Tutor privacy notice
For children: the short version
Hi! Here is how Tutor looks after your information.
- Coach is a computer program, not a person. It uses AI to write its messages. It asks you questions and gives you hints, but it won't give you the answer straight away. That's on purpose: the thinking is yours. Coach can get things wrong, so check its ideas.
- Coach doesn't know your name. Inside Tutor you have a code name, like
lp-…. Your real name and the year you were born are kept in a locked place that only your parents can see. Coach never gets them. - Please don't type your name, your address, your school, your phone number or any password in the chat. Coach doesn't need them.
- We keep your answers. They help us choose your next exercises and show your parents how you're doing.
- Sometimes a person on our team reads a conversation to check that Coach is helpful and safe. The words are deleted after 30 days.
- If you write something that worries us, for example that you want to hurt yourself or that someone is hurting you, Coach will ask you to talk to an adult you trust right away, and your parents will get a message. We can't switch this off, because keeping you safe matters most.
- You can ask to see your information or to have it deleted. Ask your parent, or ask them to write to us at support@probabilitylab.org.
For parents: the one-minute version
- Your child practises with Coach, a computer program that uses AI (Anthropic's Claude models, under zero data retention) to write its questions and hints. Coach can make mistakes and does not replace you or a teacher.
- Coach never receives your child's name, birth year or your email. Your child appears to it under a code; the name and birth year stay in our database and are shown only to you.
- Progress, the next exercise and the level of help are decided by our own learning engine, never by the AI. The numbers you see come from that engine.
- You consent for your child when you add their profile. You can withdraw at any time; tutoring for that child then stops.
- We keep conversations for 90 days in the live service, trace text for 30 days, and progress for as long as the profile exists.
- We review samples of conversations to check quality and safety. You can object to this.
- If your child writes something suggesting self-harm or abuse, you are notified. This cannot be switched off.
- No advertising, no sale of data. Data stays in the EU, except AI requests, which Anthropic may process outside the EU under EU safeguards.
For parents: summary
| Who we are | Probability Labs SAS, 138 Avenue Victor Hugo, 75016 Paris, France, SIREN 849 409 313. Contact: support@probabilitylab.org |
|---|---|
| What we collect | Your email; your child's first name or nickname, birth year and language; what your child does in Tutor (answers, conversations with the AI tutor, progress); device and security data |
| Why | To provide tutoring, to keep it safe, to improve its quality, and to secure accounts |
| Children's consent | You consent for your child when you add their profile. In France, children under 15 need a parent's consent (Loi Informatique et Libertés, art. 45) |
| AI | Conversations are processed by Anthropic's Claude models under zero data retention. The AI never receives your child's name, birth year or your email |
| Progress | Mastery numbers are computed by our own learning engine, never by the AI |
| Safety | Signs of self-harm or abuse always notify you. This cannot be turned off |
| Quality and safety review | We use conversation records (traces) to evaluate the tutor's quality and safety. This is covered by this notice; you can object |
| Where | EU (Cloudflare EU jurisdiction, Neon Frankfurt, Brevo France). AI inference by Anthropic may run outside the EU, under EU Standard Contractual Clauses |
| How long | Conversations: 90 days in the live service; trace content 30 days; progress for as long as the profile exists. Details below |
| Your rights | Access, correction, deletion, portability, objection, withdrawal of consent, complaint to the CNIL |
Details
1. Controller and contact
The controller is Probability Labs SAS, 138 Avenue Victor Hugo, 75016 Paris, France (SIREN 849 409 313), which operates Tutor. For any question or request about personal data, write to support@probabilitylab.org. Emails from no-reply@auth.probabilitylab.org cannot receive replies.
2. What data we process and why
Your account. Your email address, the sign-in codes we send you (stored only as a hash, valid 10 minutes), your sessions (valid 30 days, with IP address and browser type for security). Purpose: sign-in and account security. Legal basis: our contract with you.
Your household. The parents and guardians in the household and their role. The devices you enroll for your children (a label you choose, such as "Kitchen tablet", please avoid children's names), and a PIN per child, stored only as a hash. Legal basis: contract.
Your child's profile. A first name or nickname you choose, birth year, and language. These stay in our database in Frankfurt and are shown only to you. We use the birth year to compute an age band (9-10, 11-12, 13-14), and only the age band is used by the tutor. Legal basis: your consent as holder of parental responsibility (GDPR art. 8).
Your child's learning. Answers, progress per skill, scheduled reviews, and the decisions our learning engine makes (which exercise next, how much help). This is a form of profiling: it adapts exercises and reports progress to you. It does not produce decisions with legal or similar effects, and the AI never decides it. Legal basis: your consent.
Conversations with Coach (the AI tutor). What your child types and what Coach replies. Purpose: tutoring. These conversations are sent to the AI model with a pseudonymous code instead of your child's name. Legal basis: your consent.
Traces for quality and safety evaluation. We record how each tutoring turn ran (which model answered, how long it took, costs, safety checks, and the conversation text) in our own, self-hosted monitoring system. We review samples to find mistakes, check that the tutor stays safe and does not give answers away, and build test sets that check future versions. We remove identifying details we can detect before storage, keep the conversation text 30 days and the technical data 13 months. Test sets keep only de-identified examples. Legal basis: our legitimate interest in providing a safe and effective tutor for children; we have weighed it against your child's interests (see our impact assessment). You can object at any time (section 7).
Safety escalation. Every message is checked by automated safety filters. If your child writes something suggesting self-harm or abuse, the tutor replies with a fixed message encouraging them to talk to a trusted adult now, the session may pause, and you are notified. Self-harm and abuse notifications always reach you and cannot be muted. Other safety concerns (for example bullying, a stranger trying to contact your child, or content not suitable for their age) can also notify you. Legal basis: legitimate interest in protecting your child, and vital interests where a life may be at risk. [Counsel: describe the handling when the concern involves a household member.]
Security and abuse prevention. IP addresses and email addresses in short-lived rate-limit counters (24 hours), security events in your household (device enrollment, PIN changes, lockouts, consent), kept 1 year. Legal basis: legitimate interest in securing the service.
Alpha applications. If you applied on our landing page: your email, country, your children's ages, goal, subjects, sessions per week, devices and your optional message. We never ask for children's names or schools. These are covered by the separate applicant notice (version 2026-10-alpha-application).
3. Artificial intelligence
Coach, the tutor your child talks to, uses Claude models from Anthropic through Anthropic's API, in a workspace under zero data retention: Anthropic does not store prompts or replies after answering, and does not use them to train models. The AI receives the language, the exercise, our learning engine's instructions for the next step and the recent conversation, and at most an age band. It never receives your child's name, birth year, your email or any account token. The AI writes the dialogue; it never computes progress, picks the next exercise or decides how much help to give. Those are computed by our own learning engine.
AI can make mistakes. Coach is designed not to give answers away and its replies are checked automatically, but it is not a substitute for a teacher or for supervision.
4. Who receives the data
We do not sell data and do not use it for advertising. We use these processors, under contracts that bind them to our instructions:
| Processor | Role | Location |
|---|---|---|
| Cloudflare | Hosting of the service, the live session storage (EU jurisdiction), file archive, access control | EU for stored session data; global network |
| Neon | Database | Frankfurt, Germany |
| Anthropic | AI models (zero data retention) | United States or global inference |
| Brevo | Sending sign-in codes and alpha emails | France |
| [VM host, to be decided] | Server for our self-hosted monitoring system | EU |
The full list, with transfer safeguards, is kept up to date at [link]. We will tell you before adding a processor that receives your child's data.
5. Transfers outside the EU
Anthropic may process AI requests outside the EU. The transfer is covered by [the EU-US Data Privacy Framework certification and/or EU Standard Contractual Clauses: counsel to confirm] and by zero data retention. Cloudflare's network may route traffic outside the EU; stored session data stays in the EU jurisdiction.
6. How long we keep data
| Data | Retention |
|---|---|
| Sign-in codes | 10 minutes |
| Sessions | 30 days |
| Rate-limit counters | 24 hours |
| Conversations in the live service | 90 days rolling |
| Trace content | 30 days |
| Trace technical data and scores | 13 months |
| Learning engine decisions | 13 months |
| Progress per skill, profile | Until you delete the profile or close the account |
| Security events | 1 year |
| Proof of your consent | As long as the profile exists, then 5 years [counsel to confirm] |
| Accounts without sign-in | Closed after 24 months, after a warning |
| Database backups | [6 hours to 7 days], then deleted data is gone from backups too |
| Alpha applications | [declined: 6 months after decision; others: 12 months; to be aligned with the applicant notice] |
7. Your rights and your child's rights
You can ask to access, correct, delete or receive a copy of your data and your child's data, to restrict its use, and to object to its use for quality and safety evaluation. You can withdraw your consent for a child at any time; this stops tutoring for that child and does not affect processing that already happened. Your child can ask too, through you or by writing to us. A person who was a minor when data was collected can ask for its erasure at any time (Loi Informatique et Libertés, art. 51).
To make a request, write to support@probabilitylab.org from the email address of your account. We will ask you to sign in with a fresh code to confirm it is you. We answer within one month, extendable by two months for complex requests, in which case we will tell you why.
You can also give instructions about what happens to your data after your death (Loi Informatique et Libertés, art. 85).
8. Complaints
You can complain to the French data protection authority, the CNIL: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr/fr/plaintes. We would be grateful if you contacted us first.
9. Security
Children's names and birth years are kept apart from everything else. Codes, PINs and device credentials are stored only as hashes. Session data is stored in the EU. Access to monitoring data is restricted to named people behind single sign-on.
10. Changes
When this notice changes in a way that affects your child's data, we will show you the new version in the app and ask for your consent again before continuing. Previous versions are available at [link].