Privacy Policy

Sofiya.ai ("Sofiya", "we", "us") is operated by Cognitive Analytics, 170-422 Richards Street, Vancouver, BC, Canada. This policy explains what personal information we collect through sofiya.ai and our related services (the "Service"), how we use and protect it, and the choices and rights you have.

Sofiya is a learning platform used by educational institutions, instructors, and students. Because most people use Sofiya through an institution, your institution's own privacy notices and policies also apply to the information it manages through Sofiya.

1. Our role: who is responsible for your information

• Institution accounts. When your school, college, university or other organization (your "Institution") provides Sofiya to you, the Institution decides why and how your information is used for teaching and administration. In that case Sofiya acts as the Institution's service provider and handles your information on its instructions. Questions about access, correction, or deletion of course records are best directed to your Institution first.
• Independent users and platform operations. For independent accounts, account security, billing (if any), support, and the operation and improvement of the Service itself, Sofiya is responsible for the information.

2. Information we collect

Account information. Name, email address, role (for example student, instructor, administrator), Institution membership, and language preference. If you accept an invitation, we process the invitation token and the email address it was sent to.

Course and learning content. Classes, rosters, assignments, rubrics, course materials, submissions, grades or feedback, and settings an instructor configures (such as turn limits and checkpoints).

AI chat content. Messages you send in the chat feature, the AI's responses, and associated metadata such as the selected model and timestamps.

LMS (LTI) integration data. If your Institution connects Sofiya to its learning management system, we receive launch data such as your user identifier, name, email, role, and course context, as permitted by your Institution's configuration.

Technical and usage information. IP address, browser and device type, pages and features used, error and security logs, and information collected through cookies and similar technologies (see our Cookie Policy).

Communications. Messages you send us for support, and transactional emails we send you (for example, invitations and account notices).

We do not ask you to share passwords with anyone, and we do not sell personal information.

3. How we use information

• To provide, operate, and maintain the Service, including creating accounts, enrolling users in Institutions, and delivering classes, assignments, and chat.
• To send invitation emails and other service-related messages.
• To generate AI responses within chat and related features.
• To secure the Service, prevent abuse, and troubleshoot problems.
• To provide support and respond to your requests.
• To understand and improve the Service, using aggregated or de-identified information where practical.
• To comply with legal obligations and enforce our Terms of Service.

4. AI processing

Sofiya's chat feature is powered by large language models delivered through Microsoft Azure OpenAI Service, deployed in Canadian Azure regions (for example, Canada East). Where the interface shows a region next to a model name, that is the region where the model is hosted.

• Chat content is sent to the model provider solely to generate responses for you.
• Neither Sofiya nor our model provider uses your chat content or course content to train or improve foundation AI models.
• AI output can be inaccurate. Please review it critically and do not rely on it as the sole basis for important decisions.

5. How we share information

We share personal information only as described here:

• Your Institution. Administrators and instructors at your Institution can access information associated with your account and activity in their classes, in line with their roles and the Institution's policies.
• Service providers. We use vendors to host, secure, and run the Service, including cloud hosting and AI services (Microsoft Azure), and a transactional email delivery provider engaged to send account and course notifications on our behalf. They may only use information to provide services to us and are bound by confidentiality and security obligations.
• Integrated platforms. If your Institution uses LTI, information is exchanged with its LMS as configured by the Institution.
• Legal and safety. We may disclose information when required by law or legal process, or to protect the rights, safety, and security of users, the public, or Sofiya.
• Business transfers. If Sofiya is involved in a merger, acquisition, or sale of assets, information may be transferred, subject to this policy's protections.

6. Where information is stored

Our AI processing is hosted in Canadian Azure regions, and our production systems are configured to require this. We take commercially reasonable steps to host the rest of the application and its database primarily in Canada; some operational or support functions may access or process limited information from outside Canada, for example for security or support, in which case we take reasonable steps to ensure comparable protection.

7. Retention

We keep personal information only as long as needed to provide the Service and fulfil the purposes in this policy, or as required by law. As a general schedule: conversation transcripts are archived roughly 13 months after a course concludes and the transcript content is permanently deleted around 24 months after that point (a record that the conversation occurred may be kept for academic or administrative purposes); content awaiting a safeguarding review is kept for up to 7 days; and course materials you delete are held in a recoverable state for 30 days before being permanently removed. Institutions may set additional retention choices for their own course records. When an account or Institution relationship ends, we delete or de-identify associated information within a reasonable period, unless we must retain it (for example for legal or security reasons). Backups are overwritten on a regular cycle.

8. Security

We use administrative, technical, and organizational safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls, and logging. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected individuals and the relevant authorities as required by applicable law.

9. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• request correction of inaccurate information;
• withdraw consent, subject to legal or contractual restrictions;
• request deletion of your information; and
• ask questions about our practices or make a complaint.

To exercise these rights, contact us at hello@sofiya.ai. If you use Sofiya through an Institution, we may refer your request to the Institution or work with it to respond. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy regulator (for example, the Commission d'accès à l'information du Québec).

10. Children and students under 18

Sofiya is intended for use in educational settings. Institutions are responsible for obtaining any parental or guardian consents or authorizations required for students who are minors, and for confirming that their use of Sofiya complies with applicable education and privacy law. We do not knowingly offer the Service directly to children under 13. If you believe a child has provided us information without appropriate authorization, contact us and we will take steps to delete it.

11. Third-party links and services

The Service may link to third-party sites or integrate with other platforms (such as your LMS). Their privacy practices are their own, and we encourage you to review them.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, give notice through the Service or by email.

13. Contact us

Cognitive Analytics 170-422 Richards Street, Vancouver, BC, V6B 2Z4 Email: hello@sofiya.ai