Privacy Policy

Last updated: 5 October 2026

This policy explains how SIA “Riga International Tuition Centre” (“Datorium”, “we”) processes personal data when you use Datorium.AI, visit our website or contact us, and what rights you have.

1. Who we are

The controller is SIA “Riga International Tuition Centre”, registration number 40103978328, Brīvības gatve 204B, Riga, LV-1039, Latvia, which operates Datorium.AI.

For any question about your personal data or to exercise your rights, write to hello@datorium.eu with the subject “Data protection”.

2. Who this policy covers

This policy covers the personal data we process for our own purposes:

teachers and other individuals who create an account and use Datorium.AI;
visitors to our website;
people who contact us, request a quote or subscribe to our newsletter.

Schools and municipalities. When a school or municipality provides Datorium.AI to its teachers and pupils, or a teacher invites pupils to work in it, the school or municipality is the controller of that personal data, and Datorium processes it only on its instructions as its processor under a Data Processing Agreement. That processing is governed by the school’s or municipality’s own privacy notice, not by this policy. Questions about it are best addressed to the school, which can also contact us. How we act as a processor, and which service providers we use, is described on our Trust Centre.

3. What personal data we process and where it comes from

Account data. Examples: name, email address, password (stored only as a salted hash), language, role, school name, the date and time of sign-ins. Source: you, when you register.
Sign-in data. Examples: your identifier, name and email address at Google or Microsoft; for e-Klase and eKool also your school and class or role. Your personal identification code is received at sign-in and is not stored. Source: the sign-in provider you choose.
Content. Examples: lessons, materials and prompts you create, documents you upload, instructions you give the AI. Source: you.
Payment data. Examples: name, email address, subscription and invoice details. Card details are entered directly with Stripe; we never receive them. Source: you and Stripe.
Enquiries. Examples: name, email address, phone number, school and your message. Source: you, through our contact and quote forms.
Newsletter. Examples: email address and language. Source: you.
Usage and technical data. Examples: pages visited, features used, device and browser type, IP address, cookie preferences. Source: your device, as described in section 9.

You do not have to give us personal data, but without an email address or a sign-in provider we cannot create an account, and without payment details we cannot provide a paid subscription.

4. Why we process it and on what legal basis

Creating and running your account, providing the features you use, and support. Legal basis (GDPR): performance of our contract with you, Art. 6(1)(b).
Payments, invoicing and subscription management. Legal basis (GDPR): performance of the contract, Art. 6(1)(b); keeping accounting records, legal obligation, Art. 6(1)(c).
Answering your enquiry or quote request. Legal basis (GDPR): steps at your request before a contract, Art. 6(1)(b), or our legitimate interest in answering, Art. 6(1)(f).
Service emails such as verification, password reset and account notices. Legal basis (GDPR): performance of the contract, Art. 6(1)(b).
Newsletter. Legal basis (GDPR): your consent, Art. 6(1)(a).
Product analytics with cookies. Legal basis (GDPR): your consent to analytics cookies, Art. 6(1)(a).
Counting visits without cookies and without identifying you, when analytics cookies are declined. Legal basis (GDPR): our legitimate interest in knowing how many people use the website, Art. 6(1)(f).
Marketing measurement. Legal basis (GDPR): your consent to marketing cookies, Art. 6(1)(a).
Keeping the service secure, preventing abuse and rate-limiting sign-in attempts. Legal basis (GDPR): our legitimate interest in a secure service, Art. 6(1)(f).
Establishing, exercising or defending legal claims; complying with lawful requests from authorities. Legal basis (GDPR): legitimate interest, Art. 6(1)(f); legal obligation, Art. 6(1)(c).

Where we rely on legitimate interest, you may object (section 8).

5. Who receives personal data

We share personal data with the following recipients:

cloud hosting, database, file storage and search (Amazon Web Services);
hosting of the web application (Vercel);
AI providers, which process the prompts and documents you submit. We do not send them your name, email address or other account details, but if you include personal information in your prompts or documents, they will receive it;
payment processing (Stripe);
email delivery (Brevo);
the sign-in provider you choose (Google, Microsoft, e-Klase or eKool);
with your consent, product analytics (PostHog) and marketing measurement (Meta).

Each provider, its purpose and where it processes data is listed on our Trust Centre. We disclose personal data to public authorities, courts or professional advisers only where the law requires it or where it is needed to establish, exercise or defend legal claims.

6. Transfers outside the European Economic Area

Where a provider processes personal data outside the European Economic Area (the Trust Centre marks each one), the transfer is covered by a European Commission adequacy decision or by the Commission’s standard contractual clauses.

7. How long we keep personal data

Account data and content. Kept for: while your account exists. When you ask us to delete your account, we delete it within one month.
Payment and invoicing records. Kept for: the period accounting and tax law requires.
Enquiries. Kept for: as long as needed to answer you and, if you become a customer, for the duration of that relationship.
Newsletter subscription. Kept for: until you unsubscribe or withdraw consent.
Server logs. Kept for: one month.
Analytics data. Kept for: as long as needed to understand how the service is used.
Cookie preferences. Kept for: until you change them or clear your browser storage.

Data may be kept longer where it is needed to establish, exercise or defend a legal claim, and only for that purpose.

8. Your rights

You have the right to:

access the personal data we hold about you and receive a copy;
rectify inaccurate or incomplete data;
erase your data where there is no longer a reason to keep it;
restrict processing, for example while a correction is checked;
data portability: receive data you gave us, in a structured, machine-readable format, where processing rests on consent or contract;
object at any time to processing based on our legitimate interest, and at any time to processing for direct marketing;
withdraw consent at any time, without affecting processing before the withdrawal. Cookie consent can be changed through “Manage Cookies” at the foot of every page; the newsletter by writing to us.

Write to hello@datorium.eu. We answer within one month, which may be extended by two further months for complex requests, in which case we tell you why. We may ask you to confirm your identity.

You also have the right to lodge a complaint with a data protection supervisory authority.

9. Cookies and similar technologies

We use the following categories, and you choose which of the optional ones to allow when you first visit and at any time through “Manage Cookies”.

Strictly necessary. What it does: keeps you signed in, remembers your language and stores your cookie choices. Duration: sign-in: 7 days for teachers, 1 hour for pupils. Language and cookie choices: until changed or cleared. Requires consent: no.
Analytics (PostHog). What it does: tells us which pages and features are used, so that we can improve them. Duration: 1 year. Requires consent: yes.
Marketing (Meta). What it does: measures whether our campaigns lead people to Datorium.AI. Duration: the campaign click identifier is kept in your browser until you clear it. Requires consent: yes.

If you decline analytics cookies, we may still count page visits without storing anything on your device and without identifying you.

10. Changes to this policy

We update this policy when our processing changes. The date at the top shows when it last changed.