Artificial Intelligence Transparency Policy

This Artificial Intelligence Transparency Policy ("Policy") is published by ULEARNA TECHNOLOGY LTD, a company registered in England and Wales ("the Company", "we", "us", "our"), operator of the CLAST.io educational management platform ("the Platform"). This Policy sets out, in full, the nature of all artificial intelligence ("AI") technologies integrated within the Platform, the purposes for which such technologies are employed, the third-party service providers engaged in the delivery of AI functionality, the technical and organisational measures applied to secure data processed in connection with those AI services, and the Company's roadmap for the future development of its AI infrastructure.

This Policy is intended to satisfy the transparency and disclosure requirements of applicable data protection legislation, including but not limited to the United Kingdom General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, and equivalent frameworks in the jurisdictions in which the Platform operates. It further fulfils the disclosure requirements stipulated by third-party platform verification programmes, including those administered by Google LLC in connection with the use of Google Workspace APIs and related services.

Users, institutional administrators, and data subjects are encouraged to read this Policy in conjunction with the Company's Privacy Policy and Terms of Use, both of which are published at clast.io. In the event of any conflict between this Policy and those documents, this Policy shall prevail with respect to matters concerning AI and automated processing.

The Company does not develop, train, or operate any proprietary AI model. All AI functionality made available through the Platform is delivered via the APIs of the following third-party providers, each engaged under a formal data processing agreement that imposes binding obligations regarding the handling, security, and permissible use of any data transmitted to their systems.

The following table sets out each AI-enabled feature of the Platform, the corresponding processing purpose, and the lawful basis under UK GDPR upon which that processing is conducted.

The Company applies a layered, defence-in-depth security architecture to protect all data processed in connection with the AI features of the Platform. The technical and organisational measures described in this Section apply to data both at rest within the Company's infrastructure and in transit to and from third-party AI service endpoints.

4.1 Data Minimisation and Anonymisation

Prior to any data being transmitted to a third-party AI provider, the Company applies a data minimisation process. Only the minimum information necessary to fulfil the specific AI task is included in any API request. Where the AI task can be completed using anonymised or pseudonymised data, direct identifiers (including names, student identification numbers, and contact details) are stripped from the payload before transmission. Student records, financial data, and biometric data are never included in AI API payloads.

4.2 Encryption in Transit

All data transmitted between the Company's backend servers and third-party AI provider endpoints is encrypted using Transport Layer Security (TLS) version 1.2 or higher. The Company does not permit unencrypted API communications. Certificate validation is enforced at the application level to prevent man-in-the-middle interception.

4.3 Encryption at Rest

All data stored within the Company's managed database infrastructure — including institutional records, student data, curriculum content, and AI-generated outputs awaiting human review — is encrypted at rest using AES-256 encryption. Database encryption keys are managed via a dedicated key management service and are rotated on a defined schedule.

4.4 API Key and Credential Security

Third-party AI provider API keys and service credentials are stored exclusively within the Company's secure secrets management system (environment-isolated secret stores). Keys are never embedded in application source code, version control systems, or client-side assets. Access to API credentials is restricted to authenticated backend service accounts operating under the principle of least privilege. Keys are rotated periodically and upon any suspected compromise.

4.5 Access Controls and Authentication

Access to AI features within the Platform is subject to role-based access control (RBAC). Only users holding appropriate authorised roles within their institution's account may invoke AI-assisted functionality. All user sessions are authenticated via secure, expiring JSON Web Tokens (JWT). Administrative access to backend AI processing infrastructure is restricted to authorised Company personnel and is protected by multi-factor authentication (MFA).

4.6 Biometric Data Isolation

The Platform's biometric attendance integration (ZKTeco hardware) is architecturally designed to ensure that raw biometric data — specifically, fingerprint templates — is processed and stored exclusively on the physical attendance device. The device transmits to the Platform only the derived attendance event record (comprising employee or student identifier, timestamp, and attendance status). No biometric template, raw fingerprint image, or biometric hash is ever transmitted to, or stored within, the Platform's servers or any AI processing pipeline.

4.7 Prohibition on AI Training Use

The Company has confirmed, via the applicable data processing agreements and terms of service with each third-party AI provider, that no data submitted by the Company or its Operators via API calls is used by those providers to train, fine-tune, or improve their foundational AI models. This restriction applies to all three current providers: OpenAI, Anthropic, and Google LLC.

4.8 Audit Logging and Monitoring

The Company maintains server-side audit logs of all AI feature invocations. Logs record the initiating user role, the AI service called, the timestamp, and the operational outcome, without retaining the substantive content of AI prompts or responses beyond the session period. Logs are retained for a minimum of twelve (12) months and are used for security monitoring, anomaly detection, and incident response purposes.

Security measures summary

Each third-party AI provider engaged by the Company is subject to a Data Processing Agreement ("DPA") that imposes binding obligations consistent with the requirements of UK GDPR Article 28. These obligations include, without limitation: processing data only on documented instructions from the Company; maintaining appropriate technical and organisational security measures; assisting the Company in meeting its obligations to data subjects; deleting or returning data upon termination of the service relationship; and submitting to audits.

The Company warrants that, to the best of its knowledge, each provider's data processing infrastructure operates in accordance with internationally recognised security standards, including ISO/IEC 27001 or equivalent, and that each provider maintains relevant compliance certifications appropriate to their operations. Users wishing to review the data handling commitments of each provider are referred to the publicly available privacy and security documentation published by OpenAI, Anthropic, and Google LLC respectively.

The Company acknowledges that reliance upon third-party AI API providers introduces certain dependencies and potential data sovereignty considerations, particularly for Operators in markets with specific regulatory requirements. Accordingly, the Company has established a phased roadmap to progressively migrate AI processing to self-hosted, open-source language models deployed within the Company's own controlled infrastructure.

In accordance with UK GDPR and applicable data protection law, individuals whose personal data is processed in connection with the AI features of the Platform retain the following rights, exercisable by submitting a written request to the contact details set out in Section 9:

This Policy is owned by the Data Protection function of ULEARNA TECHNOLOGY LTD and is reviewed on a minimum six-monthly basis, or upon any material change to the AI integrations, data flows, or applicable regulatory requirements described herein. The version history of this Policy is maintained internally.

Where a material change is made to this Policy — including the addition of a new third-party AI provider, a change in the nature of AI processing, or a significant alteration to security measures — affected Operators will be notified in advance via the Platform's in-app notification system and by email to the registered Operator administrator address. Continued use of the Platform following such notification constitutes acceptance of the updated Policy.

Document metadata

All enquiries, data subject rights requests, and concerns relating to this Policy or the processing of personal data in connection with AI features should be directed to:

This Policy does not constitute legal advice. Operators are encouraged to seek independent legal counsel in relation to their own data protection obligations arising from use of the Platform. Nothing in this Policy limits or excludes any right of a data subject under applicable data protection law. The Company reserves the right to amend this Policy at any time upon notice in accordance with Section 8.