Privacy Policy

Modality Learning

Who We Are

Introduction

What Data We Collect

1. Account Information

• Email address (required for account creation)
• Authentication credentials (securely hashed, managed by Firebase Authentication)
• Account creation date
• Last login date
• Authentication method (Google OAuth or username/password)

2. Learning Activity Data

• Module enrollments: Which courses you're registered for
• Progress tracking: Topics completed, current progress percentages
• Interaction history:
  • Questions you answered
  • Explanations you provided
  • Analogies or connections you made
  • Content you viewed and when
  • Time spent on activities
• Assessment results: Scores, completion dates, attempts

3. Cognitive Modeling Data

• Coverage scores (0-1) indicating demonstrated understanding of facts
• Quality of explanations provided
• Accuracy of connections made between concepts

• Stability scores indicating memory strength
• Review history and timing
• Predicted optimal review dates

• Assessment attempts and results
• Mastery status by topic
• Performance trends over time

4. Behavioral Interaction Data

• Pages visited and navigation patterns
• Features used
• Errors encountered
• Help requests or support interactions
• Device type and browser (anonymised)

5. Feedback and Communications

• Feedback you provide about the platform
• Support emails or inquiries
• Survey responses (if you choose to participate)

What We Do NOT Collect

• Plain-text passwords (if you use username/password authentication, passwords are securely hashed by Firebase and we never see the actual password)
• Google password (if you use Google OAuth, we never see your Google password)
• Financial information (platform is currently free)
• Precise location data
• Biometric data
• Health data (unless you voluntarily include it in responses)
• Data from other websites or apps

How We Use Your Data

Legal Basis for Processing

• You explicitly consent to create an account and use the platform
• You consent to behavior tracking for personalized learning
• You can withdraw consent at any time

• Improving our platform and algorithms
• Preventing fraud and abuse
• Ensuring platform security
• Conducting research (using anonymised data)

Specific Uses

• Authenticate your login
• Track your learning progress
• Save your place in courses
• Display your personalized dashboard

• Recommend next topics based on your progress
• Schedule spaced repetition reviews
• Adjust content difficulty to your level
• Identify knowledge gaps and suggest bridging content

• Analyze interaction patterns to improve algorithms
• Identify bugs and usability issues
• Test new features and improvements
• Train our cognitive modeling systems

• Study effective learning patterns (anonymised)
• Publish academic research (you will never be identified)
• Validate adaptive learning approaches
• Improve educational technology

• Send trial updates and important notices
• Request feedback
• Provide support
• Notify about trial conclusion

Automated Decision-Making

What Decisions Are Automated

• Algorithm analyzes your progress and understanding
• Suggests next topics to study
• Identifies prerequisite gaps

• Spaced repetition algorithm calculates optimal review timing
• Predicts which facts need reinforcement
• Schedules review sessions

• System adapts content complexity based on performance
• Adjusts challenge level to maintain engagement
• Balances learning pace

• System selects representative questions from knowledge graph
• Adapts difficulty during assessments
• Determines mastery status

Your Rights Regarding Automated Decisions

• Human review - Request your facilitator review automated recommendations
• Explanation - Understand why certain content was recommended
• Contest - Disagree with mastery assessments and request manual evaluation
• Opt-out - Request manual content selection (though this limits platform functionality)

How We Share Your Data

Who We Share With

• Your enrollments and progress in their courses
• Your assessment results and mastery status
• Your interaction patterns (to help them improve teaching)
• NOT your individual explanations (unless they specifically request to review for educational purposes)

• Firebase Authentication (Google) - Account authentication and security
• Google (if you use Google OAuth for login)
• [Cloud hosting provider] (data storage - UK/EU servers)
• [Analytics provider if used] (anonymised usage patterns)

• Sell your data to anyone
• Share with advertisers
• Provide to third parties for marketing
• Share across different trials or studies without consent

International Transfers

• Primary data storage: UK/EU data centers
• Some processors may be outside UK/EU but we ensure they provide adequate protection through:
  • Standard Contractual Clauses
  • Adequacy decisions
  • Other approved transfer mechanisms

How Long We Keep Your Data

During Active Use

After You Delete Your Account

• Immediate deletion: We delete personal identifiers within 30 days
• Anonymised retention: If you consent, we keep anonymised learning patterns for research (no way to identify you)

Inactive Accounts

• Flagged for review
• Archived (data retained but account access suspended)
• Deleted after notification to your registered email

Legal Obligations

• Required by law (e.g., financial records, legal disputes)
• Necessary to defend legal claims
• You've consented to longer retention

Your Rights Under UK GDPR

Right to Access

• Response time: 30 days
• Cost: Free

Right to Rectification

• Update your email or course enrollment information
• Correct errors in progress tracking

Right to Erasure ("Right to be Forgotten")

• We'll delete within 30 days
• Anonymised research data may be retained
• Some data may be required for legal purposes

Right to Restriction

• Your account will be frozen
• Data won't be deleted but won't be used

Right to Data Portability

• We'll provide JSON or CSV export
• Includes all your progress and interaction data
• Can transfer to another platform

Right to Object

• We'll stop unless we have compelling legitimate grounds
• You can always object to marketing (though we don't do any)

Right to Withdraw Consent

• Email modality-privacy@shiftlabs.uk
• Takes effect immediately
• Doesn't affect past processing

Right to Lodge a Complaint

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wylde House, Water Lane, Wilmslow, Cheshire SK9 5AF

How to Exercise Your Rights

• Subject line stating your request (e.g., "Data Access Request")
• Your registered email address
• Specific request details

• Verify your identity
• Respond within 30 days (may extend to 60 days for complex requests)
• Provide requested information or explain why we can't

Data Security

How We Protect Your Data

• Encryption in transit: HTTPS/TLS for all connections
• Encryption at rest: Database encryption
• Access controls: Role-based access, need-to-know basis
• Regular backups: Automated, encrypted backups
• Security monitoring: Logging and alerting for suspicious activity

• Staff training: Team members trained on data protection
• Confidentiality agreements: All staff sign NDAs
• Limited access: Only necessary personnel access personal data
• Regular reviews: Security assessments and updates

Data Breaches

• We'll notify you within 72 hours
• We'll report to the ICO as required
• We'll explain what happened and what we're doing about it
• We'll advise you on protective steps

Children's Privacy

Age Requirements

• Minimum age: 13 years old
• Under 18: Parental awareness recommended

Special Protections for Minors

• We use age-appropriate language
• We limit data collection to essential purposes
• We don't use data for profiling or marketing
• Parents can request access to or deletion of their child's data

Parental Rights

• Access their data
• Request correction or deletion
• Withdraw them from the trial
• Ask questions about how data is used

Cookies and Tracking Technologies

What We Use

• Authentication session (keeps you logged in)
• Security tokens (prevents CSRF attacks)
• User preferences (settings you've chosen)

• Anonymised usage statistics
• Feature adoption tracking
• Error reporting

Your Choices

• Advertising cookies
• Social media tracking pixels
• Cross-site tracking

Cookie Policy

Changes to This Privacy Notice

How We Update

• Changes in data processing practices
• New features or services
• Legal or regulatory requirements
• Feedback from participants

How We Notify You

• We'll email you at your registered address
• We'll update the "Last Updated" date at the top
• We'll highlight material changes in the notification

Research Use of Data

Anonymisation Process

• Names and email addresses
• Account identifiers
• Timestamps (replaced with relative times)
• Any information that could identify you

• Learning patterns and progress trajectories
• Interaction types and quality
• Anonymised performance data
• Aggregated statistics

Research Publications

• Academic papers and conferences
• Internal research reports
• Public demonstrations (aggregate statistics only)
• Open datasets (fully anonymised, if released)

Opting Out of Research

• Email modality-privacy@shiftlabs.uk with "Opt out of research"
• We'll flag your account
• Your data will be used only to provide you the service
• Doesn't affect your ability to use the platform

Contact Us

Questions or Concerns

Data Protection Contact

Company Information

Summary: Key Points