This Privacy Policy explains what personal data OpenDegree Ltd, trading as MyAE("MyAE", "we", "us") collects, how we use it, who we share it with, how long we keep it, and the rights you have under the UK GDPR / EU GDPR. By creating an account or using the service you agree to this policy.
Data controller. The controller of your personal data is OpenDegree Ltd, trading as MyAE, a company registered in England and Wales (Company No. 17397971). You can contact us at hello@myae.co.uk.
1. An overview in plain English
MyAE is an AI-tutor tool for university students. You paste or upload your assignment brief, marking criteria, and a draft. Our AI models produce examiner-style feedback and a predicted grade. To do this we store your work securely in our database and send extracts to trusted AI providers so they can generate the report. We do not sell your work, we do not allow model training on it, and we do not share it with your university.
2. The information we collect
2.1 Account information
- Name and email address when you register.
- If you sign in with Google — your Google name, email, and profile picture.
- A hashed password (bcrypt) — we never store plain-text passwords.
- Consent records — the timestamp when you accepted these Terms, and separately whether you opted-in to marketing email.
2.2 Content you provide
- Assignment briefs, rubrics, marking criteria and any supporting documents you upload.
- The essay / draft / group contribution text itself.
- Any grade you later confirm from your university (used only to improve our calibration for you, and stored anonymously for aggregate accuracy metrics).
- If you opt in to Help Improve MyAE — the Turnitin similarity PDF you choose to share so we can benchmark against real Turnitin scores.
2.3 Usage & technical data
- Feature interactions (buttons clicked, reports viewed) collected through PostHog with an anonymised user id.
- Standard server logs (IP, user-agent, timestamps) retained only for security & fraud-prevention and auto-purged after 30 days.
3. How your uploaded work is processed
Transparency matters. Here is exactly what happens when you upload or paste an assignment:
- Extraction. The text is extracted from your file (PDF, DOCX, image) locally on our servers.
- OCR (if needed). Scanned PDFs or images are OCR'd via Google Cloud Vision. Google acts as a data processor under standard EU model clauses.
- AI analysis. The text is sent to one or more AI providers (OpenAI, Anthropic, Google Gemini) — chosen automatically by our intelligent router. All providers process content only to generate your requested report and are contractually barred from using it to train their models.
- Similarity check. Our internal similarity search compares your submission against other documents within your own MyAE account. For the optional Submission Intelligencemodule, short excerpts (up to 300 chars) may be sent to Brave Search and Exa AIto look for external matches. Only excerpts are shared — never your full essay.
- Storage. The extracted text and the generated report are stored in our EU-based MongoDB Atlas cluster so you can revisit them in your history.
- Deletion. You can delete any analysis at any time from your history — the stored text and report are removed within 30 days from all backups.
4. Third-party processors we use
We rely on a small number of trusted infrastructure and AI providers. Each is bound by a data-processing agreement (DPA) and only processes data under our instructions.
| Processor | Purpose | Data | Location |
|---|---|---|---|
| OpenAI | AI examiner analysis + text generation | Assignment text, brief, rubric | US/EU (contractual no-train) |
| Anthropic (Claude) | Backup AI examiner + evaluation | Assignment text, brief, rubric | US (contractual no-train) |
| Google Gemini | AI examiner fallback | Assignment text, brief, rubric | US/EU (contractual no-train) |
| Google Cloud Vision | OCR of scanned PDFs / images | Uploaded file content | EU |
| Brave Search | Web-similarity signal (Submission Intelligence) | Short excerpts (≤300 chars) | US |
| Exa AI | Academic evidence retrieval | Short claim excerpts | US |
| Stripe | Payments (future paid plans) | Name, email, billing details | US/EU (PCI-DSS) |
| Resend | Transactional email (verification, reset, alerts) | Name, email | EU |
| PostHog | Product analytics (anonymised) | Usage events, session id | EU |
| MongoDB Atlas | Primary database (hosting) | All account + report data | EU |
| Meta (WhatsApp) | Operational alerts to MyAE admin only | Incident metadata only | US/EU |
5. Marketing communications (optional)
Marketing emails — product updates, tips and offers — are only sent to users who explicitly opted-in at sign-up or from their profile. The opt-in is unticked by default and stored separately from the mandatory Terms acceptance. Every marketing email includes a one-click unsubscribe link. Transactional emails (verification, password reset, receipts) are sent regardless as they are required to operate your account.
6. Cookies & local storage
See our separate Cookie Policy. In short: we use essential local storage to keep you signed in and to link guest sessions to your account. We do not use advertising or cross-site tracking cookies.
7. Your rights under UK/EU GDPR
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure ("right to be forgotten") — ask us to delete your account and everything linked to it. We honour this within 30 days.
- Portability — download your reports as PDFs from your dashboard at any time.
- Restriction / objection — object to certain processing, including marketing.
- Withdraw consent — withdraw marketing consent at any time from your profile.
- Complain — you can lodge a complaint with the UK ICO (ico.org.uk) or your local supervisory authority.
To exercise any of these rights email hello@myae.co.uk.
8. Retention
- Account & reports — kept while your account is active. Deleted within 30 days of account deletion or an analysis being removed.
- Anonymised calibration data — where you confirm an official grade, we may keep an anonymised, hashed record indefinitely to improve accuracy metrics.
- Server & incident logs — 30 days, then purged.
- Payment records — retained by Stripe for the period required by tax / accounting law (typically 6 years in the UK).
9. International transfers
Some of our providers (notably OpenAI, Anthropic, Brave, Exa, Stripe) are based in the United States. Where personal data is transferred outside the UK/EEA we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards.
10. Data security
All traffic is encrypted with HTTPS (TLS 1.2+). Data at rest is encrypted at the storage layer. Passwords are hashed with bcrypt. Access to production data is restricted to authorised MyAE personnel only. Critical incidents are proactively monitored and paged to our on-call team via email and WhatsApp.
11. Children
The service is intended for users aged 16 and over. If we learn a younger child has created an account, we will delete it.
12. AI limitations & academic-integrity notice
MyAE provides an indicative, AI-assisted assessment. It is not an official grade and it is not a substitute for your institution's marking. AI outputs can contain errors, omissions and biases. Use MyAE as a study aid, not as a submission or decision-maker. You remain responsible for the work you submit.
13. Changes to this policy
We may update this policy from time to time. Material changes will be announced in-app and by email to registered users. The "Last updated" date at the top of this page always reflects the current version.
14. Contact
Questions or data-subject requests? Email hello@myae.co.uk.