นโยบายความเป็นส่วนตัวPrivacy Policy

Learnly assists teachers with reading reasoning, identifying errors and drafting feedback on secondary-school mathematics work. It serves individual teacher subscribers and schools purchasing access for teachers, as well as students registering to join their teachers’ classes.

This policy covers learnly.co.th, the Learnly service and demo.singlty.com demonstration environment, accounts, submissions, Google Classroom imports and communications. Public free access is being prepared; trials with real teachers do not mean that public registration is already open.

When paid plans launch, this policy also covers information needed to administer subscriptions, with additional disclosures before further collection. External services have their own privacy policies.

The provider is the Learnly Project, Team TLDR, students in Digital Entrepreneurship at Khon Kaen University’s Faculty of Business Administration and Accountancy. Contact suprawee.m@kkumail.com. This identifies the project team, not the university as a contracting party or service endorser.

Accounts and communications: Learnly controls processing for purposes it determines, including account administration, communications and security.

Student work: roles follow who actually determines the purposes and means. A school may be the controller with teachers acting on its behalf, or a teacher may control activities they independently determine. Learnly acts as processor where it follows the controller’s instructions, subject to appropriate processing arrangements.

Paying for an individual plan does not itself authorize use of school-held student data or automatically change the controller. Individual teachers and schools may both contact Learnly directly.

Learnly follows the principle that personal data should be collected and used only to the extent necessary for clear and legitimate purposes, and should not be used beyond what is reasonably necessary or for unrelated purposes without an appropriate legal basis.

Submitting student work, teacher materials, or other content to Learnly does not automatically transfer ownership of that information or content to Learnly.

Learnly does not sell, rent, or trade personal data to third parties for marketing purposes.

The information involved varies depending on which part of the website or prototype is used, and may include:

• Teacher or user information, such as name, account information, school, or organization.
• Student information, such as name, student ID, class information, or identifiers used to associate work with a student.
• Images of assignments, handwriting, mathematical expressions, text, or other content appearing on submitted work.
• Text extracted from images through OCR.
• AI-generated analysis, observations, or related outputs.
• Teacher-created assignments, tests, answer keys, rubrics, or educational materials.
• Technical information such as IP address, device information, browser information, access time, and system logs.
• Content you send us directly, such as the contents of an email requesting a demo or asking a question.

Sources: teachers, students, schools, direct communications and authorized imports. Section 19 explains Google Classroom. Not importing a roster does not mean that files or submission records contain no personal data.

When paid services launch, necessary plan, billing-contact and transaction information may be processed, with payment-provider and data disclosures before that service is used.

Account and contact information is used to respond to requests and provide services to subscribers. Technical data supports operation and security with regard to legitimate interests; legal obligations apply where relevant.

Work analysis, feedback drafting and Classroom imports provide requested functions. For student data, the relevant controller must have an appropriate lawful basis. Where Learnly acts as processor it follows the controller’s instructions and processing arrangement. A teacher’s subscription is not a universal lawful basis for processing students’ information.

Google authorization grants the selected access; it is not consent on behalf of students or parents. Where processing relies on consent, it may be withdrawn without affecting lawful prior processing.

Without account information, account-based features are unavailable; without a submission it cannot be analyzed; without Classroom authorization its import is unavailable; without contact details we cannot respond.

Learnly does not seek to collect sensitive personal data — such as health data, disability, religion, ethnicity, political opinions, or biometric data — and the system is not designed to analyze such categories.

Sensitive data may nevertheless appear incidentally in an image of student work, for example where a student writes about personal matters or where such text is captured in the photograph.

In those cases:

• We will not use such data as a factor in analyzing or grouping students.
• On notification, we will delete or mask the data without undue delay.
• We ask teachers and students not to upload documents containing sensitive data unless necessary.

Students register their own Learnly accounts and join using a teacher’s class code. Accounts are not generated from a Google Classroom roster. Individual teachers and schools oversee educational data use within their respective roles.

Self-registration does not remove rules on minors’ capacity to contract or consent. Where consent is the basis, applicable law determines whether the minor may consent or parental authorization is needed; for children aged ten or younger, parental consent is required as provided by law.

Teachers or schools bringing student data must provide appropriate notices and have relevant authority and lawful grounds. Learnly remains responsible for its own processing.

Students and parents may contact Learnly directly to exercise rights without a school-wide subscription. We verify identity and coordinate with the relevant controller.

• The learnly.co.th website does not use cookies for advertising, marketing, or cross-site tracking.
• The public website currently has no analytics tooling installed.
• The prototype uses cookies or browser storage only as necessary to maintain login state and account security. These are strictly necessary cookies; disabling them prevents access to the system.
• The website loads fonts from Google Fonts, which does not set cookies but does result in your IP address and browser information being transmitted to Google when the page loads.

If we introduce analytics tooling or other cookie categories in future, we will update this policy and provide notice or obtain consent as required by law before doing so.

Learnly's prototype uses AI across several stages, including image processing, text extraction, and analysis of student work. An example data flow is:

Learnly is not designed to make fully automated decisions about students. A teacher always makes the final decision.

Learnly does not assign grades for teachers: AI identifies issues and drafts feedback. Teachers determine all grades, may edit or rerun analysis, and may confirm multiple items together. Students receive teacher-sent feedback; bulk confirmation still requires teacher review.

The Learnly prototype does not contain an automatic pipeline that uses submitted student work to train Learnly's own models.

We want to be clear, however, that saying data is “not used to train a model” does not automatically mean that:

• no information is transmitted to an external provider;
• the provider retains no information temporarily;
• no safety or abuse-prevention processing occurs; or
• information is deleted immediately.

Where third-party AI services are used, their processing and retention practices depend on the service, configuration, and terms actually in effect at the time.

For Google API data, use and transfer are limited to disclosed functions and user-directed use, including applicable Limited Use requirements. Such data is not used for advertising or general-purpose AI model training. Import support does not imply Google endorsement.

Learnly relies on technical service providers to operate the website and prototype. These currently are:

• Google Fonts — supplies the fonts used on the website, which results in your IP address and browser information being sent to Google when the page loads.
• Hosting and infrastructure providers — for the website and prototype.
• AI and OCR providers — for reading and analyzing student work.

We may also disclose information where necessary to comply with the law, a court order, or a lawful request from a competent authority, or to establish or defend legal claims.

We do not sell, rent, or trade personal data to third parties for marketing purposes.

Classroom imports involve Google as the source provider. Imported files may be processed by OCR/AI providers as described in sections 9–10, like direct submissions. Personnel access must be limited to authorized needs; Google data is also subject to Google’s human-access restrictions.

Before collecting data through a publicly launched service, the actual providers and processing arrangements must be disclosed to individual teachers and schools. The categories here are not a complete named subprocessor list.

The Learnly prototype relies on some services or AI systems that process information outside Thailand.

You should therefore not assume that all Learnly data is held exclusively in Thailand or that no information leaves the country.

Where personal data is transferred internationally, we consider the applicable requirements and appropriate safeguards, such as selecting providers with adequate data protection measures and limiting the data transferred to what is necessary.

For future deployments, Learnly is exploring ways to reduce the personal information made available to AI systems and may consider infrastructure that processes data within Thailand. These approaches should not be interpreted as fully implemented capabilities of the current prototype.

For future development, Learnly is exploring a data-minimization approach: where AI can analyze work without knowing a student's identity, unnecessary identifying information should not be sent with the work. Proposed measures include:

• Masking names, student numbers, or other identifiers.
• Using a Submission ID or similar reference instead of a real name.
• Providing AI only with the information necessary for the analysis.

Learnly retains information only for as long as necessary for the relevant purposes or as required by law. At prototype stage we apply the following periods:

Once these periods expire, or when the information is no longer necessary, we delete, destroy, or de-identify it.

If Learnly is deployed with educational institutions, retention periods may be redefined under the agreement with the school as data controller, and we will update this table accordingly.

Individual users and imports: account and contact periods above also apply to individual users. The 90-day demonstration-work rule concerns demo accounts, not a uniform paid-plan retention promise. Subscription-work periods will be disclosed before launch. A plan’s visible history window is not an automatic deletion schedule.

Revoking Google access prevents future access but does not automatically delete previously imported copies. Users may request deletion from Learnly directly. Where a school has a retention duty, we coordinate with the controller and explain the reason. Closing a teacher account does not extinguish other students’ data rights.

Measures currently in place in the prototype include:

• Access to the system requires a user account and password.
• Data is transmitted between browser and server over an encrypted connection (HTTPS).
• Access to data is limited to team members who need it to develop and maintain the system.
• The demonstration environment is separated from real school data where practicable.

Before production deployment, we will establish further measures covering access control, encryption at rest, backup and deletion, and periodic risk-based review.

In the event of a personal data breach

On becoming aware of a breach, we will investigate and contain it without undue delay, and will notify the Personal Data Protection Committee office within 72 hours of becoming aware, where feasible, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

Where the breach is likely to result in a high risk to individuals' rights and freedoms, we will notify the affected data subjects together with remedial guidance without undue delay, and in the case of student data we will also notify the relevant school.

When acting as processor, Learnly will inform the relevant controller without undue delay, whether the teacher or school as applicable. Notices to individual teachers do not depend on a school-wide purchase.

Subject to the conditions and exceptions provided by law, data subjects have the following rights:

• Right of access — to access or obtain a copy of your personal data.
• Right to rectification — to have inaccurate, outdated, or misleading data corrected.
• Right to erasure — to have data deleted, destroyed, or de-identified.
• Right to restriction — to have the use of your data temporarily suspended.
• Right to object — to object to the collection, use, or disclosure of your data in certain cases.
• Right to data portability — to receive your data or have it transmitted to another controller where the conditions are met.
• Right to withdraw consent — at any time, for activities that rely on consent.
• Right to lodge a complaint — with the Office of the Personal Data Protection Committee if you believe our processing does not comply with the law. See pdpc.or.th.

How to exercise your rights

Send your request to suprawee.m@kkumail.com with the subject “Data subject request”, stating which right you wish to exercise and the data concerned. We may ask for additional information to verify your identity before acting.

We will respond within 30 days of receiving the request, at no charge.

Where student data is under a school's control, we will coordinate with the school to act on the request, and we recommend contacting the school first.

Individual teachers, students and parents may submit requests directly. Recommending school contact when the school controls data does not remove direct contact with Learnly or require a school subscription.

Learnly may update this policy as the system, use cases, service providers, or applicable law change.

Where material changes are made, we will revise the “Last updated” date at the top of this page and provide notice through appropriate channels, such as an in-product notice or an email to participating schools.

Material-change notices also cover individual subscribers and affected users. Changes to Google data access will be explained and any necessary additional authorization requested first.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact:

Governing language

In the event of any inconsistency between the Thai and English versions, the Thai version shall prevail.

Authorized teachers may connect to import assignments (title, description and due date) and student submissions (files and submission status) for requested Learnly analysis.

This feature does not import a student roster or student numbers to create accounts; students register separately. Files and submission records may still contain names, technical identifiers or identifiable information and remain protected data.

Access is limited to permissions needed and disclosed in authorization. Importing does not authorize access to all other data or writing grades or feedback back to Classroom.

Teachers may revoke access through Google account settings and request handling of existing imported copies by emailing Learnly. Import availability may depend on teacher permissions or school administrator settings.

Google API data use is subject to the Google API Services User Data Policy, applicable Limited Use requirements and Google Workspace policies.