not sell, rent, or trade personal data to third parties.
• We do not use student submissions or AI interaction data to train public foundation models or for commercial profiling.
• In standard deployments, data is stored in localized secure cloud infrastructures (e.g., local Microsoft Azure regions) as instructed by the institution, meaning we do not maintain independent copies of institutional data beyond the scope of our hosting contracts.

5. Third-Party Services and Sub-processors

To deliver the Service, we share data with selected third-party service providers (acting as sub-processors) subject to strict contractual safeguards:

• Cloud Infrastructure Providers: Secure hosting environments (such as Microsoft Azure).
• Enterprise AI Providers: API processors (OpenAI Enterprise / Azure OpenAI Services). All data sent to these models is processed in private environments and is explicitly excluded from model training.
• Communication Services: Email delivery clients (such as Resend) used for account registration and notification notifications.

6. International Data Transfers

We store and process data within the regions requested by the deploying institution (typically within the UK or European Economic Area). If international transfers occur, we implement legally approved safeguards, including:

• UK International Data Transfer Agreements (IDTA).
• European Commission Standard Contractual Clauses (SCCs).
• Adequacy decisions issued by the UK Government or European Commission.

7. Data Retention Policy

Wurksy AI applies automated data retention policies configured by your institution:

• In-Progress Drafts & Unsubmitted Sessions: All chat logs, uploaded documents, telemetry events, and editor drafts are automatically deleted after 29 days (or the period specified by your institution) if the session remains unsubmitted.
• Submitted & Locked Assignments: Once you submit your assignment, all associated drafts, telemetry logs, AI interactions, and the final AI Index are preserved indefinitely (unless configured otherwise by your institution) to serve as a reliable audit trail for academic review.

8. Data Subject Rights (GDPR / FERPA)

Under applicable data protection laws (including UK/EU GDPR and FERPA), you have specific rights regarding your personal data:

• Right of Access: Request a copy of the personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal or academic retention overrides).
• Right to Restrict or Object: Limit or object to certain processing operations.
• Right to Data Portability: Obtain your data in a structured, commonly used format.

Because we act as a Data Processor for institutional accounts, data subject rights requests must be directed to your educational institution. We will assist your institution in responding to your request in accordance with our DPA.

9. Security Measures

We employ industry-standard technical and organizational security measures:

• Encryption in transit using TLS and encryption at rest.
• Role-based access controls (RBAC) and strict authentication checks.
• Frequent automated data backups and security vulnerability testing.
• Strict segregation of customer database instances.

10. Automated Decision-Making

Wurksy AI does not use automated decision-making or profiling to make decisions that produce legal or similarly significant effects on users (Article 22 GDPR). Automated indicators (e.g., "red flags") are flags raised for investigation and Professional Human Review by educational staff, who remain solely responsible for any academic or disciplinary decisions.

11. Contact and Supervisory Authorities

If you have questions about this Privacy Policy, please contact our support team at info@wurksyai.com.

You also have the right to lodge a complaint with a supervisory authority, such as the UK Information Commissioner's Office (ICO) or your local European Data Protection Authority.