A. Who we are and what this policy covers

Version 4.0 - Effective from 2026-09-30.

Open Alfie B.V. provides Alfie, an AI-assisted service that helps teachers create educational material. This Privacy Policy explains which personal data we process, why, with whom we share it, how long we keep it, and which rights you have. It applies to the Alfie app and website. Our views on responsible AI in education are explained on our AI transparency page.

1. Our role: controller or processor

If you use Alfie with an individual account or subscription, Open Alfie B.V. is the controller for everything in this policy. Where Alfie processes personal data on behalf of your school or organization, that organization is the controller and Alfie is its processor. Where required by applicable law, including the GDPR, this processing must be governed by a binding data processing agreement; the role does not depend on whether that agreement has been signed. Open Alfie B.V. remains controller for its own billing administration and for the other purposes this policy specifically identifies as our own. Sections marked "school accounts" explain the differences. Requests about school-account data go to your school, which we assist. Alfie is intended for teachers and other adults working in education.

B. How do we handle your data when using Alfie?

What data do we store?

2.1 Account, billing, and communication data

• Your name and email address are collected for account creation and communication purposes. If you sign in with Google, see section 2.4.
• Your language preference, your role in your organization (if any), and the status of your account and licence.
• Data related to your subscription, such as the type of subscription and your payment status. We do not store full payment details ourselves; our payment provider Stripe holds them, together with your billing address and, for organizations, VAT number.
• Messages you send us, for example through the contact form or by email.

2.2 Learning objectives, Sources, Notes, and generated Material

We process your learning objectives, instructions, chat messages, uploaded or imported Sources, Notes, and generated Material. We also keep the extracted text, images, summaries and search information needed to use Sources, and which Sources and Notes were used for each activity.

Your content is private to your account unless you explicitly choose to share it. If we offer a sharing feature, we will show what is shared and with whom before you confirm. Do not include identifiable personal data about Learners or other people. Alfie does not automatically check Sources for personal data.

2.3 Usage and technical data

• Usage and AI logs: your actions, user and organization identifiers, language, browser/device details, timestamps and token use. For support and troubleshooting, we also log AI instructions and outputs, which may include copies of your content; the same restrictions apply to those copies.
• Server and audit logs: technical requests, which may include IP addresses, and Google Cloud security/platform audit records.
• Website analytics: Google Analytics 4 measures visits and engagement, including changes around newsletters and website updates. Google Tag Manager manages the tags.

Sections 3.4 and 3.6 explain permitted uses, section 4.2 lists retention periods, and section 8.1 explains cookies and consent.

2.4 Google sign-in and Google Drive

Google sign-in. We receive your name, email address and profile picture link to create your account and show your picture. We use these details for the purposes in this policy, including account management, billing and notifications, and share them only with the providers in section 7. Signing in does not give us access to other Google data. We do not sell this information.

Google Drive import (optional). Alfie accesses only the files you select and saves its own copy as a Source, without ongoing access to your Drive or access to other files. Deleting that Source does not delete your Drive original; disconnecting Google does not erase Alfie's copy. You can request erasure under section 4.4.

We use selected files and extracted content to provide and support the features you request, not to train shared AI models or build a shared source library. Any other internal improvement use must meet Google's requirements, your rights and section 3.6. These restrictions continue after account links are removed.

Our use and transfer of Google API data follows the Google API Services User Data Policy, including the Limited Use requirements where applicable.

Why are we allowed to use your data?

3.1 Consent

Where a processing purpose requires your consent, such as optional marketing tracking or non-exempt analytics using your device, we ask for it separately. You can withdraw it at any time. Reading or acknowledging this policy, or accepting the Terms, does not itself give consent for marketing or optional tracking. Our individual-user communications and the related analysis are described in section 3.4.

3.2 Execution of the Agreement

We use your data to provide the services you have signed up for, such as creating your account, processing payments, storing your Sources and Notes, and generating educational materials.

3.3 Compliance with Legal Obligations

We are legally required to retain financial transaction data for tax purposes.

3.4 Legitimate interest

We use pseudonymised usage data and relevant AI logs for security, abuse prevention, content reports, support and understanding how Alfie is used. This serves our legitimate interests and those of our users; section 6 explains your right to object. Content copies remain subject to section 3.6. School-controlled data follows the school's documented instructions, applicable law and any agreed DPA.

Service messages. We may email you about feedback, support and relevant service or legal matters, regardless of marketing preferences.

Individual offers. For individual Free and paid accounts, we use professional email domains, account/subscription details and limited activity indicators, such as recent use and material counts, to identify interest in team plans. We may invite active users to introduce Alfie to their school or team, and send offers about Alfie and our own similar services at most twice a year.

School outreach. We may contact prospective organizations with aggregated counts of individual users and materials created. We do not share names, individual activity records, material contents or counts that reveal an individual's usage. School-directed accounts and activity are excluded from sales analysis and outreach, even without a signed DPA.

Our interest is to develop relationships with interested users and organizations, balanced against your privacy and reasonable expectations. You can turn offers off in Settings, separately from newsletters, or object free of charge by replying or emailing team@alfie.school. A general objection stops all direct marketing and related selection/profiling; we retain only what is needed to honour it. Service and legal notices continue.

3.5 Instructions of your school (school accounts)

Where we process data on your school's or organization's behalf, we follow its documented instructions for teacher account data, usage data, Input and generated Material, under applicable law and any agreed DPA. Your school decides the purposes; we do not use that content for our own purposes, except for content without personal data as described in section 3.6.

3.6 AI processing, training, and improvement

To generate material, Alfie sends your learning objectives, instructions, Notes, and relevant passages of your Sources to AI models operated by our providers (see section 7). We instruct our providers to process this data only to deliver the service to us. Google, our main provider, processes this data under terms that do not allow it to train its models on it. Other AI providers are used only under verified arrangements that support these restrictions. We may choose among the providers and model routes described in section 7 according to the task, quality and availability. School accounts use only routes permitted by the applicable DPA and recorded instructions; an existing school’s narrower choices continue to apply.

We do not use personal data to train AI models, and we do not use content that contains personal data to improve or develop Alfie. Usage data is used only as described in section 3.4. Learning objectives, Sources, Notes, and Material that contain no personal data may be retained and used by us to correct errors and to evaluate, improve, and develop Alfie, including its prompts, templates, and our own models, as described in Part A, section 3.4 of our Terms.

How long do we retain your data?

4.1 While you use Alfie

We keep account data and your library while needed to provide your active account. We do not automatically delete an account solely because it is inactive. Rolling retention periods for logs and completed support matters still apply while your account is active; they do not remove your login or library. You can ask us to remove or erase Sources and Material, export your content or delete your account. The effects are explained below.

4.2 Retention periods

Data	How long
Individual account data, Sources, Notes, activities and Material	While needed for your active account; personal data is removed from active systems within 30 days of an erasure request, with the exceptions below.
School accounts and content	The school’s agreement and instructions determine retention, deletion and what may remain in a continuing individual account.
Usage and AI logs	Up to 24 months from the event, with earlier erasure or anonymisation where required.
Ordinary Google Cloud server logs	Up to 24 months; other providers’ logs follow their applicable retention and erasure arrangements.
Required Google Cloud audit logs	400 days, fixed by Google Cloud.
Support, contact and content reports	Up to 2 years after closure, unless earlier deletion is required.
Required tax and invoice records	7 years.
fal.ai request history and generated images	Request inputs and outputs: 30 days by default. Image files follow separate storage settings and are included in erasure handling.
Slack notifications	90 days.
Recovery copies	Up to 98 days after deletion from active systems, solely for recovery and security.
Google Analytics 4	Event data: 14 months; user data: up to 14 months after your latest activity; aggregated reports may remain longer.

When restoring a backup, we reapply required deletions before using the data again; stricter school agreements still apply.

We may retain anonymised data that can no longer reasonably identify you. Data that remains identifiable is subject to the retention periods and rights described in this policy.

4.3 Financial Data Retention Obligation

Financial data is retained for 7 years in accordance with tax legislation.

4.4 Removing and deleting your content

Email team@alfie.school for removal, erasure or export. We currently handle requests manually.

• Library removal: hides the item from your library; it does not erase every copy. This policy's purposes, rights and retention periods still apply.
• Source erasure: removes Alfie's Source copy and prepared data from active systems within 30 days, subject to section 4.2. Your Google Drive original is unchanged. Existing activities may retain passages or Notes; tell us if those are also in scope. For personal-data erasure, we find relevant copies without requiring you to name every storage system.
• Material or Activity erasure: removes the whole item from active systems within 30 days, subject to section 4.2. Editing or removing an exercise is not a separate erasure service and may leave its stored record.
• Account erasure: removes personal data subject to section 4.2; anonymous data and eligible non-personal content may remain under the Terms. Copyright and Google-import restrictions still apply.

For school-controlled data, we follow the school's documented instructions, applicable law and any agreed DPA. We explain any exception or information needed to fulfil your request. Statutory consumer rights to retrieve content and restrict its continued use remain unaffected.

How do we secure your data?

5.1 Technical Security Measures

We use recognized software for storing and securing your data. Furthermore, we follow best practices to protect your data against unauthorized access and data breaches. These include, for example, the use of HTTPS for sending data, securely storing our access keys, and regularly checking the security of our systems.

5.2 Data Storage and Access Control

Our core application database and your files are stored on servers within the EU, with strict access controls. Some providers store or process data outside the EU; section 7 explains where and under which safeguards. Our staff have access to your data on a need-to-know basis, for example to help you with a support question, to investigate an error, or to handle a report about content.

5.3 Management of Administrative Access

Access to data for management and maintenance is limited to a minimum number of employees and has its own authentication process. Our developers must be logged in before they can access your data.

6. What rights do you have as a user of the app?

Under the GDPR, you have certain rights regarding the processing of your personal data. These rights include:

• Access: You have the right to access the data we process about you.
• Rectification: If we hold incorrect or incomplete data about you, you have the right to have it corrected.
• Erasure: You have the right to have your data deleted by us.
• Restriction: You have the right to temporarily restrict the processing of your data.
• Objection: You can object to processing based on legitimate interests. You can always object to direct marketing and the related profiling, free of charge; we then stop that use.
• Data portability: You have the right to receive the data you provided to us in a machine-readable format.
• Withdraw Consent: You have the right to withdraw your consent for the processing of your personal data, insofar as the processing is based on your consent.
• Complaint: You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority in your country.

You can submit your requests to us at team@alfie.school. We may ask you to confirm your identity, for example by writing from the email address of your account. We respond within one month. School accounts: if your school is the controller for your content, we forward requests about that content to your school and help it respond.

7. Which third parties do we share your data with?

The table below lists our providers and the fallback services we may use. The limited organization-level statistics described in section 3.4 are a separate disclosure to prospective organizations, not a provider service. Most providers process data on our behalf and on our instructions; Stripe also acts as an independent controller for payment processing under its own privacy policy. We do not sell personal data. School accounts: this table identifies providers that may act as subprocessors; the agreed DPA determines which are permitted for your organization. Schools receive direct written notice of a proposed new or changed subprocessor at least six weeks before it is introduced and can object, as the agreement describes; schools can also subscribe to updates of this list by emailing team@alfie.school.

7.1 Our providers

Provider	What for	Which data	Where
Google (Google Cloud, Firebase, Gmail and Google Tag Manager)	AI generation, accounts, hosting, storage, document processing, security, logs, email and tag management	Account data, Input, generated Material and usage logs	Core database, files, standard images and document processing: EU. Text and high-quality images, authentication and email: global, including outside the EU. Log storage has a global location designation.
Netlify	Website and app hosting, including login checks	Login sessions and account data needed to show your pages	United States for server processing; a distributed delivery network also processes data outside the EEA
Stripe	Payments and invoices	Name, email, billing address, VAT number and subscription status; payment-card details are held by Stripe only	Ireland and United States
fal.ai	Fallback image generation when the primary image service fails	Image instructions, generated images and request records; no account profile is sent as standard	United States
OpenRouter and model providers such as OpenAI and Anthropic	Optional fallback text generation	AI instructions, relevant source passages and supported input; no account profile is sent as standard	United States and the selected model provider’s processing locations
Slack	Signup and operational notifications, including recognising school interest	User IDs and email addresses	United States
Google Analytics 4	Website traffic and engagement	Page views, interactions, page addresses, city-level location, browser/device details and analytics identifiers	Global processing, including the United States

We may use OpenRouter for fallback text generation. Model providers may retain requests under their applicable retention terms.

Where providers process data for their own purposes, their own privacy policies apply, such as Stripe's Privacy Policy.

7.2 International transfers

Our core database and files are stored in the European Economic Area (EEA). For processing outside it, the providers use the following transfer safeguards:

• Google, including Analytics: the EU-U.S. Data Privacy Framework and the standard contractual clauses in the applicable Google Cloud and Analytics data-processing terms.
• Stripe: the transfer safeguards in its Data Processing Agreement and Data Transfers Addendum.
• Netlify: standard contractual clauses in its incorporated Data Processing Agreement.
• Slack: participation through Salesforce in the EU-U.S. Data Privacy Framework for covered U.S. transfers.
• fal.ai and OpenRouter: standard contractual clauses in their Data Processing Agreements.

A provider's inclusion here does not override a school's agreed restrictions. You can request information or a copy of the safeguards at team@alfie.school. We aim to keep as much AI processing as possible in the EU; some routes operate globally.

What cookies do we use?

8.1 Cookies and similar techniques

Necessary storage. Cookies and similar browser storage keep you signed in, remember checkout choices and limit repeated verification emails. Session storage normally ends with the session; other settings remain until they expire or are cleared. Stripe also uses necessary payment and security technologies.

Analytics. Google Analytics 4 measures website traffic and engagement, using the data in section 7.1. Google Tag Manager manages our tags. Current advertising features are off; optional account data sharing is limited to technical support, and email redaction reduces collection of email addresses. Section 4.2 lists retention periods.

Consent. Necessary storage needs no consent. Analytics may also operate without consent where it has little or no privacy impact and meets the legal conditions. Privacy-sensitive analytics and marketing tracking require prior consent. If we introduce consent-based measurement, we will explain its purpose and data use and let you accept, refuse or withdraw consent.

YouTube. Our links open YouTube; they do not load a video player on our website. YouTube's privacy and cookie policies apply when you visit it.

C. Other Provisions

What if we change something in this statement?

9.1 Procedure for Changes

We reserve the right to change or update this privacy statement at any time. We always note the version and the date when the statement was last modified, and keep internal records of changes. If a change is important for you, for example a new provider or a new purpose, we inform you by email or in the app before it takes effect; schools receive direct written notice as their data processing agreement provides. You can consult this statement from time to time for the most up-to-date information.

Do you want to talk to us about privacy?

10.1 Contact

For questions about our privacy statement, you can contact us via our contact form or directly at team@alfie.school. We are open to your feedback and questions. Reports about unlawful content: support@openalfie.nl (see our Terms, Part D, section 4).

Open Alfie B.V.
Beiroetdreef 22, 3564 XC Utrecht, the Netherlands
Chamber of Commerce (KVK): 90017102

Version 4.0 - Effective from 2026-09-30