1. Introduction
Praxis ("we", "us") is an AI-supported educational system. We value privacy and comply with GDPR. Praxis is not intended for handling sensitive personal data and includes technical safeguards to reduce the risk that such information is processed.
2. Roles Under GDPR
Controller
The education provider, such as the university, is the controller for student data in the educational context.
Processor
Praxis (Virtualis) processes personal data on behalf of the education provider according to agreement and instructions.
Subprocessor
AI processing that may contain personal data must be routed through reviewed EU/Sweden-resident provider routes according to customer and production configuration.
For questions about processing within a specific course, we primarily refer to the education provider privacy policy and local instructions.
3. What Personal Data Is Processed?
Identifiers
Email address, to receive and answer messages.
Education-Related Content
Message subject and body connected to course learning activities.
Technical Metadata
Timestamps, delivery status, and limited operations and security logs.
Consent / Information (Optional)
Tracking of whether an information notice has been sent and/or consent exists, depending on customer configuration.
We recommend that users do not send sensitive personal data. Praxis includes technical controls that can stop certain especially protected information.
4. Why Is Data Processed?
- To provide course-based educational support and generate responses to education-related questions.
- To manage course and access settings, for example per subscriber.
- For operations, troubleshooting, and security with limited and privacy-friendly logging.
- To meet legal and contractual requirements.
5. Legal Basis
The legal basis depends on the context and the education provider role as controller. Common bases in education may include contract, public interest/exercise of official authority, or legitimate interest.
Praxis can support configurable information and consent flows per subscriber. These are used when the education provider considers them appropriate.
6. Data Minimization and Safeguards
Hard Block
Messages that may contain national identity numbers or login credentials are stopped.
No Store
When blocked, message content is not stored and no AI processing takes place.
Sanitization
Data minimization and sanitization before external AI is used, when enabled.
Limited Logging
No raw text in logs; only necessary metadata and safe indicators.
7. Sharing and Transfers
Email Provider
Email data is processed and stored within Sweden/EU according to the provider statement. A processor agreement/DPA is available.
AI Processing (EU/Sweden)
AI processing that involves student data must use the reviewed EU/Sweden-resident provider chain. Praxis must not fall back to an unreviewed route for student data.
Praxis uses configurable AI routing. Student data must be processed through reviewed EU/Sweden-resident provider routes, and the current provider/model configuration must be verified before each pilot or customer deployment.
Additional safeguards: In addition to EU/Sweden-resident processing, we apply strict data minimization and sanitization before AI processing, maintain data processing agreements (DPA) with relevant subprocessors, and use standard contractual clauses (SCC) as an additional legal safeguard.
8. Retention and Deletion
Praxis applies storage minimization. Retention rules may vary by customer and course configuration. Where relevant, automated cleanup jobs are used to enforce retention.
Educational Interactions
Retained during the course period and for a limited time afterward according to configuration and need. Blocked messages are not stored.
Technical Logs
Limited retention. Privacy logs, such as AI inspection logs, can be purged automatically by scheduled jobs when enabled.
Automated cleanup requires scheduled jobs to be enabled in the runtime environment. For questions about customer-specific retention, contact the DPO contact.
9. Your Rights
You have the right to request:
- Access to personal data
- Rectification
- Erasure, where applicable
- Restriction of or objection to processing
- Data portability, where applicable
Contact the data protection contact: privacy@praxis.virtualis.se. Please include GDPR Request in the subject line.
10. Security
Praxis uses technical and organizational safeguards such as encryption, access control, limited logging, and regular security and privacy reviews.
11. Cookies
Praxis uses only necessary cookies for system functionality, such as session management. No analytics or marketing cookies are used.
12. Changes
We may update this policy when functionality or regulations change. Material changes are communicated through appropriate channels.
13. Contact
Data protection contact (DPO): Jonas Sjöström • privacy@praxis.virtualis.se