Privacy Policy
Last updated: 30 June 2026
1. Who we are
HelpTheBot is operated by Anton A. A. Autzen, Technical University of Denmark, Denmark. For privacy matters, contact us at aaas@dtu.dk.
2. What data we collect and why
Teacher accounts
When you create an account we store your username and email address. This is necessary to
provide the service (legal basis: Article 6(1)(b) GDPR — performance of a contract).
We do not share this data with third parties except as described in section 4.
Student conversations
When a student uses a bot, their chat messages are stored against a randomly generated
session ID, plus a separate device identifier (stored in the browser's local storage)
that links together a student's attempts on the same bot. We do not collect names, email
addresses, or any other identifying information from students by default. Students are
reminded not to enter personal information into the chat. The legal basis for storing
conversations is legitimate interest in supporting educational assessment (Article 6(1)(f)
GDPR). Conversations are automatically deleted after 180 days (configurable
by the administrator).
Academic-integrity signals
When anti-cheat is enabled, the chat page also records counts of how input reached it —
for example how many characters were typed versus inserted without a keystroke, whether
clicks were preceded by mouse movement, keystroke-timing regularity, and whether input
arrived while the tab was hidden — to help teachers spot sessions operated by AI agents.
Only counts and timings are stored, never what keys were pressed. They are stored with
the conversation and deleted with it.
Claiming a chat
A student may optionally "claim" one of their chat sessions as the one they want graded,
by entering their name and, optionally, their email address. This is provided voluntarily
by the student for the purpose of submitting their work (Article 6(1)(b) GDPR — performance
of a contract, i.e. the assessment the student is participating in). Because every session
from the same device shares the same device identifier, claiming one session lets the
instructor see that the same device also produced other, unclaimed sessions on that bot —
though not who those other sessions belong to, unless separately claimed. Claimed name/email
is retained for as long as the underlying conversation is (see retention above).
3. Cookies
We use only technically necessary cookies:
- sessionid — keeps you signed in during your browser session
- csrftoken — protects against cross-site request forgery
We do not use analytics, advertising, or tracking cookies. No consent banner is required for technically necessary cookies under the ePrivacy Directive.
4. Third-party processors
OpenAI — chat messages are sent to OpenAI's API to generate bot responses. OpenAI acts as a data processor under a Data Processing Agreement and has signed EU Standard Contractual Clauses to cover international data transfers. See OpenAI's privacy policy.
Railway — the application and database are hosted on Railway (US). Railway is covered by EU Standard Contractual Clauses. See Railway's privacy policy.
Resend — we use Resend to send account verification and password-reset emails. Your email address is transmitted to Resend for this purpose only. See Resend's privacy policy.
5. Data retention
- Teacher account data: retained until you delete your account.
- Student conversations: automatically deleted after 180 days.
6. Your rights
Under GDPR you have the right to access, correct, or delete your personal data; to restrict or object to processing; and to data portability. To exercise any of these rights, email aaas@dtu.dk. Teacher accounts can also be deleted directly from the platform — sign in and use the Delete account link.
You have the right to lodge a complaint with your national supervisory authority. In Denmark this is Datatilsynet.
7. Changes to this policy
We will update this page if our practices change and note the revision date at the top. Continued use of the service after changes constitutes acceptance.