Privacy

Alumo holds what your school writes and the accounts of the people who write it. To answer questions about it, parts of it go to Google's AI models, and anybody who connects Claude or ChatGPT sends more of it to those companies. We do not sell any of it, we do not advertise, and we do not follow you around other sites. The rest of this page says where it sits and who else can see it.

Your name, your email address, a picture if you set one, and a password we cannot read: only a scrypt hash of it is stored. If you sign in with Google we keep the account id Google gives us and never a password. Each session records the browser, its IP address and the country we work out from it, so you can see where you are signed in and end anything you do not recognise.

Pages and their version history belong to the school. We store them so your colleagues can read them back, and every version records who wrote it. Questions on the board and the answers under them belong to the school in the same way. A page in your private workspace is yours alone: nobody else at your school can open it, not even an administrator. It is not the school's, so it goes when your account does rather than staying behind. Nobody here reads any of it, except when somebody at the school asks us to look at something with them. Software does read it, to answer questions, and the next sections say how.

A picture or a document you drop into a page is kept on our own servers and served from cdn.alumo.ai. That address carries no name and cannot be guessed, and search engines are told to stay away, but there is no sign in on it. Anybody holding the link can open the file, including somebody outside your school, and that holds even when the page it sits on is private. Treat the link as carefully as the file. Deleting a file starts the same ninety day wait as everything else, and then the bytes are gone.

Alumo can answer a question from what your school has written down, and Google's models do that work. Every page and every question on the board is sent to Google once, when it is written and again whenever it changes, and comes back as the numbers we search on. When somebody asks a question, the question goes to Google together with the passages we found for it, up to around fourteen thousand characters of your school's own writing. Only passages that person is already allowed to read are sent, so a colleague's private page is never among them.

A chat is saved so you can open it again: what you asked, what came back, and the pages and questions each answer drew on with the passage it used. It is yours rather than the school's, and nobody else can open it. Deleting a chat takes the words out straight away and leaves only the counts the daily limits are worked out from. Closing your account does the same to every chat you had.

Anybody with an account can connect Alumo to Claude or ChatGPT. That assistant then reads what the person can read, which is the team's pages and their own private ones, never a colleague's, and it can write and delete pages as well. Everything it reads leaves us and goes to Anthropic or OpenAI, and from that point their privacy policy covers it rather than this one. You make the connection from inside the assistant. To end it, disconnect it on the integrations page in your account, which stops it here on the assistant's next call.

Every call an assistant makes is written down: which tool it used, what it asked for, and what it was handed back, kept up to eight thousand characters. That last part is a copy of your school's writing, private pages included. The same line holds the IP address, the country and the name the app gave for itself. It is there so a school can find out what an assistant did in its space. There is no expiry on it.

Six, and none of them for advertising. One keeps you signed in for thirty days. One remembers your language and one remembers how wide you dragged the sidebar, both for a year. One remembers the page you had open last and lasts until you close the browser. One carries a single confirmation message across one page load and expires after a minute. The last is set only while you are signing in with Google and lasts ten minutes. The contact and application forms also load a Cloudflare check, which sets its own.

Serving a page writes an ordinary web server log line: the IP address that asked, which page it asked for, when, and which browser it said it was. We read it to keep the site up and to find out when it breaks.

Four companies handle a part of this for us. An assistant somebody connects is not one of them, and has its own section above.

• Cloudflare handles every request to the site, not just the check on our forms. Yours reaches them before it reaches us, and the address we write down for you is the one they report.
• Sentry gets a report when something goes wrong, from our server and from your browser. A report can carry the page you were on, your IP address, your email address and what you were doing at the time.
• Resend sends our email, so an invitation or a reset link passes through them.
• Google runs the models behind our answers, so they see the writing itself: every page and question when it is indexed, and a question you ask along with the passages found for it. Separately, they are the sign in you can choose, and then we ask them for your name, your email address and your profile picture, nothing else. The picture is copied to our own servers the first time you sign in, so your browser never goes to Google for it afterwards.

Mail to [email protected] arrives on a mail server we run. We keep your message and your address so we can reply and pick the conversation back up later. The contact form is not stored anywhere else.

A note sent with the feedback button is stored here, with your account and the language you wrote in, and a copy is mailed to us so we see it. We keep it to read it and answer. It is erased when your school is.

The application form keeps what was filled in: the school's name, the contact's name and email address, how many people they expect and their message. It also records the IP address, the country and the browser, which is how we tell a school apart from a robot that found the form. If we approve it, that is erased when the school is eventually closed. If we turn it down, or never get to it, it stays until somebody clears it out by hand. Ask us and we will remove it.

Closing an account or a school hides it and starts a ninety day wait, so a mistake can be undone by signing in again. After ninety days a nightly job erases it for good. For an account that is the name, the address, the picture, the password, every session, every private page and every chat. What that person wrote in the school's own pages stays, because it belongs to the school. Closing the school erases the pages, the files, the notes sent to us from inside the app, the record of assistant calls and every account in it.

Two things outlast that. Questions on the board and the answers under them are kept either way, because they are how a school works something out together and they stay useful after the person who asked has gone. And the record of assistant calls holds up to eight thousand characters of what an assistant was shown, which is only cleared when the whole school is erased. Closing one account takes the address and the browser off those lines and leaves the text.

No advertising, no following you across other sites, no profiling, and nothing sold. The companies named on this page are the only ones that get any of it, and only for the job they are named for.

You can ask what we hold about you, ask for it to be corrected or deleted, and complain to the Belgian Data Protection Authority. Write to [email protected].

We rewrite this page when the software changes what it does. The date above says when it last did.