Loading…
Loading…
Last updated: July 2026
When the public interest page is open, we may collect your email address solely to contact you about VibeKoala product updates and launch news. This is optional and requires your affirmative consent on that form. You may opt out using the unsubscribe link we provide. Closing the interest page does not delete existing records; contact support if you need erasure.
VibeKoala handles personal data with reference to the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong. Role classification depends on the processing purpose:
See also our subprocessors list for classes of persons to whom data may be transferred.
On or before collection (account registration, classroom join, module use, material upload, and checkout) we collect personal data for the purposes below. Supply of account name and email is obligatory to use the service. Other fields may be optional as shown in the product UI.
We do not sell personal data. We do not currently use personal data for direct marketing under PDPO Part 6A. If that changes, we will provide the required notice and obtain consent before use.
When you use AI features (chatbots, document tutors, generation modules, embeddings, TTS, etc.), prompt text, chat history, and relevant material excerpts are sent to the configured AI provider so the feature can run. Providers may include OpenRouter, Hugging Face, Poe, Pinecone, ElevenLabs, and teacher- or student-configured Flowise/Dify endpoints. Transfers may leave Hong Kong. Platform-hosted inference uses a platform key within published quotas; BYOK uses keys you supply under your provider agreement.
Creating an account and using AI modules constitutes acknowledgement that this processing is required to provide those features. Research-study classrooms additionally require the join consent flow.
Teachers may enable AI outbound privacy controls per classroom (on by default): redact obvious emails/phones/ID-like tokens and replace member display names with aliases in the provider request only. Classroom records keep the original text. Redaction reduces risk; it is not full anonymisation.
We use session cookies necessary to keep you signed in (via our authentication library). We do not use third-party analytics cookies on student-facing pages. Details may expand if additional cookies are introduced.
Your keys are decrypted only in server memory to call providers on your behalf during sessions you initiate. We never return plaintext keys to the browser after save. We record lastUsedAt and per-event credentialId for transparency.
Default retention windows for usage events and aggregates are configured in classroom settings on the server (for example event and aggregate retention day defaults). A full teacher-facing retention editor may be expanded over time. Account data is kept while your account remains open and as needed for security, billing disputes, and legal obligations.
Self-serve accounts are intended for users aged 18 or older. The catalog may include materials labelled for younger grade bands for teachers to use with their classes. If a teacher invites a person under 18, the teacher is responsible for obtaining any parental or guardian consent and for complying with applicable PDPO and school rules. VibeKoala does not currently provide a built-in parental-consent workflow; wide K-12 deployment remains subject to that tooling and legal review.
Under the PDPO you may request access to and correction of your personal data. You may also request erasure where appropriate. Contact us at hello@vibekoala.ai (or via vibekoala.ai). We aim to respond within 40 calendar days. Self-service export and deletion tools may be added later; until then requests are handled manually under our internal runbook.
By default we collect operational telemetry (event types, token counts, timestamps) to run classrooms and show teachers monitoring summaries. Teachers may opt in per room to allow de-identified export of classroom content (chat text and student artifacts) for platform research and AI model improvement. Opt-in is off by default and controlled in room settings.
Research study classrooms require explicit participant consent at join before room entry. Consent records include the information sheet version, locale, and checkbox acknowledgements. Participants may withdraw consent without academic penalty. See Research Participation.
We do not use third-party analytics on student-facing pages. Research exports are processed on our infrastructure with pseudonymized identifiers where designed to do so.
We take practicable steps to protect personal data, including encrypting stored API keys (AES-256-GCM). No method of transmission or storage is completely secure.
Privacy requests: hello@vibekoala.ai. More: Terms of Service, Subprocessors.