Privacy Policy

Last updated: 28.09.2026

This policy explains what personal data USC (usc.ro) processes, why, and what your rights are under Regulation (EU) 2016/679 (GDPR).

1. Controller

Asociatia Literati, Republicii 202, Comarnic, Prahova, CUI 18855907. Data protection contact: contact@literati.ro.

2. What we process

• Participants without an account: the name or nickname entered, quiz answers, the time they were sent, and a random participant identifier kept in a cookie.
• Students with an account: email address, name, the answers and results of quizzes taken while logged in, the courses they are enrolled in, the names used on the account (with the date of each change), feedback and grades from teachers, messages exchanged with the teachers of their courses, date of last login.
• Course enrolment: you are enrolled in a course automatically when you take one of its quizzes while logged in, or by the teacher, who can add a list of their students' email addresses. In the second case your email address is kept in the course list even before you create an account.
• Uploaded files: homework and documents sent at the teacher's request and, to verify attendance, photos of participants taken in class. Photos are downsized and their metadata (including GPS location) is removed on upload.
• Teachers: email address, name, role, interface language, date of last login, API token and the quizzes they create.
• Login codes: stored only in hashed form for 10 minutes, with the number of attempts, to prevent abuse.
• Technical data: IP address and standard server log information kept by the hosting provider; the IP address is also used briefly to limit how many codes are sent.

3. Purposes and legal bases

• Providing the service (running quizzes, accounts, results): performance of the accepted terms of use (Art. 6(1)(b) GDPR) and the legitimate interest of educational activity (Art. 6(1)(f)).
• Teachers following their students' progress: legitimate interest in teaching and assessment (Art. 6(1)(f)).
• Collecting homework and verifying attendance from photos sent by participants: legitimate interest of educational activity (Art. 6(1)(f)). Photos are not used for facial recognition or any other automated processing.
• Security and abuse prevention: legitimate interest (Art. 6(1)(f)).

We do not use data for advertising, build commercial profiles or sell data. We use no traffic analytics.

4. Who has access

• The teacher who created a quiz sees the answers, results and uploaded files of that quiz; platform administrators have technical access to all data. Files are never public and are not shown on the projector.
• The server's hosting provider and, for sending login codes, the email service provider, as processors acting for the operator.
• When a teacher uses an AI assistant (for example Claude, by Anthropic, or ChatGPT, by OpenAI), connected with their personal API key, to help assess submissions or write feedback, the answers and files of that quiz are sent to that service, which processes them on the teacher's behalf. The teacher remains responsible for the feedback published.
• Messages between a student and the teacher of a course are seen only by the two of them. For a new message the recipient gets an email saying only who wrote and in which course, without the message text (each can turn these emails off). Messages are deleted with the student's account or with the course. If the teacher uses an AI assistant to read or draft replies, those messages are sent to it under the same terms as above.

If the email provider is located outside the European Economic Area, transfers rely on the safeguards provided by the GDPR (for example, standard contractual clauses).

5. Retention

• Answers and results: until the teacher deletes the quiz or your account is deleted.
• Uploaded files: until the teacher deletes them or the quiz. Teachers are advised to delete attendance photos once checked.
• Course enrolments: until the teacher removes you from the course, deletes the course, or your account is deleted.
• Student accounts: until you delete them ("Delete my account" on the Terms and Conditions page) or ask us to.
• Teacher accounts: until deactivated and deleted by an administrator.
• Backups: the platform's data is backed up daily and kept for up to 30 days, outside the website; data deleted from the platform disappears from backups within that period.
• Login codes: 10 minutes. Cookies: see the Cookie Policy.

6. Minors

The platform is used in class, including by students under 18. Taking part without an account, under a nickname, requires no email address. People under 16 create an account only with the agreement of a parent or guardian.

7. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection. Students can delete their own account on the Terms and Conditions page; for other requests write to contact@literati.ro. You may lodge a complaint with the Romanian supervisory authority (ANSPDCP, www.dataprotection.ro) or the authority in your country.

8. Security

Connections are encrypted (HTTPS), data is stored outside the public web area of the server, login uses one-time codes instead of passwords, and access is limited by role.