Privacy Policy

Effective: March 26, 2026

Last updated: July 25, 2026 — pending legal review. This policy describes our current production stack and practices and is provided for transparency; it has not yet been reviewed by counsel.

1. Who We Are

Anaptu ("we", "us", "our") is an AI-powered learning platform operated by AgentSOX Ltd., based in Israel. This policy explains how we collect, use, and protect your personal data when you use our service at anaptu.agentsox.com.

AgentSOX Ltd.
Israel

AgentSOX has not appointed a Data Protection Officer as we do not currently meet the thresholds requiring mandatory appointment under GDPR Article 37 or Israel's Privacy Protection Law Amendment 13. For all privacy inquiries, contact us at atlas@agentsox.com.

EU/EEA Representative: We have not yet appointed an EU/EEA representative under GDPR Article 27. If you are located in the EU/EEA and wish to exercise your data protection rights, please contact us directly at atlas@agentsox.com. We will appoint an EU representative as our EU user base grows.

2. What We Collect

When you use Anaptu, we collect the following categories of personal data:

• Account information: Your name, email address, and profile picture from Google OAuth. We do not store your Google password.
• Age:We ask for your age to personalize the teaching experience and comply with children's privacy laws.
• Learning data: Topics you study, compass plans (structured learning outlines), chat messages with the AI tutor, quiz responses, and progress data.
• Usage data: Pages visited, features used, session duration, and device/browser information.
• Preferences: Language, theme (light/dark), and locale settings stored in cookies.
• Billing information: If you subscribe to a paid plan, we store your subscription status, plan, and a billing customer identifier. Your payment is processed by our Merchant of Record (Polar) — we receive confirmation of your subscription but do not receive or store your full payment card number.

3. Google User Data

Anaptu uses Google OAuth to authenticate your account. We access your Google account name, email address, and profile picture solely to create and maintain your Anaptu account.

Anaptu's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, transfer it to third parties (except as necessary to provide the Service), or use it to train AI/ML models.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract performance (GDPR Art. 6(1)(b)): Processing necessary to provide the Anaptu learning service you signed up for.
• Legitimate interest (GDPR Art. 6(1)(f)): Analytics and service improvement using aggregated, anonymized data.
• Consent (GDPR Art. 8): For minors, we rely on a parental/guardian consent acknowledgement recorded at profile setup (see Section 12). You may withdraw consent at any time.
• Israel Privacy Protection Law: As an Israeli company, we comply with the Protection of Privacy Law, 5741-1981, including Amendment 13, which governs the collection, storage, use, and transfer of personal data in Israel.

5. How We Use Your Data

• Personalization: We use your learning history, age, and preferences to tailor lessons, adjust difficulty, and recommend topics.
• AI tutoring: Your messages are sent to AI language model providers to generate teaching responses (see Section 6).
• Service improvement: We analyze aggregated, anonymized usage patterns to improve the platform.
• Communication: We may send important service updates to your email. We will never send marketing emails without your explicit consent.

6. AI and Your Data

Anaptu uses artificial intelligence to generate teaching content. When you send a message in a learning session, or when you upload a document or provide a URL for the AI tutor to work with, that content is processed by AI language models. Your messages and uploaded content are transmitted to our AI model provider (OpenRouter) over encrypted connections (TLS) to generate teaching responses. Where you ask the tutor to use information from the web, the relevant web content (and your query) is also processed by our web-search and content-extraction sub-processors (see Section 7).

• We do not use your data to train our own AI models, and we do not authorize our AI providers to use your content to train their models. Conversation history is stored in our database to maintain session continuity.
• Quality evaluation.We do review real examples — primarily feedback you submit, and the lesson context frozen with it — to measure and improve teaching quality. That work changes our prompts, our evaluation tests, and our software; it never trains or fine-tunes a model on your data. Legal basis: our legitimate interest in a functioning product (GDPR Art. 6(1)(f)). Data used this way follows the retention rules in Section 9, and minors' data is excluded entirely.
• Our AI model providers process your messages to generate a response. We rely on their published terms and data-processing commitments regarding retention and model training; we do not control their internal processing beyond what those terms provide. We encourage you not to share sensitive personal information in chat messages.
• AI-generated responses may contain errors or inaccuracies. Anaptu is not a substitute for professional education or certified teaching.
• We do not use AI to make automated decisions that produce legal or similarly significant effects on you.
• AI-generated conversations may be reviewed by automated safety systems and, where flagged, by authorized personnel, to detect and prevent harmful content.

7. Data Sharing and Sub-processors

We do not sell your personal data. We do not share your data for advertising purposes.

Service Providers

We share data only with the following service providers who process data on our behalf:

The set of sub-processors above reflects our current production stack and may change as the Service evolves. Sub-processors located outside the EU/EEA process data under appropriate safeguards (see Section 8).

In addition to the sub-processors listed above, your data may be accessed by AgentSOX employees and contractors who need access to perform their duties, subject to confidentiality obligations. We do not share data with any other categories of recipients.

Legal Disclosure

We may disclose your personal data when required by law, in response to valid legal process (such as a subpoena, court order, or government request), or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Third-Party Links

The Service may contain links to third-party websites or resources. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal data.

8. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States and Israel. For transfers from the EU/EEA, we rely on:

• EU adequacy decisions (Israel has a partial adequacy decision from the European Commission)
• Standard Contractual Clauses (SCCs) with our US-based sub-processors (including OpenRouter, Tavily, Firecrawl, Vercel, Google, Cloudflare, Polar, and Resend to the extent data is processed in the US)

Our primary application hosting and database (Railway) and our AI observability provider (Langfuse) operate in the EU. Where conversation content is transferred to US-based AI or web sub-processors, that transfer is carried out under SCCs and other appropriate safeguards.

9. Data Retention

• Account data: Retained as long as your account is active.
• Learning sessions and chat history: Retained for up to 24 months from last activity, then automatically deleted by a scheduled purge job. Uploaded documents and their extracted content are deleted on the same schedule.
• Usage and engagement records: Retained for up to 12 months, then automatically purged.
• Feedback you submit (thumbs votes, written reasons and suggested rewrites, quality reports, attached screenshots): the personal parts are kept for up to 12 months, then automatically stripped by the same scheduled job — the rating, category and date survive as anonymous statistics, while your account link, the written text, the frozen lesson context and the screenshot reference are erased. Attached screenshots are deleted from object storage after 90 days.
• Aggregated analytics: Retained in aggregated, anonymized form indefinitely.
• Deleted accounts: When you delete your account (see Section 10), your account and associated personal data are erased immediately. Backups and observability traces are removed within 30 days.

10. Your Rights

Depending on your location, you have the following rights regarding your personal data:

• Access: Request a copy of all personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure:Request deletion of your data ("right to be forgotten").
• Portability: Request export of your data in a machine-readable format.
• Restriction: Request that we limit processing of your data.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Withdraw consent at any time (for processing based on consent).
• Automated decision-making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Anaptu does not currently make such decisions.

Self-service: You can exercise two of these rights directly from your account without contacting us:

• Export your data: Download a machine-readable JSON copy of all data we hold about you (your profile, learning sessions, chat history, threads, compass reports, feedback, and usage records) via the in-app data export, which calls our GET /api/v1/users/me/export endpoint.
• Delete your account: Permanently erase your account and associated personal data via the in-app account deletion, which calls our DELETE /api/v1/users/me endpoint. This takes effect immediately and signs you out.

To exercise any of the other rights, or if you need help, contact us at atlas@agentsox.com. We will respond within 30 days (or sooner as required by applicable law).

Supervisory Authorities

EU/EEA users: You also have the right to lodge a complaint with your local data protection supervisory authority.

Israeli users: You may lodge a complaint with the Privacy Protection Authority (PPA) at www.gov.il/en/departments/the_privacy_protection_authority.

California residents (CCPA): We do not sell personal information. You have the right to know, delete, and correct your personal information. We will not discriminate against you for exercising these rights.

11. Cookies

We use only essential cookies required for the service to function:

• Authentication cookie: Session token to keep you signed in.
• Locale cookie: Stores your language preference (English/Hebrew).
• Theme cookie: Stores your visual theme preference (light/dark/palette).

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. Because we use only strictly necessary cookies, we do not require cookie consent under the ePrivacy Directive.

Do Not Track: Because we do not use tracking or advertising cookies, the Service operates the same way whether or not a Do Not Track signal is received.

12. Children's Privacy

The Service is not directed to children under 13, and the minimum age to sign up for Anaptu is 13. Sign-up includes a neutral age screen; age is self-declared, and we do not perform hard age verification. Accounts indicating an age under 13 are blocked — both in the sign-up flow and server-side — and no under-13 profile is created. If we learn that we have nonetheless collected personal data from a child under 13, we will delete it. We take minors' privacy seriously.

• Users under 13: Accounts are not available to children under 13 and under-13 sign-ups are blocked. We do not offer a verifiable-parental-consent flow that would allow under-13 use. If you are under 13, please do not use the Service.
• Users 13-17:Users aged 13-17 require verifiable parental consent through the "email-plus" method: the user provides a parent or guardian's email address, the parent receives an email describing the Service and our data practices, and must confirm their consent before the minor can learn. Accounts created before this method launched recorded a parent/guardian acknowledgement at profile setup; we may ask those users to complete the email confirmation as well.
• Users 13-15 (GDPR): In EU/EEA countries where the digital age of consent is higher than 13 (up to 16), the parental consent described above is the mechanism we rely on. If you have questions, contact us at atlas@agentsox.com.
• Data minimization:We collect only the minimum data necessary to provide the learning service. Minors' data is used only to provide the Service.
• No advertising, no sale:We do not use minors' data for advertising or behavioral profiling, we do not sell it, and we do not use it for any purpose other than providing the learning service.
• No quality-evaluation use:Minors' data is excluded from the datasets we assemble for quality evaluation and labeling (we do not train AI models on any user's data — see Section 6). Our export tooling filters out data belonging to users under 18.
• AI disclosure: Messages and uploaded content from all users, including minors, are processed by our AI provider (OpenRouter) to generate teaching responses, as described in Section 6.
• Parental rights:Parents or guardians of a minor may revoke their consent, and may request access to, review of, deletion of, or to refuse further collection of their child's data at any time by contacting atlas@agentsox.com. On revocation we stop further collection and, on request, delete the minor's account and associated personal data (see Section 10).

13. Security

We implement appropriate technical and organizational measures to protect your personal data, including: encrypted data transmission (TLS), encrypted data at rest, access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

14. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay. We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33 and Israel's Privacy Protection Law.

15. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or an in-app notice. Continued use of Anaptu after changes constitutes acceptance of the updated policy.

16. Contact

For privacy questions, data requests, or complaints, contact us at: atlas@agentsox.com

AgentSOX Ltd.
Israel