Saval Privacy Notice
Last Updated: October 10, 2026
1. Introduction
Welcome to Saval ("Saval," "we," "us," or "our"). This Privacy Notice explains how we collect, use, disclose, safeguard, and transfer your personal data when you access or use our AI-powered Problem-Based Learning (PBL) platform, available at saval.app (the "Service").
This Notice explains the practices that apply when you use the Service. Where we rely on your consent, we ask for it separately and you can withdraw it at any time.
This Notice may be supplemented by additional privacy statements (e.g., for specific regions or products) where applicable.
2. Legal Compliance
We process personal information in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) (for EU/EEA residents), COPPA (for U.S. children's data), FERPA (for U.S. educational data), and other national privacy regulations.
For individual teacher accounts, we act as the data controller. When a school or institution uses Saval with its students, the institution is the controller and Saval processes data on its behalf as a processor, under our Data Processing Addendum (DPA).
3. Information We Collect
We collect and process the following categories of information:
a. Information You Provide
- Account registration details (email, password, display name, role)
- Profile and optional contact information
- Educational content: quizzes, responses, progress
- Support, feedback, and communication form submissions
b. Automatically Collected Information
- Device and browser information
- Service usage metrics and interaction data
- Error and diagnostic logs
c. Data from Third Parties
- Authentication provider data (if linked)
- Service providers supporting functionality
4. How We Use Your Information
We use your data to:
- Provide and improve the Service
- Deliver AI-powered grading and learning analytics
- Respond to support requests and communications
- Maintain security and prevent fraud
- Send service, system, and legal notices
- Comply with legal obligations
We do not sell your personal data or use it for cross-context behavioral advertising.
5. Legal Bases for Processing
We process personal data based on:
- Contractual necessity (to provide the Service)
- Consent (where required)
- Legitimate interest (e.g., security, analytics)
- Legal obligations (e.g., data retention laws)
6. Data Sharing & Authorized Sub-processors
We use a small number of vetted service providers ("sub-processors") to run the Service. Each is bound by written data protection terms at least as protective as ours and may use data only to provide its service to Saval.
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Supabase (cloud hosting) | Database, sign-in, file storage and server functions | Account details, quizzes, student responses, activity logs |
| Lovable AI Gateway (Google Gemini, OpenAI GPT) | AI feedback, grading suggestions and question generation | Question text, rubric and the student response being assessed |
| Piston code runner | Running student code in an isolated sandbox | Submitted source code (not stored after execution) |
| Resend | Service emails such as invitations and password resets | Email address and display name |
| Stripe | Subscription payments | Billing contact and payment details of paying teachers or institutions only; never student data |
We give institutions at least 30 days' notice before adding or replacing a sub-processor, so they can object. We may also disclose data where required by law, or to a successor in a merger or acquisition that remains bound by this Notice.
We do not sell personal data, and we never share student data for advertising or commercial purposes.
7. International Data Transfers
User data may be stored and processed outside your home jurisdiction (e.g., in cloud environments). We implement appropriate safeguards (e.g., standard contractual clauses) to ensure compliant transfers.
8. Your Rights
Depending on your location, you have rights to:
- Access, correct, or delete your data
- Withdraw consent
- Restrict or object to processing
- Data portability
- Lodge a complaint with a supervisory authority
Requests may be submitted via support or privacy contact channels and will be processed within statutory timeframes.
9. Children's Privacy, COPPA & School Consent
Saval is built for schools, colleges, universities, and educators. Student data is used only to deliver the educational Service and is never used for advertising, profiling for commercial purposes, or sale.
School authorization (COPPA)
For students under 13 in the United States, Saval relies on the school's authorization, as permitted by the FTC for educational use. The school acts on behalf of parents and may consent to collection of student data solely for the use and benefit of the school. Parents may ask the school, or contact us at privacy@saval.app, to review or delete their child's information and to stop further collection.
We collect only the information reasonably necessary for the student to take part in the activity (for example a name or nickname, a school email where used, and assessment responses). Guest participation requires no email address.
Institutional consent (GDPR / UK GDPR)
Where a school or institution uses Saval with its learners, the institution is the data controller and Saval acts as its data processor under our Data Processing Addendum. The institution determines the lawful basis for processing and, where a child is below the digital age of consent in their country (between 13 and 16 in the EU, 13 in the UK), obtains any required parental consent.
Education records (FERPA)
For U.S. institutions subject to FERPA, Saval acts as a "school official" with a legitimate educational interest under 34 CFR § 99.31(a)(1). Education records remain under the institution's direct control.
AI and student work
Student responses sent for AI feedback are used only to produce that feedback. We do not use student data to train AI models, and our AI providers are engaged under terms that do not permit them to use the data to train their models. Teachers remain responsible for final grades.
10. Cookies and Local Storage
We use essential cookies and local storage solely to enhance Service functionality. We do not use tracking cookies for advertising.
11. Data Retention
Data is retained for as long as necessary to fulfill Service obligations or as required by law. Soft-deleted content may be recoverable during defined retention periods.
12. Changes to This Privacy Notice
We may update this Notice due to operational or legal changes and will notify you of material updates through your account or prominent notices.
13. Contact Information
If you have questions about this Privacy Notice, please contact:
We aim to respond to all privacy inquiries within 30 days.