Privacy notice
Soihtu is a practice app for children's school tests. It processes children's data, so this notice has been written to be read, not to be hidden.
Contents
1. The controller
Soihtu is provided by, and its data is the responsibility of, a private individual:
No separate data protection officer has been appointed, because the data protection regulation does not require one for this activity. All data protection matters are handled through the contact details above.
2. What data we process
Soihtu collects only what running the service requires.
- The guardian's details
- Name, email address and password. The password is stored only as a one-way hash, and it cannot be read. We also store which version of the terms of use and of the consent to AI processing you have accepted, and when.
- Invitation of a second guardian
- If you invite another adult into the family, the invited person's email address is stored for as long as the invitation is valid.
- The child's details
- The name or nickname given by the guardian, the year group and the chosen character picture. No email account is created for the child: the child's device is linked to the family with a single-use code, and the device is identified by an anonymous identifier.
- The exam material
- The pages the guardian photographs from books, handouts and notes, together with the subject, title and date of the test. The images are stored in the service so that the exam material can be added to later and so that the questions can be generated again if needed.
- Practice data
- The questions generated by the AI, the answers the child gives, the assessment of those answers, the explanations the child asks for, and progress by topic.
- Encouraging messages
- Messages the guardian writes to the child.
- Usage volumes
- The monthly number of tests created, answers assessed and explanations requested. These are used to monitor the limits of the subscription.
- Subscription details
- The subscription identifier received from Apple, the product purchased and the period of validity. No payment card details are processed at all — Apple handles the payment.
- Technical logs
- Server logs record errors, timestamps and IP addresses. They are used for troubleshooting and for preventing misuse.
3. What the data is used for, and on what basis
- Providing the service
- Creating an account, managing the family and the children, generating questions, practice and following it. Basis: performance of a contract (GDPR Art. 6(1)(b)).
- AI processing of the exam material
- Sending images and text to an AI service in order to produce questions, assessments and explanations. Basis: consent (GDPR Art. 6(1)(a)), which the guardian gives on registering. Consent can be withdrawn by ceasing to use the service and deleting the account, or by getting in touch.
- Subscriptions and payments
- Checking the validity of the subscription with Apple and updating access rights. Basis: performance of a contract.
- Security and prevention of misuse
- Limiting login attempts and device codes, reviewing logs and making sure the free trial period is a one-off. Basis: legitimate interest (GDPR Art. 6(1)(f)) — the service has to work and its costs have to stay under control.
- Responding to enquiries
- Replying to your email and sorting out the matter. Basis: legitimate interest.
The data is not used for automated decision-making that would produce legal effects, nor for profiling for marketing purposes. The data is not sold and is not disclosed to advertisers.
4. A child's data
A child's profile is always created by the guardian, and the guardian decides what information about the child is given. We recommend using just a first name or a nickname — Soihtu does not need a surname, a date of birth or the name of the school.
A child cannot create an account or add anyone to the family. Children are shown no ads, no price or payment information and no links outside the service.
The guardian sees the child's practice: the answers, the feedback given by the AI and the explanations the child asked for. This is a deliberate choice — an adult has to be able to know what a child is told in the service. Tell your child that their parent can see the practice.
5. Use of AI
The questions, the assessment of answers and the explanations are produced through Google's Gemini API. What is sent to the API is the images of the exam material and the text read from them, the question, the child's answer and the child's year group. The child's name, email address and other contact details are not sent to the AI service.
Soihtu uses the paid tier of the Gemini API, in which Google does not use the material sent to train its models.
A child cannot write to the AI freely. They choose a ready-made request — "explain", "more simply", "an example" or "why" — and the answer is limited to that question and to the exam material.
The AI can still get things wrong. Soihtu does not replace a teacher, and where something is unclear, the textbook and the teacher decide.
6. Who the data is disclosed to
The following service providers process data on behalf of the controller. A data processing agreement, included in each service's terms, is in force with each of them.
- Supabase, Inc.
- The database, authentication and image storage. The servers are located in the EU (AWS, Ireland).
- Google Ireland Limited / Google LLC
- The Gemini API, for producing questions, assessments and explanations.
- Sinch Sweden AB (Mailgun)
- The emails the service sends, such as confirmation and password links. Mailgun's EU region is used.
- Apple Inc. / Apple Distribution International Ltd.
- Distribution of the app and subscription payments. As regards payment data, Apple acts as a controller in its own right; Soihtu receives from Apple only the subscription identifier and its validity.
The data may also be disclosed to an authority where the law so requires.
7. Transfers outside the EU and the EEA
The database and the images are kept in the EU. Some of the service providers are American, so data may be transferred outside the EU and the EEA, for example in support situations and in AI processing. Transfers rely on the European Commission's standard contractual clauses (SCCs) and, where applicable, on the EU–US Data Privacy Framework.
8. How long the data is kept
- Account and family data
- For as long as the account exists.
- Deleting the account
- You can delete your account in the app's settings. If you are the last adult in the family, the family's children, tests, exam material images, answers and practice history are deleted at the same time. If there are other adults in the family, your own data is deleted and the family remains with them. Deletion happens immediately and cannot be undone.
- The record of a trial period already used
- Once the free trial has been used, a one-way hash of the email address remains for 12 months. The address itself is not kept, and no name, family or other information is attached to the hash. The purpose is to prevent the trial being reset by deleting the account and creating it again. This information therefore remains even after the account has been deleted.
- Invitations to a second guardian
- An invitation expires by itself, and the data is deleted along with the family.
- Technical logs
- At most 7 days.
- Emails
- If you have been in touch by email, the messages are kept for as long as dealing with the matter requires, and at most two years.
9. Security
- All traffic between the app and the server is encrypted (HTTPS).
- Passwords are stored only as one-way hashes.
- The database has row-level access control: only the family's own account can reach the family's data.
- The images of the exam material are not publicly retrievable.
- The code needed to link a child's device is single-use and expires.
If a data breach occurs and it is likely to result in a risk to your rights, we will notify you and the Office of the Data Protection Ombudsman within the time the law requires.
10. Your rights
You have the right to
- find out what data about you and your child is processed, and to get a copy of it
- have incorrect data corrected
- have the data deleted (deleting your account does this immediately in the app)
- restrict the processing, or object to it
- receive the data you have given in a machine-readable format
- withdraw the consent you have given to AI processing
Requests should be sent by email to [email protected]. We will reply within a month. We may have to verify your identity, so that the data is not given to the wrong person.
If you consider that your data is being processed unlawfully, you can lodge a complaint with the Office of the Data Protection Ombudsman: PO Box 800, 00531 Helsinki, tietosuoja.fi.
11. Cookies
This website uses no cookies, no analytics and no tracking. There are no ads on the site and no third-party content apart from the fonts, which are loaded from the Google Fonts service.
The app stores a login session on the device so that you do not have to sign in every time. It is not a tracking cookie.
12. Changes to this notice
When the service changes, this notice changes too. Every version has a date, which is shown at the top of the page. We will tell you about material changes in the app and, where necessary, ask you to accept the terms again.