Privacy Policy

MathFyx is used by schools and universities. Students' data and work, and the accounts of that school's teachers, are processed on behalf of the school and on its instructions. The school is the controller of that data under the GDPR and the service operator is its processor. The relationship is governed by a data processing agreement with the school.

Data needed to run the service itself — keeping track of the gradings (“opravy”) allocated to teachers and billing the school for the service, security records, the messages you send us through “Napíšte nám” (Write to us) in Help, and enquiries from the form on mathfyx.sk — is processed by the service operator on its own behalf.

If you are a student or a parent and wish to exercise your rights, please contact your school first. Any request that reaches us is forwarded to the school.

About teachers and administrators:

• name and email address;
• for a new teacher: the first name, surname and email address the school's administrator enters when requesting the account. We send an invitation with a link on which you create your account to that address; the address is not stored with the account;
• password — only as a one-way hash, never in readable form;
• sign-in data: time, IP address and browser or device type;
• role in the institution and the courses you teach;
• a record of who signed off a grade and when, and who started a grading run;
• the number of gradings the service operator has allocated to you, and how many you have used;
• if you connect Google Classroom: the email address of your Google account and an access token (stored encrypted);
• if you sign in to EduPage: your school's EduPage address, your username, your name and identifier in EduPage, and the sign-in session, stored encrypted. The EduPage password is used only to sign in and is not stored;
• if you write to us through “Napíšte nám” (Write to us) in Help: the kind of message, its text, the page of the application you wrote from, your browser or device type (user agent), and who sent the message and from which school.

About students:

• name and email address, if the school imports them from Google Classroom (otherwise only the file name under which the teacher uploaded the work);
• with the EduPage integration: the name and EduPage identifier of the student the teacher matched a piece of work to, and a record of when a message was sent to them and with which grading. The list of classes, students and their parents' identifiers is read from EduPage only while the application is in use and is not stored in the database;
• submitted work — photographs or PDFs, including anything written on them (often a name and handwriting);
• for programming: a transcription of the code, test results and any suggested fixes;
• grading: points, written feedback, marked mistakes, the teacher's corrections and sign-off.

About people who write to us through the form on mathfyx.sk:

• first name and surname, school and email address;
• phone number, if you give one;
• subject, type of school and the text of the message;
• when it was sent, and a record of how we handled it.

The IP address is not stored with the enquiry: the server keeps it only in memory, to limit how many enquiries can be sent from one address. As with every request, however, the entry gateway writes it to its access log (technical data below).

Technical data: server error logs, which may contain the name of an uploaded file, and the entry gateway's access log (IP address, time, page address, browser type).

We do not request or deliberately process special categories of data (such as health data). If a teacher or student writes such information into a piece of work themselves, it is processed as part of that work.

• Grading work, giving feedback to students and keeping records of results — on the instructions of the school, which processes the data in carrying out its educational tasks.
• Creating and managing teacher accounts, including the email invitation to a new teacher — on the basis of the contract with the school.
• Security of the service (sign-in protection, error logs) — legitimate interest in keeping the service secure and reliable.
• Support and improvement of the service (messages from “Napíšte nám” in Help) — legitimate interest in being able to answer you and improve the service. Only the service operator sees the messages; their author sees their own in Help.
• Keeping track of the gradings the service operator has allocated to teachers and of their use, and billing the school for the service — performance of the contract with the school.
• Answering an enquiry from the form on mathfyx.sk and arranging cooperation with the school — legitimate interest in being able to answer you and arrange the cooperation; where the contract is to be made with you directly, also steps taken at your request before entering into it. Only the service operator sees the enquiry, in the service's console and in its own mailbox. If you order the service from us, we will also use this email address to send you access to it.

We do not use data for advertising, we do not sell it, and we do not build profiles of students for any other purpose.

We use Google's Gemini model to grade work. We send the model the reference solution, the pages of the student's work, the list of exercises and the teacher's instructions. Student names that we know are replaced in the text before it is sent. A name handwritten on paper, however, is part of the page image and cannot be removed.

The model's output is only a suggestion, which the teacher sees, can overwrite and signs off. An assignment cannot be returned to students or finalised in MathFyx until a person has signed off every grade. Grades written to Google Classroom are drafts that a student sees only when the teacher returns them in Classroom themselves. Only grading the teacher has signed off is sent to EduPage, and only when the teacher starts the sending. No grade therefore reaches a student through artificial intelligence alone, and this is not a decision based solely on automated processing within the meaning of Article 22 GDPR.

We share data only with the following recipients and only to the extent needed to provide the service:

• Google (Gemini API) — grading work, transcribing code, proposing tests and fixes. We use the paid service, under which Google, according to its terms, does not use submitted data or responses to improve its products and retains them for 55 days solely to detect abuse of the service.
• Google (Classroom and Drive) — only if a teacher connects their Google Classroom account. Data is exchanged with the Google account the school already uses.
• aSc Applied Software Consultants, s.r.o. (EduPage) — only if a teacher signs in to EduPage. Data is exchanged with the school's EduPage, which the school already uses and which processes data on its behalf: MathFyx reads classes and students from it and sends messages with grading and a feedback PDF into it.
• Have I Been Pwned — when a password is set, we check whether it has appeared in known data breaches. Only the first five characters of the password's hash are sent, from which neither the password nor the person can be identified.
• Oracle Cloud Infrastructure (Oracle Corporation), data centre in Frankfurt — the service's entry gateway. It receives the encrypted (HTTPS) connection from your browser or app, decrypts it and forwards it to our server through an encrypted tunnel; the content of requests (including uploaded work) therefore passes through it but is not stored there. Only an access log is kept — IP address, time, the address of the requested page and the browser type — and it is continuously overwritten.
• Tailscale — the encrypted tunnel between the entry gateway and our server, and a fallback route to the server. Tailscale cannot see the content of the traffic, only connection data.
• Websupport s.r.o. — management of the mathfyx.sk domain (DNS), the mailbox that receives your messages and requests (for example at info@mathfyx.sk), and sending invitations to new teachers: we send the invitation from our own @mathfyx.sk mailbox through Websupport's mail server (SMTP). The new teacher's email address, the school's name and the account-creation link with its expiry date are transmitted. The notification of an enquiry from the form on mathfyx.sk reaches our mailbox the same way, with everything you filled in.

Google may process data outside the European Union. Such transfers are governed by Google's data processing terms, including standard contractual clauses or the EU–US Data Privacy Framework.

We do not disclose data to any other third party, except where required by law.

If a teacher connects Google Classroom, MathFyx obtains only these permissions from Google:

• the teacher's list of courses (read-only);
• the list of students in a course and their email addresses (read-only) — so that work is matched to the right student, and so that a feedback PDF in Google Drive can be opened only by the student it belongs to;
• coursework and student grades — so that an assignment can be created, submitted work retrieved and grades written back;
• files in Google Drive that MathFyx itself creates or that the teacher explicitly selects — for example a feedback PDF attached to a student's submission. We have no access to any other files in Drive.

MathFyx's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, data obtained from Google APIs: is used only for the features described above, which the teacher sees and controls; is not transferred to others except as described in section 5 where needed for grading; is not used for advertising; is not sold; and is not used to train or improve general-purpose artificial intelligence models. Humans access it only with the user's consent, for security purposes, or where required by law.

A teacher can disconnect at any time in the application's settings, or in their Google account settings. The stored access token is then deleted.

If a teacher signs in to their school's EduPage, MathFyx acts as that teacher and only for these features:

• it reads the school's classes and students (names, class membership and parents' identifiers), so the teacher can match work to students and messages can be addressed. This data is held only in the server's memory for at most 5 minutes and is not stored;
• it uploads the feedback PDF to the school's EduPage storage and sends the student a message with the assignment title, the points and, where applicable, the grade. If the teacher chooses so for the assignment, the parents registered with the student in EduPage receive the same message.

The EduPage password is not stored. We keep only the sign-in session EduPage issued, encrypted; when EduPage ends it, the teacher signs in again. A match suggested from the name on the paper or in the file name is only a suggestion, confirmed by the teacher.

A sent message cannot be withdrawn from MathFyx; within EduPage the school handles it under its own rules. MathFyx does not write grades into the EduPage grade book and does not download students' work from it.

A teacher can sign out of EduPage at any time in the application's settings, which deletes the stored session, the school address and the username. The record of which student was sent grading and when stays with the assignment, so it remains clear who received which grading.

Data is stored on the service operator's server in Slovakia, on a fully encrypted disk. The database is backed up once a day and each backup is kept for 14 days on the same encrypted storage. The entry gateway in Frankfurt (section 5) stores no data apart from its access log.

• A sign-in session expires after 24 hours without use.
• Assignments and submitted work are kept for as long as the school needs them. If a teacher deletes an assignment or a whole course that already contains grading — a grade, points or notes from the AI or the teacher, even incomplete, or a grading in progress — the assignment or course is only hidden and its data, including the record of the grading, is kept, so that the evidence of a published grade does not disappear. Only an assignment or course with no grading in it is deleted permanently straight away. The school can request permanent removal of the hidden data.
• When an account is closed, the name, email address, password, sessions and the Google and EduPage connections are removed immediately. Assignments and courses stay with the institution (its administrator can hand them to another teacher), and signed-off grades keep only an anonymous record that someone signed them off.
• A new teacher's email address is kept in the request only to send the invitation: it is deleted when the teacher creates the account, when we reject the request, or when the request expires — 30 days after approval if the teacher has not created the account by then. A request the school's administrator withdraws before a decision is deleted entirely. The first name, surname and the decision on the request (who approved it, when, and how many gradings) stay as a basis for billing until the school is removed from the service. When the teacher closes their account, their name is removed from the request and the invitation just as it is from the account; the decision stays.
• Messages from “Napíšte nám” (Write to us) are kept until we have handled them and then for 12 months from their handling, after which they are deleted. They are deleted sooner when their author's account is closed or when the school is removed from the service.
• An enquiry from the form on mathfyx.sk is kept in the service, and its notification in our mailbox, for 12 months from the last change of the enquiry's status (for example when we contacted you or settled the enquiry); then we delete them. If you order the service and we send you access to it from the enquiry, we keep them until the school is removed from the service; after that, the 12 months from the enquiry's last change of status apply. You can ask us to delete them sooner at any time at info@mathfyx.sk.
• Server logs are continuously overwritten and take up at most a few tens of megabytes.

• encrypted connections (HTTPS) and a fully encrypted server disk;
• access to students' work and names limited to the teachers of the course, checked on the server for every request; the institution's administrator does not teach and sees only aggregate statistics (counts, averages, score distributions) without students' names or work;
• Google access tokens and the EduPage sign-in stored encrypted; the EduPage password is never stored;
• a limit on sign-in attempts, and refusal of passwords known from breaches;
• student code runs in an isolated environment with no internet access and no access to other students' data.

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability and to object. Students and parents exercise these rights with their school; teachers and others may contact us at info@mathfyx.sk. We respond without undue delay and within one month at the latest.

If you believe the processing breaches the law, you may lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).

You can close your account yourself, in the app or on the web: after signing in, open Settings and, under “Zrušenie účtu” (Close account), choose “Zmazať môj účet” (Delete my account) and confirm with your password. If you cannot sign in, email info@mathfyx.sk with your sign-in name and school — we will verify that the account is yours before closing it.

What is deleted and what is kept is described in section 8.

We use only a strictly necessary cookie to keep you signed in, and the browser remembers your chosen appearance (light or dark). We use no analytics or advertising cookies and do not track you across websites.

Students do not use the service directly — only teachers and administrators have accounts. Students' data, including that of minors, is processed only on behalf of the school and to the extent needed to grade their work.

If the way we process data changes, we will update this policy and mark the change with the date at the top of the page. Schools are informed of material changes in advance.