📘 COOKIE & PRIVACY POLICY OF AI-FUTURESCHOOL

Last update: 1 October 2026

AI-FutureSchool protects the privacy of its users and ensures that all personal data processing is carried out in full compliance with the applicable European and national rules: Regulation (EU) 2016/679 (GDPR), ePrivacy Directive 2002/58/EC and Italian Legislative Decree 196/2003 (Personal Data Protection Code), as amended by Legislative Decree 101/2018. This policy applies to all users of the platform, regardless of the navigation language.

AI-FutureSchool pays particular attention to the protection of minors: processes, settings and controls are designed according to the principle of “maximum protection”, with technical and organisational measures dedicated to preventing any form of abuse, minimising data, and ensuring content security.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🗂️ TYPES OF COOKIES USED

AI-FutureSchool only uses technical, functional and anonymized analytical cookies. No profiling or advertising tracking cookies are used.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🛡️ TECHNICAL AND FUNCTIONAL COOKIES

These cookies ensure the correct functioning of the website and the services offered (session management, access to restricted areas, language preferences, notifications).

Cookies used:
- aifsNavigazione — manages session and navigation
- aifsNotifiche — manages internal notifications
- remember_me — login management
- preferenzaSuggerimentiPagine — stores the view of help and instructions
- toogle-curiosita — manages internal search results for the “Curiosity” section
- toogle-studio — manages internal search results for the “Study” section
- toogle-notizie — manages internal search results for the “News” section

These cookies do not collect personal data and are not shared with third parties.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

📊 ANALYTICAL COOKIES (GOOGLE ANALYTICS 4)

The platform uses Google Analytics 4 to collect anonymised and aggregated statistical data about site usage, solely to improve functionality and user experience. The configuration adopted is GDPR compliant and includes:
- anonymisation of IP addresses
- disabling Google Signals and advertising features
- no individual tracking or profiling
- data sharing with Google disabled

Installed cookies:
- _ga — used to distinguish users anonymously (duration: 2 years; provider: Google LLC, USA)
- _ga_VWEHYTTR9M — used to maintain the session state associated with the GA4 property (duration: 2 years; provider: Google LLC, USA)

Further information:
- Google Privacy Information: https://policies.google.com/privacy
- Opt-out Component: https://tools.google.com/dlpage/gaoptout

Compliance note: Google Analytics 4 is a third-party service and the cookies it installs require the user's prior consent (Art. 122 of the Italian Privacy Code, Art. 6 GDPR). They are not loaded until consent is given through the "Statistics Cookies" option in the banner, and withdrawing consent deletes the _ga cookies already stored on the device. IP anonymisation and the disabling of advertising features reduce the data processed, but do not remove the need for consent.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

📘 COOKIE MANAGEMENT

Users may manage or disable cookies through their browser settings. Disabling technical cookies may compromise certain essential site functions.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚖️ DATA CONTROLLER

AI-FutureSchool
Data controller: Bertoncello Stefano
Via San Giuseppe 24 - 36060 Romano d'Ezzelino (VI), Italy
Website: www.ai-futureschool.com
Email: info@ai-futureschool.com

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚖️ PURPOSES AND LEGAL BASIS OF PROCESSING

Purposes of the processing:
- provision of educational services based on artificial intelligence
- management of user accounts and personalised learning activities
- continuous improvement of the platform and features

Legal basis:
- explicit consent of the user (art. 6, par. 1, letter a GDPR)
- performance of a contract (art. 6, par. 1, letter b GDPR)
- legitimate educational interest of the data controller (art. 6, par. 1, letter f GDPR)



🗂️ DATA PROCESSED

Only the data necessary for the operation of the services is processed:
- email address and user-chosen nickname
- educational data and AI requests generated during use
- language preferences and navigation settings

No sensitive, biometric or financial data is collected.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🔐 LEGAL VERIFICATION AND AI REQUEST SAFETY

All requests sent to the platform’s AI assistants are subject to automatic pre-checks to verify legal, ethical and safety compliance, with particular protection for minors. The filter:
- blocks or modifies requests containing illegal, offensive or discriminatory content
- protects minors by preventing processing of content not suitable for their age
- ensures results that respect educational, safety and privacy principles

Data entered is never shared with external systems for profiling purposes.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🗂️ DATA RETENTION AND DELETION

Data is stored only for the time strictly necessary for educational purposes. Users may:
- delete their account independently via their settings
- request complete removal of data by contacting AI-FutureSchool

Data deletion is permanent and results in the removal of all information associated with the account.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚖️ USER RIGHTS

Under applicable regulations, each user has the right to:
- access their personal data
- request rectification or deletion (“right to be forgotten”)
- restrict or object to the processing
- withdraw consent at any time
- obtain a portable copy of their data

Requests may be sent to: info@ai-futureschool.com


━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🛡️ DATA SECURITY

AI-FutureSchool adopts advanced technical and organisational measures to prevent unauthorised access, loss or alteration of data, including:
- encryption (HTTPS/TLS)
- secure authentication
- protected and monitored servers
- periodic controls and anti-abuse filters

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚖️ NO SALE OR TRANSFER OF DATA

AI-FutureSchool does not sell, rent or transfer users’ personal data to third parties. No information is used for advertising or commercial purposes. Any external integration will always be GDPR compliant and subject to updated notice.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚖️ WITHDRAWAL OR MODIFICATION OF CONSENT

Users may withdraw or modify consent to the use of cookies or the processing of personal data at any time:
- via the “Privacy Management” section of their profile
- or by sending a request by email to the Data Controller

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

📘 RULES FOR THE USE OF AI SERVICES

AI services are intended exclusively for educational and personal purposes. It is forbidden to use AI to generate illegal, offensive or harmful content. Each user is responsible for their own requests and generated content. Use is allowed from 14 years of age and upwards; for younger users, parental consent is required. All data remains internal to the platform and is not transmitted to third parties for profiling. Misuse of the system may result in suspension or revocation of access. AI automatic controls protect minors and ensure compliance with the law and digital ethics.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

📘 POLICY UPDATES

AI-FutureSchool reserves the right to update this policy to adapt it to regulatory or technical changes. Changes take effect immediately after publication on this page.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

📘 MULTILINGUAL VERSIONS

This policy is available in: Italian, English, Spanish, French, German, Portuguese, Russian, Romanian and Croatian. In case of interpretative discrepancies, the Italian version prevails.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🌍 DATA PROCESSORS AND TRANSFERS OUTSIDE THE EUROPEAN UNION

To provide its artificial intelligence services, AI-FutureSchool relies on external suppliers that process data on behalf of the controller as data processors (Art. 28 GDPR). The text of requests sent to the assistants and the files uploaded by users are transmitted to these suppliers for as long as it takes to produce the answer.

List of processors:
- OpenAI, L.L.C. (United States) — text generation and processing; automatic screening of forum messages
- Google LLC and Google Ireland Ltd. (United States, Ireland) — Gemini models for text generation; Google Analytics 4 for usage statistics
- Stability AI Ltd. (United Kingdom) — image generation
- a9t9 software GmbH – OCR.space (Austria, European Union) — recognition of text contained in images
- CloudConvert GmbH (Germany, European Union) — format conversion of uploaded documents

What is transmitted:
- the text of the request written by the user
- uploaded files (documents, images, homework) where the requested feature involves them
- no account data: username, email address and internal identifiers are never sent to the suppliers

Users are advised not to include in their requests any personal data, their own or other people's, that is not necessary for the educational purpose. Uploaded homework and documents may contain such data: this should be considered before uploading them.

Legal basis and safeguards for transfers (Art. 13(1)(f) and Art. 44-49 GDPR):
Processing entrusted to suppliers established in the European Union does not constitute a transfer. Transfers to the United States take place on the basis of the Standard Contractual Clauses approved by the European Commission in Implementing Decision (EU) 2021/914 and, for participating suppliers, the EU-U.S. Data Privacy Framework adequacy decision, Implementing Decision (EU) 2023/1795. For the United Kingdom, adequacy decision (EU) 2021/1772 applies.

A copy of the safeguards in place can be requested by writing to info@ai-futureschool.com.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🗂️ WHAT HAPPENS WHEN AN ACCOUNT IS DELETED

Deletion removes, in a single operation:
- the profile, login credentials and session tokens
- private messages sent and received
- conversations with the AI assistants, summaries, notes and saved prompts
- quiz and challenge results, study paths, favourites and history
- generated images, uploaded attachments and any custom avatar

Two exceptions, which answer to legal obligations or to the protection of other users:
- messages posted in the forum are not removed but made anonymous: the link to the author disappears, the text remains so that discussions and other users' replies still make sense
- the consent register keeps the date, the version of the notice and the choice made, stripped of any reference to the person: Art. 7 GDPR requires the controller to be able to demonstrate the consents it has collected, and Art. 17(3)(b) and (e) allow this reduced retention

A record of every deletion is kept, with the date and the detail of the operations carried out. The email address is not retained: only a cryptographic fingerprint of it is kept, enough to confirm that a request was carried out without keeping the data itself.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🍪 HOW TO MANAGE COOKIE CONSENT

On the first visit the banner asks for a choice. Technical and navigation cookies remain always active because they are needed for the site to work and do not require consent. Statistics cookies are off until they are explicitly switched on: closing the banner without choosing, or refusing, leaves Google Analytics disabled.

The choice can be changed at any time from the "Manage cookies" link at the bottom of every page. Turning statistics cookies off deletes the _ga cookies already stored on the device and stops Google Analytics from loading.

Every choice is recorded on our systems with the date, the version of the notice and the categories accepted, as required by Art. 7 GDPR. If the notice changes, the banner asks again.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🔑 STAYING SIGNED IN

The session cookie keeps you signed in while the browser is open. Alongside it, the remember_me cookie keeps you signed in for 90 days even after the browser is closed, and its expiry restarts from 90 at every visit: your password is asked again only after 90 days without using the site from that device. Both serve only to keep you connected to your account: they collect no other data and are not shared with third parties. They are removed by signing out — the "Log out" link deletes the cookie from the device and the matching token from our systems — or from the browser settings.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🗓️ HOW LONG DATA IS KEPT

- account data and content created (conversations, summaries, quizzes, images, attachments): for as long as the account exists, and deleted together with it
- persistent login token: 90 days, restarting from 90 at every visit
- log of sign-in attempts, used to stop automated attacks: 7 days
- register of consents and deletions: kept even after the account is closed, stripped of any reference to the person, because Art. 7 GDPR requires the controller to be able to demonstrate the consents it has collected

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚖️ COMPLAINT TO THE SUPERVISORY AUTHORITY

Anyone who believes that the processing of their data infringes the GDPR may lodge a complaint with a supervisory authority (Art. 77 GDPR). In Italy:

Garante per la protezione dei dati personali
Piazza Venezia 11 - 00187 Rome, Italy
www.garanteprivacy.it - garante@gpdp.it

Residents of another European Union country may contact the supervisory authority of their own country. The right to an effective judicial remedy is unaffected (Art. 79 GDPR).

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🤖 AUTOMATED DECISIONS AND REQUIRED DATA

The AI assistants produce texts, images and study materials at the user's request. No automated decisions are taken that produce legal effects or similarly significantly affect the person (Art. 22 GDPR): the generated content is a study aid, not an assessment with external consequences.

An email address and a password are required to create an account: without them the service cannot be provided. Everything else is optional.

No Data Protection Officer (DPO) has been appointed: for any matter concerning personal data, please contact the controller directly at the details given above.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🔑 GOOGLE USER DATA (GOOGLE API SERVICES)


1. WHAT GOOGLE USER DATA THE APPLICATION ACCESSES

AI-FutureSchool uses Google APIs in three places, all optional: signing in with Google; importing a class from Google Classroom, together with the due dates of the assignments in your own courses; and importing your own events from Google Calendar. If you use none of them, you give us no Google data at all.

Sign in with Google — «email» and «profile» scopes:
- the email address of the Google account
- the display name and, where present, the profile picture
- the Google account identifier

Import from Google Classroom — only for teacher accounts that choose to link Classroom:
- «classroom.courses.readonly»: the list of courses where the user is a teacher, with each course's name and section
- «classroom.rosters.readonly»: the list of students enrolled in the course the user chooses to import, with their names
- «classroom.profile.emails»: the email addresses of those students
- «classroom.coursework.me.readonly»: the assignments given to YOU in the courses you attend, with the title, the instructions and the due date. Only your own: not other students' assignments, and not their submissions

Import from Google Calendar — for users who choose to link their calendar:
- «calendar.calendarlist.readonly»: the list of your calendars, with each name, so you can choose which ones to import
- «calendar.events.readonly»: the events of the chosen calendars, limited to a window of 14 days in the past and 180 in the future, with title, description, location, date and time

All of these scopes are read-only: AI-FutureSchool does not write, change or delete anything in Google Classroom or in Google Calendar. No write scope is requested, and the site has no feature that could change anything inside a Google account.

To keep the link alive we also store the authorization token issued by Google. It is not a user credential: we never know or receive the password of your Google account.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

2. HOW WE USE GOOGLE USER DATA

Each piece of data serves the feature it was requested for, and nothing else:

- email address, name and profile picture: to create or recognise your AI-FutureSchool account and to show your name and avatar inside the site
- list of courses: so the teacher can choose which course to import
- list of students and their email addresses: to build the matching virtual class. Students who already have an AI-FutureSchool account are invited to the class; those who do not are sent an invitation to sign up with that address. No account is ever created on anyone's behalf
- authorization token: to read from Classroom when the teacher asks, without having to link the account again every time
- Classroom coursework: to place the due date in the site's calendar, as a reminder. The copy is read-only: change it in Classroom and the copy realigns on the next sync
- Google Calendar events: to show a copy in the site's calendar, next to the entries you wrote by hand, so that a single page shows your whole day. These copies are read-only here too

Google user data is not used for advertising, is not sold, is not used to profile people, and is not used to train artificial-intelligence models, ours or anyone else's.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

3. WHO WE SHARE, TRANSFER OR DISCLOSE GOOGLE USER DATA TO

Nobody. Data received from Google APIs stays on our systems and is not sold, transferred or disclosed to any third party, for any reason. In particular it is not sent to the AI providers listed in the Cookie & Privacy Policy: those providers process the text of requests made to the assistants, which is a different thing.

The only exception is disclosure required by law or by a competent authority.

An imported student's name and email address are visible to the teacher who imported that class — that is what the import is for — and are not visible to other users of the site.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

4. HOW WE PROTECT THE DATA

- all traffic travels over an encrypted connection (HTTPS)
- database access is limited to the technical staff who need it, with separate credentials per service
- we ask for the minimum: every Google scope we use is read-only, and the Classroom link is enabled by an administrator only for teachers whose registration has been reviewed
- special categories of data (Art. 9 GDPR) are neither requested nor processed: we do not ask for health, biometric, religious, political or similar data, and we ask that such data not be put into uploaded content
- the administration area cannot be reached by non-administrators and is not indexed by search engines

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

5. HOW LONG WE KEEP IT, AND HOW IT IS DELETED

- account data is kept for as long as the account exists
- the Google authorization token is kept until the link is revoked
- the copies of imported events and due dates are kept as long as the link exists. Disconnecting Google Calendar from your profile deletes the copies from the site's calendar straight away; the originals on Google are not touched
- an event deleted on Google, or moved outside the imported window, disappears from the site's calendar at the next sync

Both the Google Classroom link and the Google Calendar link can be revoked at any time at https://myaccount.google.com/permissions, and from your AI-FutureSchool profile under «Account and connections». From that moment AI-FutureSchool can no longer read anything.

Deleting your account — from your profile, «Delete account» — removes the account data, the Google token and the linked content. All that remains, anonymised and stripped of any reference to the person, is the consent log and the deletion log, which Art. 7 GDPR requires us to be able to produce. Exactly what is removed and what remains is set out in the Cookie & Privacy Policy.

Deletion can also be requested by writing to info@ai-futureschool.com.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

6. LIMITED USE — GOOGLE API SERVICES USER DATA POLICY

AI-FutureSchool's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

🎙️ VOICE IN THE CHAT (MICROPHONE AND SPOKEN AI ANSWERS)

Last updated: 6 October 2026

The chat can also be used by voice: you can dictate questions with the microphone and have the AI's answers read aloud. The feature is optional and the written chat always works.

Who can use it:
- only registered, logged-in users
- only people aged 14 or over: the first time you use it you must declare "I declare that I am at least 14 years old". Without this declaration voice is not activated
- we keep the date and version of this declaration and, in the consent log, the IP address and browser used; you can withdraw it at any time from "Voice settings" (voice turns off and you can turn it on again whenever you want)

What happens to audio:
- the microphone turns on only when you tap it and turns off when you stop speaking or press Cancel/Send
- the recording is sent to our servers and from there to Deepgram, Inc. (United States) to be converted into text; it is not saved by us or by AI-FutureSchool in any way
- the resulting text becomes a normal chat message and follows the chat's retention rules
- to make the AI speak, the text of the answer is sent to OpenAI (United States), which turns it into speech; the generated audio is not saved
- Deepgram and OpenAI process data as processors on our behalf; transfers to the United States rely on the safeguards of Arts. 44-49 GDPR (standard contractual clauses and/or an adequacy decision)
- we do not perform biometric voice recognition or profiling

What we keep: the date and version of the consent and, for each day, the number of seconds of voice used (only for the daily limit of 15 minutes per user). The choices "AI answers by voice", speed and microphone language stay in your browser (local storage) and are not sent to us.

Legal basis: consent (Art. 6(1)(a) GDPR; Art. 2-quinquies of Italian Legislative Decree 196/2003 for the age of 14). Withdrawing consent does not affect the lawfulness of processing already carried out.