This policy explains what EduOS, a product of Strixa does with personal data, in plain terms. We've written it to be read rather than skimmed, because a company whose value is "boring where it counts" should be able to explain itself in one sitting.
What we collect
Account data you give us: name, work email, organisation, role, and the contents of anything you send us through a form.
Operational data your organisation puts into the platform, which may include records about your staff, and — where the product handles education — records about pupils and their guardians.
Technical data generated by use: IP address, device and browser type, pages visited, and timestamps. We use this for security, reliability and capacity planning.
What we do not collect
We do not buy personal data from brokers, we do not run advertising trackers on our product surfaces, and we do not sell or rent personal data to anyone, under any circumstances.
We do not use your operational data to train models that would benefit another customer.
Our role
For data your organisation puts into the platform, your organisation is the controller and we are the processor. We act on your documented instructions.
For the data we collect about our own relationship with you — enquiries, contracts, billing, and site analytics — we are the controller.
Legal bases
We rely on contract where processing is necessary to provide the service you have bought, legitimate interests for security, fraud prevention and service improvement, consent for optional communications, and legal obligation where retention or disclosure is required by law.
Sub-processors
We use a small number of sub-processors for hosting, error monitoring, email delivery, payment handling and the AI features described below. The current list is available on request and we give 30 days' notice before adding a new one, so you have time to object.
Where AI is involved
Some features send content to a third-party model provider to produce an answer: in HostOS, the questions you ask the assistant along with the records needed to answer them; in EduOS, the textbook pages you select and a student's side of a tutoring conversation.
Those features only ever draw on your own data. We do not use your content to train models, we do not permit our providers to train on it, and nothing from one customer is ever used to answer another's question.
Tutoring conversations are stored against the student they belong to so a session can be resumed, and are visible only to that student. A school can delete them.
Retention
Operational data is retained for as long as your agreement is live, and deleted within 30 days of termination unless you ask us to hold it longer or the law requires otherwise.
Enquiry data is retained for 24 months. Security logs are retained for 12 months.
Where data lives
Data is stored in the region agreed in your contract. Where a transfer outside that region is necessary, we use approved safeguards and we tell you before it happens.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. Export is always available with no notice period — lock-in is not a business model.
To exercise any of these, email privacy@strixa.org. We respond within 30 days, usually far sooner.
Children
EduOS handles records about pupils, including children. We process those records only on the documented instructions of the school or trust that controls them, we apply additional access controls and audit logging to safeguarding records, and we never use them for any purpose other than delivering the service.
Security
Encryption in transit and at rest, least-privilege access with mandatory review, isolation between customers enforced by the database itself, and audit logging on sign-in and on changes to accounts. If a breach affects you, we will tell you without undue delay and within any statutory deadline.
Changes and contact
We will post material changes here and, where the change affects you meaningfully, tell you directly rather than relying on you to notice.
Questions go to privacy@strixa.org.