Privacy Policy for the Symbai app

Last Updated: [4th of May 2025]

1. Introduction

Symbai (“we”, “our”, or “us”) is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered educational debate platform.

As a New Zealand-based company, we comply with the New Zealand Privacy Act 2020. This policy reflects our commitment to the Information Privacy Principles contained within that Act.

2. Information We Collect

Personal Information
Account Information: Name, email address, username, password (encrypted), account type (teacher, student, or enterprise), and profile information
Educational Information: Student-teacher relationships, class affiliations, debate performance, and educational content
Organizational Information: Organization name, context, settings, and facts provided for debate context
Usage Information: Debates created, chat messages, motion filters, and interactive content
Technical Information: IP address, browser type, device information, log data, and cookies

3. How We Use Your Information

We use your information for the following purposes:

Providing and personalizing our services
Facilitating educational debates and discussions
Enabling teacher-student interactions
Improving our platform and AI capabilities through analysis of user interactions, debate patterns, and educational content (with your consent)
Training and enhancing our AI models using anonymized data derived from user content and conversations (with your consent)
Developing better content filtering and safety systems
Creating personalized educational experiences based on learning patterns
Sending service updates and communications
Ensuring compliance with our terms
Meeting legal obligations

4. Legal Basis for Processing

We process your information based on:

The performance of our contract with you
Your consent (where specifically requested)
Our legitimate interests in providing and improving our services
Compliance with legal obligations

5. Data Sharing and Disclosure

We may share your information with:

Other users as part of the platform’s functionality (e.g., teachers can access their students’ debates)
Service providers who assist in operating our platform, including:
– Replit (our hosting provider), which maintains GDPR compliance and has appropriate data processing agreements in place for EU data transfers
– Database and infrastructure providers that operate under Replit’s compliance framework
Legal authorities when required by law

We do not sell your personal information to third parties.

6. Data Security

We implement appropriate technical measures to protect your information, including:

Encryption of sensitive data
Using reputable cloud service providers with strong security practices
Regular database backups and security updates
Access controls and authentication systems
Secure data storage with our cloud providers

7. Data Retention

We retain your information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy.

For detailed information, please refer to our Data Retention Policy.

8. Your Privacy Rights

Under the Privacy Act, you have the right to:
Access your personal information
Request correction of inaccurate information
Request deletion of your information (where applicable)
Withdraw consent (where processing is based on consent)
Receive notification of privacy breaches that are likely to cause serious harm
Make a complaint to the Privacy Commissioner

9. Children’s Privacy

Symbai is designed for educational use by students of all ages under the direct supervision of a teacher or educator in a classroom setting. For independent use (such as homework assignments), students must be at least 13 years of age.

We rely on teachers to ensure they have obtained appropriate authorization to use educational technology platforms with their students, in accordance with their school’s policies and local laws. This may include:

School digital learning agreements
Technology use policies
Direct parental consent (particularly for younger students or where required by local law)

For students under 13 years of age (or the applicable age of digital consent in your jurisdiction), educators must ensure they have obtained verifiable parental consent before allowing students to use Symbai, in compliance with applicable laws such as COPPA in the United States. Students under 13 should only use Symbai under direct teacher supervision in a classroom environment.

Symbai does not independently verify student age or parental authorization.

Teachers registering for an account must confirm that they have appropriate authorization for all students in their classes to use educational technology platforms and that they will only assign independent use to students aged 13 and above.

10. International Data Transfers

Our data is processed and stored through Replit’s cloud infrastructure. Replit, as our hosting provider, maintains compliance with international data protection requirements including:

GDPR compliance for European Union data
Standard Contractual Clauses (SCCs) for international data transfers
Appropriate technical and organizational measures to protect personal data

When transferring data internationally, these safeguards ensure the same level of protection required by New Zealand law is maintained. For teachers and schools in the EU, Replit’s existing compliance framework provides the necessary legal basis for data transfers without requiring additional contractual arrangements.

11. Privacy Policy Updates

We may update this Privacy Policy periodically. We will notify you of significant changes through our platform or by email.

12. Contact Information

If you have questions about this Privacy Policy or our privacy practices, please contact:

Email: [email protected]
Postal Address: 50 Swann Beach Road, Stanmore Bay, Whangaparāoa, 0932

Data Retention Policy for the Symbai app

Last Updated: [4th of May 2025]

1. Purpose

This Data Retention Policy establishes guidelines for retaining and disposing of personal information collected and processed by Symbai. It ensures we comply with the New Zealand Privacy Act 2020, particularly Information Privacy Principle 9 (IPP9), which requires that agencies not keep personal information for longer than required for its lawful use.

2. Scope

This policy applies to all personal information processed and stored by Symbai, including user data, educational content, and organizational information in our database systems.

3. Data Classification and Retention Periods

Please refer to the table (viewable via the button above) for specific retention periods based on data category.

4. Data Deletion Process

When data reaches the end of its retention period, we will:

Review the data for continued relevance or legal requirements
Permanently delete data that is no longer needed
Document the deletion process for compliance purposes

5. User-Requested Deletion

Users may request the deletion of their personal information by contacting us. Upon receiving such requests, we will:

Verify the identity of the requesting user
Delete the requested personal information within 30 days (unless legal requirements prevent us from doing so)
Notify the user once the deletion is complete

6. Exceptions to Standard Retention

Retention periods may be extended when:

Required by law or regulatory requirements
Necessary for legitimate legal claims or disputes
Specifically requested by users for educational purposes (with explicit consent)
Required for significant public interest research (with appropriate safeguards)

7. Audit and Compliance

We will conduct regular reviews of our database to:

Identify data that has exceeded its retention period
Ensure that deletion processes are working correctly
Maintain records of data deletion for compliance purposes

8. Policy Review

This Data Retention Policy will be reviewed annually to ensure it remains appropriate and compliant with applicable laws and regulations.

9. Anonymized Data for AI Training

Where users provide consent for their data to be used for AI training purposes, Symbai may create a separate, anonymized dataset derived from user content (such as debate structures and arguments, excluding personal identifiers). This anonymized data, which is processed to ensure individuals cannot reasonably be re-identified, is no longer considered personal information under the Privacy Act 2020. As such, this anonymized dataset may be retained and used by Symbai for the ongoing purpose of improving our AI models and platform functionality for as long as it serves this legitimate purpose, potentially exceeding the retention periods specified for the original personal information. The retention and deletion schedules outlined in section 3 apply only to the original, identifiable personal information, not to this separately maintained anonymized dataset.

Privacy Policy