How Veileder handles your data

This privacy policy explains how Veileder (https://veileder.ai), run by the AI in Programming Research Group at NTNU, collects, uses, stores, shares and protects your personal data, including the data we receive from your Google account when you sign in.

Who is responsible

Veileder is developed and run by the AI in Programming Research Group at NTNU, the Norwegian University of Science and Technology, which is responsible for the personal data described here (the data controller). Questions about privacy: hello@veileder.ai.

Data we collect

• Your account: your name, your email address and an identifier from the sign-in provider (Google). We never see your password.
• Your learning: your conversations with your Veileder, the code you run and hand in, which tasks and challenges you have solved, and your reflections.
• Technical logs: short-lived records of requests and errors, to keep the service running and safe.

Signing in with Google

When you sign in with Google, we receive only your name, your email address and your Google account identifier. We get no access to your Gmail, Drive, contacts or any other Google data. We use this information only to create your account, sign you in and show your name in Veileder. We do not sell it, share it with anyone else, or use it for advertising. Veileder's use of information received from Google complies with the Google API Services User Data Policy, including the Limited Use requirements. We do not use information received from Google to develop, improve or train AI or machine learning models, and we do not pass it to anyone who does.

How we use your data

To give you your Veileder: to answer your questions in context, check your code, show your progress and let you continue where you left off. We use it for nothing else, and we do not use it for advertising or profiling.

The AI behind your Veileder

To answer you, your question and the relevant context (the task, your code and the course material) are sent to Anthropic, the provider of the Claude language model, which processes it on our behalf. Anthropic does not use this data to train its models. Processing may take place in the United States; such transfers are covered by the EU's standard contractual clauses.

How we store your data

Your data is stored in Google Cloud in the EU (europe-north1, Finland). Access is limited to the service itself and to the people who run it, when they need it to fix a problem.

How we protect your data

All traffic to Veileder is encrypted (HTTPS), and data is encrypted at rest in Google Cloud. Only the service itself and the few people who run it can reach the database, and only when they need to fix a problem. Code you run is executed in an isolated sandbox with no internet access.

How we share your data

Only the two service providers named above: Google Cloud (hosting and storage) and Anthropic (the language model). Both process data only on our behalf. We do not share your data with anyone else.

Cookies and your browser

Veileder uses one cookie, to keep you signed in, and a short-lived one while you sign in. Your colour theme and a few layout choices (such as a folded panel) are remembered in your own browser and never sent to us. There are no analytics or advertising cookies.

How long we keep your data, and deleting it

As long as you have an account. When you delete your account, your learning data is deleted at once and disappears from our backups within 14 days. Technical logs are kept for at most 30 days.

Removing Veileder's access to your Google account

You can remove Veileder's access at any time in your Google Account, under Security → Your connections to third-party apps & services, at https://myaccount.google.com/connections. This stops sign-in; to also delete your data, use “Delete my account and data” in Veileder.

Your rights

You can see your learning on My learning and delete your account and all its data from the account menu (“Delete my account and data”). You can also ask us for a copy of your data, or to correct it, at hello@veileder.ai. If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

Children

Veileder is intended for students in higher education. It is not directed at children under 16, and we do not knowingly collect data from them.

Changes to this policy

If we change this policy, we update the date at the top of this page. For significant changes, we will tell users in Veileder before they take effect.