Tämä asiakirja on saatavilla englanniksi ja tanskaksi. Lue tanskankielinen versio
Tietosuojaseloste
Päivitetty viimeksi: 3. marraskuuta 2026
This policy explains how personal data is handled in voice.school, the service at https://voice.school where teachers set assignments and students answer them out loud. It covers the website, the app and the emails we send.
1. Who we are
voice.school is provided by:
Edaptio II ApS
CVR 43660578
H.C. Andersens Boulevard 33, 4. th.
1553 København V
Denmark
Email: privacy@edaptio.com
In this policy, "we" and "us" mean Edaptio II ApS. We have not appointed a data protection officer. Write to privacy@edaptio.com with any question about your data.
2. Who is responsible for which data
That depends on the data.
- Students' data in a class belongs to the school. When a teacher uses voice.school with a class, the school is the data controller for the students' data: their accounts, recordings, transcripts, typed answers, grades, feedback, comments and integrity signals. For a Danish public school (folkeskole), the controller is usually the municipality. If a teacher uses voice.school outside a school, for example as a private tutor, the teacher is the controller. We are the data processor: we process the data only on the school's instructions, as set out in our data processing agreement.
- The rest is ours. We are the data controller for teacher accounts, the website, emails you send us, security and technical logs, and our product analytics about teachers.
If you are a student or a parent, your school is the right place to ask why your data is collected and how it is used. You are also welcome to write to us. If your request is about the school's data, we pass it on to the school and help it answer.
3. What we process and why
Account data
For everyone with an account: name, email address, role (teacher or student), preferred language, password (we store only a bcrypt hash, never the password itself), your Google account ID if you sign in with Google, your notification email setting, and when the account was created and last used.
We use it to create your account, log you in and send you emails. Account emails (confirming your email address, resetting your password, a warning before an inactive account is deleted) are always sent. Notification emails (a new assignment, returned feedback, a reminder 24 hours before a deadline) can be turned off in your settings.
If you sign in with Google, Google tells us your name, email address and Google account ID, and that the email address is verified. We get no other access to your Google account.
Teachers: classes and assignments
Class names and descriptions, join codes, assignments with their questions, time limits and deadlines, and which students are in which class. A student who opens a class link sees the class name and the teacher's name.
Students: answers and results
- Voice recordings. When a student answers a question, the browser records the answer and uploads it to our storage. The teacher of the class can play it back. We do not use recordings to recognise or identify anyone by their voice.
- Typed answers, where the assignment allows them.
- Transcripts. Each recording is transcribed automatically by an AI model. A transcript can contain mistakes, so the teacher can always listen to the recording.
- Progress: which questions the student got, and when they started, answered and finished.
- Grades, feedback and comments from the teacher. The student sees them when the teacher returns the work.
- Integrity signals, recorded while a student answers: switching away from the tab or window and for how long, blocked paste attempts, copy attempts, right-clicks, and the microphone being muted, unmuted or disconnected, each with the time and the question. The teacher sees them next to the answer. They are signals, not proof of cheating, and nothing happens automatically: the teacher decides what, if anything, they mean.
voice.school makes no automated decisions about anyone. AI is used only to turn speech into text. It does not grade or assess.
Technical data and logs
When you use the website or the app, our hosting provider Cloudflare and our servers process the technical data needed to deliver the pages and keep the service secure: IP address, browser and device type, the pages and addresses requested, times and error messages.
Product analytics
We use PostHog to see how voice.school is used: which features people use, where they get stuck and what breaks. The events are sent from our own servers, not by a script in your browser, to PostHog's EU cloud. They use no cookies and never contain names, email addresses, recordings, transcripts or answers. An event records, for example, that an assignment was published or an answer was submitted, together with an internal account ID and the role (teacher or student).
When you contact us
If you email us, we keep your email and our reply so we can help you and document what was agreed.
4. Legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Teacher accounts, classes and assignments | Article 6(1)(b): necessary to provide the service under our Terms |
| Account emails and notifications to teachers | Article 6(1)(b), and for notifications also Article 6(1)(f): our legitimate interest in telling you what happens in your classes. You can turn notifications off |
| Security, technical logs and preventing misuse | Article 6(1)(f): our legitimate interest in a secure, working service |
| Product analytics about teachers | Article 6(1)(f): our legitimate interest in improving the service |
| Answering your emails | Article 6(1)(f), or 6(1)(b) when it concerns your account |
| Complying with the law, for example bookkeeping if we introduce paid plans | Article 6(1)(c) |
| Students' data in classes, including student accounts | The school decides the legal basis. Public schools usually rely on Article 6(1)(e), a task in the public interest (teaching); private schools often on Article 6(1)(f). We process the data on the school's behalf under Article 28 |
5. Who can see the data
- Teachers see their own classes and everything their students do in them.
- Students see their own answers, recordings and transcripts, the grade and feedback once returned, and the class name and teacher's name. Students do not see each other's work.
- We can access data when it is needed to run, support or secure the service. Everyone who does so is bound by confidentiality.
- Our sub-processors (section 6) process data for us under data processing agreements.
- Authorities, if the law requires us to hand over data.
We never sell personal data, never use it for advertising and never use students' data to build profiles of them. We do not use recordings, transcripts or answers to train AI models.
6. Sub-processors and transfers outside the EU
| Company | What it does for us | Where |
|---|---|---|
| Amazon Web Services | Database (Amazon Aurora), storage of recordings (Amazon S3), sending emails (Amazon SES) | EU: the database and recordings in Frankfurt, Germany; email in Ireland |
| Cloudflare | Hosting of the website and app, the connection to the database, content delivery and protection against attacks | Cloudflare's global network: each request is handled in a data centre near the user |
| PostHog | Product analytics | EU: Frankfurt, Germany |
The sub-processor list has the details.
Transfers. Cloudflare and PostHog are US companies, and Cloudflare may process data outside the EU. Such transfers rely on the EU-US Data Privacy Framework (the European Commission's adequacy decision of 10 July 2023) for companies certified under it, and otherwise on the European Commission's standard contractual clauses in our agreements with the providers. AWS stores our data in the EU regions listed above.
7. How long we keep data
| Data | How long |
|---|---|
| Voice recordings | Deleted automatically 12 months after they were recorded. The transcript stays |
| Transcripts, typed answers, grades, feedback, comments and integrity signals | Until the teacher deletes the submission, assignment or class, or the account is deleted |
| Classes and assignments | Until the teacher deletes them or the teacher's account is deleted |
| Accounts | Until you delete your account. An account nobody has logged into for 24 months is deleted with everything in it. We email a warning 30 days before, and logging in keeps the account |
| Unconfirmed signups, password reset links and expired login tokens | Deleted daily once expired. Signup links expire after 7 days, password reset links after 1 hour |
| Notification emails we have sent | 30 days |
| Technical logs | At most 30 days |
| Product analytics events | At most 24 months |
| Database backups | 14 days. Deleted data disappears from the backups within 14 days |
| Emails between you and us | As long as needed to handle the matter, and at most 3 years after it was closed |
8. Deleting data
- Your own account: you can delete it in Settings. Everything you own is deleted with it. For a teacher, that includes your classes and all students' work in them.
- Teachers can delete a single submission (the student can then take the assignment again), an assignment or a whole class.
- Recordings are removed from storage within minutes of a deletion, and deleted data disappears from backups within 14 days.
9. Your rights
Under the GDPR you have the right to:
- get access to the data we hold about you, and a copy of it
- have wrong data corrected
- have data deleted
- have processing restricted
- receive data you have given us in a machine-readable format (data portability)
- object to processing based on legitimate interest, including product analytics
You can change your name and language and delete your account yourself in Settings. For anything else, write to privacy@edaptio.com. We answer within one month. If your request concerns a school's data, the school decides on it; we forward the request to the school and help it answer.
10. Complaints
You can complain to the Danish Data Protection Agency:
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark
dt@datatilsynet.dk
www.datatilsynet.dk
You can also complain to the data protection authority where you live or work. We would be glad to try to sort things out with you first, so please write to us.
11. Cookies and browser storage
voice.school uses no cookies or similar technology for tracking, advertising or analytics, and no third-party cookies. We store only what the service needs to work, which is why we don't ask for cookie consent.
Stored in your browser (local storage):
| Name | What it is | How long |
|---|---|---|
| access_token | Login token | Valid for 30 minutes, removed when you log out |
| refresh_token | Keeps you logged in, replaced each time it is used | Valid for 30 days, removed when you log out |
| vs_preferred_locale | The language you chose | Until you clear your browser data |
| nuxt-color-mode | Light, dark or system theme | Until you clear your browser data |
| pending_join_code | The class code from a join link, so you can finish joining after signing up | Removed when you have joined |
| vs_anonymous_session | A random ID created on the teacher signup page and sent with your signup. It contains nothing about you | Until you clear your browser data |
Cookies set when you log in:
| Name | What it is | How long |
|---|---|---|
| access_token | Login token (a backup for the one in local storage) | 30 minutes |
| refresh_token | Keeps you logged in | 30 days |
| g_oauth_state | Protects the Google sign-in against forged requests | 10 minutes, only during Google sign-in |
These cookies cannot be read by scripts on the page and are sent only to voice.school. Cloudflare, which delivers the site, may in some cases set a strictly necessary security cookie (such as __cf_bm) to tell people from bots.
You can remove all of it by logging out and clearing the site's data in your browser. You will then be logged out, and your language and theme go back to the defaults.
12. Security
All traffic is encrypted with TLS (HTTPS). The database and the recordings are encrypted at rest. The database is not open to the internet: the service connects to it through Cloudflare over a tunnel protected by Cloudflare Access. Recordings are stored privately and are uploaded and played through links that expire after one hour. Each user can only reach their own data, logins use short-lived tokens, and repeated login attempts are limited. The data processing agreement (appendix C.2) describes the measures in full.
13. Children
Many students who use voice.school are children. Students normally get an account through their teacher's class link, and we process their data only on behalf of their school. We never use children's data for marketing, advertising or profiling, and we never sell it. The school decides whether voice.school suits its students' age, and it informs students and parents about how the service is used.
14. Changes to this policy
We update this policy when the service or the law changes. The date at the top shows when it last changed. If a change matters to you, we tell you by email or in the app before it takes effect.