1. Controller
The controller of the data collected on cerium-app.com and in the panel at app.cerium-app.com, to the extent described below, is IT Maciej Bodnar, tax ID (NIP) 5243050733, operating under the fire-gem brand. For data matters write to [email protected].
2. Two roles: controller and processor
For data the School enters into the system or collects on its public pages (enrolment form, survey, test, payment link) the School is the controller and we process it as a processor, on its instructions and under the data processing terms of the agreement. If you are a student, parent or school employee, send requests about that data to the school; any request that reaches us is forwarded to it. We do not enter a school's workspace; we see limit usage figures, the list of people with their last activity date and signed-in devices, the requests sent to us and the mail delivery log (recipient address and subject, never the body), and at the School's request we prepare a downloadable package of its data. This policy covers the data we control ourselves.
3. What data and why
Contact and demo forms: name, e-mail address, phone, school name, number of students and message, to reply and schedule a demo (Article 6(1)(b) and (f) GDPR); they are not stored in our database, they reach our mailbox. Agreement and subscription: details of the company or person and the contact person, invoices and proof of the agreement (name, e-mail, IP address, time and a copy of the accepted text), to perform the agreement, meet tax obligations and defend claims (points (b), (c) and (f)). User accounts: e-mail address, name, hashed password, language, IP address and browser for each session, and the day of last activity in a workspace, to deliver the service and keep it secure (points (b) and (f)). Support requests and correspondence: content, requester details, browser and an attached screenshot, for customer support (point (f)).
4. Children and online lessons
Accounts of students, including minors, and of their guardians are created only by the school; processing is based on its agreement with the learner, not on the child's consent. A guardian has their own account and sees their children's data. Online lessons run through our own video server in Poland and are not recorded; we store only who was in the room and when, as a hint for attendance.
5. Cookies
The website and the panel use only files needed to work and to remember your settings: the session after signing in (__Host-cerium-app-rv2_session, at most 30 days), language (cerium_app_rv2_locale), light or dark theme (cerium_app_rv2_motyw and related, on the website cerium_landing_motyw), menu state and the chosen screen view (sidebar_state, journal_scope, journal_view, projects_view). The panel also keeps the table layout in browser storage. We use no analytics tools, advertising pixels or profiling, so there is no consent banner. Exception: a YouTube or Vimeo video embedded by a school on a whiteboard works under that service's rules.
6. Recipients
Our application and database servers are our own and located in Poland; the online lesson server runs there too. Data reaches the providers the service cannot run without: Cloudflare (the network carrying traffic to the website and panel), Hetzner Online GmbH (file storage in Germany), Zoho (e-mail: the [email protected] mailbox in Zoho Mail and system messages sent through ZeptoMail, EU data centre) and Stripe (the Cerium subscription; a school's online payments go through its own Stripe account). Each of them processes data under the provider's data processing terms and may not use it for its own purposes. Schools are notified at least 14 days before this list changes.
7. Transfers outside the European Economic Area
Some providers belong to groups outside the EEA: Cloudflare and Stripe have parent companies in the USA. Transfers take place under the European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. Files and e-mail stay in the EU.
8. How long we keep data
Form enquiries: until the matter is closed, at most 12 months. Support requests: up to 12 months. Invoices: 5 years from the end of the year they were issued. Proof of the agreement: for the term of the agreement and until claims expire. School workspace data: for the term of the agreement and 90 days after termination. An account with access to no school: deleted after 180 days without sign-in. Sessions: at most 30 days, 14 without activity. Daily activity record: 90 days. Panel notifications: 60 days. Server logs rotate within a few days, and Cloudflare processes IP addresses under its own policy. Backups are made daily and kept for 14 days, so deleted data leaves them within that time.
9. Do you have to provide data
Providing data is voluntary, but without an e-mail address we cannot answer an enquiry or create an account, and without the details needed for the agreement we cannot conclude it. We make no decisions based solely on automated processing and do no profiling.
10. Language model (OpenAI) and help chat
Two panel features use a language model from OpenAI. The AI comment on a student report is on by default, and the school owner turns it off in Settings. The model then receives attendance, grade and task statistics and the teacher's notes, after names, school and group names, e-mail addresses, phone numbers and national ID numbers are removed. The removal has limits: a diminutive of a name, or a person not in the school's records, can remain in the text of a note, so do not enter data in notes that you do not want sent on. The help chat in the panel sends the model the question the user typed, their role and excerpts from the help guides; do not enter personal data in it. We ask the provider not to store requests. The model only proposes the comment, and the teacher reads and approves it before the report is issued. The contracting entity, the processing location and the basis for transfers outside the EEA are given on the subprocessors page.
11. Browser notifications
If you turn on notifications in your browser yourself, we store its subscription (the push service address and encryption keys) with your account, and the pop-up with a short notification text goes through the push service of the browser's maker, for example Google, Mozilla, Microsoft or Apple. The content is encrypted, so the service sees an encrypted message, the subscription address and the time, not what it says. You can turn notifications off in the browser settings or in your Account, and we delete the subscription together with the account. Details are on the subprocessors page.
12. Your rights
You have the right to access your data, rectify it, erase it, restrict its processing, port it and object to processing based on legitimate interest. Send your request to [email protected]; we reply within one month. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
13. Security
Connections are encrypted, passwords are stored only as hashes, each school's data is separated at the database level and server access is limited to the people who need it. The servers are in Poland and backups are made daily. We will inform you without undue delay of a breach that may affect your rights.
14. Changes to this policy
We update this policy when the scope of the service or the law changes. The current version is always at this address, with its effective date at the top.