Privacy Policy

1. Introduction

Downtime ("the Platform", "we", "our", "us") is an AI-powered educational platform that transforms classroom sessions into interactive learning experiences through real-time transcript analysis, knowledge digestion, and educational games.

We take the privacy of our users seriously, especially when it comes to student data. This Privacy Policy explains what data we collect, how we use it, and the choices you have regarding your information. By using the Platform, you consent to the practices described in this policy.

2. What We Collect

From Teachers:

• Account data: email address, name, and avatar.
• Payment information processed via Stripe. We do not store your card details directly.
• Session data: transcripts, AI-generated content (summaries, knowledge maps, game content).

From Students:

• Typed first name when joining a game (no account creation required).
• Game interactions: answers, drawings, scores, and chat messages.
• IP address, used solely for service operation.

2b. From Website Visitors

Before you create an account, and whether or not you ever do, we record one summary of each visit to this site:

• Which sections of the page you reached, how long you spent in each part of it, and how far you scrolled.
• Which buttons and links you clicked, and which questions you opened in the FAQ.
• If you highlighted text, which section it was in and roughly how much — never the words themselves.
• On the contact page, which fields you started filling in, and whether you sent the form. We never record what you typed unless you send it.
• Your browser, operating system, screen size, IP address and approximate location.

We do not record your mouse movements, do not take screen recordings, and do not read anything you type and choose not to send.

3. How We Use Your Data

We use the data we collect for the following purposes:

• Providing the service: Real-time transcription, AI-powered content digestion, and educational game generation.
• Improving content quality: Analysing usage patterns to enhance the accuracy and relevance of AI-generated educational content.
• Analytics: We use Plausible, a cookieless analytics tool, to understand how the Platform is used. We also record page views, button clicks and a summary of how each visit went — described in section 2b — against a first-party visitor identifier stored in your browser, along with your IP address, approximate location and browser type. Once you create an account that identifier is linked to it, so earlier visits from the same browser become part of your account record.
• Advertising measurement: If you reach us from one of our adverts, we store that advert and campaign identifier in your browser so we can tell which adverts lead to teachers signing up. We send a record of sign-ups and subscriptions to Meta Platforms Ireland Limited for the same purpose. Your email address is converted into an irreversible hash before it leaves our servers; we never send it in readable form. Meta also uses this data for its own advertising purposes.
• Communication: Responding to support requests and providing service updates.

4. Session Content Processing

• Meeting audio: Audio from classroom sessions is processed in real-time by Soniox for speech-to-text conversion. Audio is NOT permanently stored after transcription is complete.
• Transcripts: Generated transcripts are stored and processed by Anthropic AI (Claude) to extract key topics, generate summaries, and produce educational content.
• AI-generated content: Knowledge maps, summaries, quiz questions, and game content are stored alongside session records for ongoing educational use.

5. Third-Party Processors

We work with the following third-party service providers to deliver the Platform's functionality:

• Anthropic (Claude AI) — AI content generation and transcript analysis. Privacy Policy
• Soniox — Speech-to-text transcription. Privacy Policy
• OpenRouter — AI image generation for game theme visuals. Privacy Policy
• Stripe — Payment processing. Privacy Policy
• Chatwoot — Customer support chat. Privacy Policy
• Meta Platforms Ireland Limited — Advertising measurement. Unlike the providers above, Meta is not only acting on our instructions: it uses the sign-up and subscription records we send for its own advertising purposes, which makes it a separate recipient of your data rather than a processor. This applies only if you reached us from one of our adverts. Privacy Policy

6. Data Retention

We retain data for the following periods:

• Game state: 2-hour Redis TTL (automatically expires after the game ends).
• Game history: 7-day Redis TTL (automatically expires).
• Session records: 12 months from the date of the session.
• Account data: Retained until you request account deletion.
• Analytics and advertising measurement: Visit records, including IP address and approximate location, are kept for 180 days and then stripped of anything that identifies a device. Advert and campaign identifiers are kept for 90 days. Records already sent to Meta are held under their own retention terms and cannot be recalled by us.

7. Children's Data

• Students do NOT create accounts on the Platform. They join games via shared links provided by their teacher.
• Minimal data is collected from students: only a typed first name is required. No email address, password, or other personal identifiers are collected.
• The teacher is responsible for obtaining any required parental consent before allowing students to participate in games, in accordance with applicable laws.
• Student game data (answers, scores, drawings, chat messages) automatically expires via Redis TTL and is not permanently stored.
• We do not knowingly collect personal data from children under the age of 13 without teacher or parental consent. If we become aware that we have collected data from a child under 13 without appropriate consent, we will take steps to delete it promptly.

8. Cookies

• Signing you in: directus_token keeps you logged in, and active_org remembers which school you are working in. Both are required for the Platform to work.
• Understanding our visitors: dt_vid is a random identifier that lets us tell a repeat visit from a new one, so our visitor counts are not inflated. It holds no name, email or account details, and is kept for 12 months. dt_vs records which version of that identifier you have.
• Advertising: dt_attr and dt_ref record which of our adverts brought you here, so we can measure which ones lead to teachers signing up. They are set only if you arrive from an advert, and are kept for 90 days. These are advertising cookies.
• Remembering this notice: dt_consent records that you have seen the cookie banner, so it is not shown on every page.
• Plausible, our analytics tool, sets no cookies of its own.
• We do not sell your data, and we set no cookies belonging to third-party advertising networks. The advertising cookies above are our own, set by this site.

9. Your Rights

Under applicable data protection laws, including the Personal Data Protection Act 2010 (PDPA, Malaysia) and the General Data Protection Regulation (GDPR, where applicable), you have the following rights:

• Right to access your personal data that we hold.
• Right to rectification of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") of your personal data.
• Right to data portability, allowing you to obtain your data in a structured format.
• Right to withdraw consent for data processing at any time.

To exercise any of these rights, please contact us through our contact page.

10. Data Security

We implement appropriate technical and organisational measures to protect your data:

• All data is transmitted via HTTPS/TLS encryption.
• Authentication tokens are securely managed and stored.
• Redis data is isolated per session with automatic expiry (TTL).
• We conduct regular security reviews of our systems and practices.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised effective date.

Continued use of the Platform after changes are posted constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.