EVA Privacy Policy
Effective date: 2 June 2026 Last updated: 2 June 2026
This Privacy Policy explains how EVA by Incipe Academy Limited ("EVA", "we", "us", or "our") collects, uses, stores, discloses, and protects personal data in connection with the EVA educational intelligence platform (the "Service"). We are committed to handling personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (the "PDPO") and its six Data Protection Principles.
Plain-language summary: EVA is a tool for teachers. Teachers (and the schools they work for) upload information about their students — including names and submitted work — so that EVA can grade it and produce performance insights. The teacher or school is responsible for having the right to provide that student information. We process it on their behalf, protect it, and do not use it for anything beyond providing the Service.
1. Who this policy applies to
The Service involves two distinct categories of individuals whose personal data we handle:
Account Holders — teachers and school/institution staff who register for and use EVA directly.
Students — the individuals (frequently minors) whose names, submitted work, scores, and performance data are entered into EVA by an Account Holder.
Different parts of this policy apply to each group, as noted below.
2. Our role and the role of teachers and schools
EVA is a tool that Account Holders use to process student information that they already hold.
For Account Holder data (the teacher's or staff member's own account and usage information), EVA is the data user under the PDPO.
For Student data, the teacher and/or their school is the party that decides what student information to collect and upload, and is responsible for having a lawful basis and any necessary parental or guardian consent to do so. EVA processes Student data only on the instruction of, and to provide the Service to, the relevant Account Holder or school. Where EVA contracts directly with a school or institution, the school is the data user and EVA acts as its data processor; separate data processing terms may apply.
By uploading Student data, the Account Holder confirms that they are authorised to provide it to EVA and that any consent required under applicable law (including for minors) has been obtained. This obligation is set out further in our Terms of Service.
3. Personal data we collect
3.1 From Account Holders
Identity and contact details: name, email address, and (where applicable) the school or institution you are associated with.
Account credentials: password (stored only in hashed form).
Billing information for paid (Premium) plans: this is collected and processed by our third-party payment provider; we do not store full card numbers.
Communications: messages you send us (e.g. support requests).
3.2 Student data (entered by Account Holders)
Student identifiers such as name and class/group.
Submitted work (e.g. answer papers, essays, attempts) and associated assessment materials and rubrics uploaded by the teacher.
AI-generated and teacher-confirmed scores, comments, and performance data.
We do not ourselves solicit Student data directly from students, and we do not require any more Student data than the Account Holder chooses to provide. Account Holders are encouraged to upload only the student information necessary for the assessment purpose.
3.3 Technical and usage data
Device and connection information, including IP address and browser type.
Usage and diagnostic data, including AI interaction traces used to monitor, debug, and improve the reliability of the Service.
4. How we use personal data (purposes)
We use personal data only for purposes directly related to providing and operating the Service, namely to:
Create and administer Account Holder accounts and authenticate users.
Perform the core functions of the Service — parsing submitted work, generating AI-assisted grades and feedback against rubrics, building student profiles, and producing performance dashboards in response to teacher queries.
Process payments and manage subscriptions for Premium plans.
Maintain the security, integrity, and reliability of the Service, including diagnostics and abuse prevention.
Respond to your enquiries and provide support.
Comply with applicable legal obligations.
We do not sell personal data, and we do not use Student data for advertising or for training our own or third parties' general-purpose AI models.
5. AI processing and third-party service providers
To deliver the Service, personal data (including submitted student work) is processed by carefully selected third-party providers acting on our behalf. These currently include:
AI model provider (Gemini, "Gemini API") — submitted work and assessment materials are sent to the Gemini API to generate grading, feedback, and dashboard outputs.
Hosting and database provider (Supabase) — stores account and student data. Data is hosted in [SUPABASE HOSTING REGION].
AI observability/tracing provider (AgentOps) — used to monitor and debug AI interactions. (Confirm with this provider what content is captured, and disclose accordingly.)
Payment provider — [PAYMENT PROVIDER NAME], for Premium plan billing.
These providers are permitted to process personal data only as needed to provide their services to us, and are subject to confidentiality and data-protection obligations. Some of these providers process data outside Hong Kong (see Section 8).
6. Student data and minors — special handling
Because EVA is used to process information about students who may be minors, we apply additional care:
The lawful basis and any required parental/guardian consent for uploading Student data rests with the Account Holder and/or their school, who must comply with their own legal and institutional obligations.
We restrict access to Student data to what is necessary to operate the Service.
Student data is used solely to provide the Service to the relevant Account Holder/school and is not repurposed.
An Account Holder or school may request deletion of Student data associated with their account (see Section 9).
If you believe a student's personal data has been provided to EVA without proper authority, contact us at [CONTACT EMAIL] and we will work with the relevant Account Holder or school to address it.
7. Data retention
We retain personal data only for as long as necessary for the purposes set out above:
Account Holder data is retained while the account is active and for a reasonable period afterward to meet legal, accounting, and security obligations.
Student data is retained while the associated Account Holder/school account is active, and is deleted or anonymised upon verified request or within a reasonable period after account closure.
8. Cross-border data transfers
Some of our service providers (including the AI model provider and, depending on configuration, hosting and tracing providers) process personal data outside Hong Kong. Where personal data is transferred outside Hong Kong, we take reasonable steps to ensure it receives a level of protection comparable to that required under the PDPO, including through contractual safeguards with our providers. By using the Service, Account Holders acknowledge these transfers; where required, Account Holders are responsible for ensuring such transfers are permitted in respect of Student data they upload.
9. Your rights under the PDPO
Individuals have the right to:
Request access to personal data we hold about them.
Request correction of inaccurate personal data.
Enquire about our policies and practices regarding personal data.
We will respond to data access and correction requests within 40 days, as required by the PDPO. A reasonable fee may apply to data access requests as permitted by law.
Because EVA processes most Student data on behalf of teachers and schools, requests concerning a specific student should ordinarily be directed to the relevant teacher or school, who controls that data. We will assist Account Holders in fulfilling such requests.
To exercise any right, contact our Privacy Officer at [CONTACT EMAIL].
10. Data security
We implement technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit, hashed credential storage, access controls, and restricted internal access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Cookies and similar technologies
The Service uses cookies and similar technologies necessary for authentication, security, and core functionality, and may use limited analytics to understand usage. Where cookies collect personal data, we provide notice and, where required, seek consent. You can control cookies through your browser settings, though disabling them may affect functionality.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified through the Service or by email. The "Last updated" date reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance.
13. Contact us
Incipe Academy Limited Privacy Officer Email: info@incipeacademy.com
© 2026 Incipe Academy
