Privacy Policy

better-ed is a voice-enabled AI assessment platform for K-12 education, operated by Predictive Systems, Inc. (Philippines) and Better Oy (Finland). This Privacy Policy explains how personal data is processed across all of our activities — the assessment Service delivered to schools, our marketing website, and our sales and support contacts.

We comply with applicable data-protection law in every jurisdiction we operate in. Where institutional customers need the specific regulatory detail their procurement teams require — GDPR, EU AI Act, UK GDPR, COPPA, FERPA, state K-12 laws, the Philippine Data Privacy Act, NPC Advisory 2024-04, and DepEd Order No. 003 s. 2026 — we cover it in our Data Processing Agreement and supporting documentation. Contact privacy@better-ed.ai for any of these on request.

Different activities have different controllers. Under data-protection law, the controller decides why and how personal data is processed and is the entity you contact to exercise your rights.

For school-deployed activitiesthe school determines purposes and lawful basis. We process pupil and teacher data only on the school’s documented instructions. The Data Processing Agreement governs the relationship. Direct rights requests to your school first; we support the school in handling them.

For everything else — marketing site, sales, and support — Predictive Systems, Inc. is the controller, and you can contact us directly.

Throughout this Policy we use tags to show which controller applies:

School-controlledprocessing inside the assessment Service, under the school’s instructions.

PSI-controlled processing on the marketing site and in sales and support channels.

For school-deployed activities, the school selects the lawful basis under its applicable data-protection law. We process pupil and teacher data only on the school’s documented instructions.

For activities where Predictive Systems, Inc. is the controller, our lawful bases are:

We use AI in the assessment Service. We are transparent about it and we keep humans in control.

• We inform users when AI is used in an assessment, describe how it works in plain language, and explain its limitations.
• AI outputs are decision-support, not authoritative grades. Educators retain final authority and may review, override, or adjust any AI-generated result.
• Where an AI-generated score is used as input to a decision that significantly affects a pupil, the pupil (or their parent/guardian) has the right to obtain human intervention, express a point of view, and contest the decision. The route is the appeal mechanism operated by the school. We support the school by providing decision logs and explanatory information.
• We treat AI-generated assessment outputs as high-risk under applicable AI risk frameworks and apply the corresponding controls: human-in-the-loop, audit logging, transparency notices, bias monitoring, and the appeal mechanism above.

We operate region-isolated infrastructure with separate administration consoles:

• EU/EEA tenants: Google Cloud Platform, region europe-north1 (Finland). EU pupil and teacher data is not replicated outside the EEA.
• US, Philippines, and rest of the world: Microsoft Azure, US East. Azure OpenAI inference runs in the same region.

Where data crosses jurisdictions, we rely on appropriate legal transfer mechanisms (Standard Contractual Clauses, adequacy decisions, or other instruments approved under the applicable data-protection law) and apply supplementary measures including access controls, logging, encryption, and contractual restrictions on government access. The specific transfer architecture for each customer’s region is set out in the Data Processing Agreement and accompanying Transfer Impact Assessment, available on request at privacy@better-ed.ai.

We retain personal data only for as long as needed for the purposes set out in §4. The controller for each activity determines the retention period; the defaults below apply unless the controller has instructed otherwise.

We implement technical and organisational measures appropriate to the risk. These include:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256);
• Access controls based on least privilege; access to pupil personal data is logged and restricted to authorised personnel with a documented need;
• Key management via the hyperscaler KMS in the relevant region;
• Network isolation between EU and US/PH environments;
• Regular security audits, vulnerability management, and penetration testing;
• Sub-processor diligence under our DPA. The current list is published at better-ed.ai/sub-processors and institutional customers receive at least 30 days’ advance notice of any change affecting pupil or teacher data;
• A documented incident response plan including notification of the affected institution(s) without undue delay and in any event within 72 hours of becoming aware of a personal-data breach.

Depending on your location, you have rights regarding your personal data. The common set includes:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion, subject to legal retention duties.
• Portability: receive your data in a structured, machine-readable format.
• Restriction: limit how we process your data.
• Objection: object to processing based on legitimate interests, including for direct marketing.
• Withdraw consent at any time where processing is based on consent (without affecting prior lawful processing).
• Lodge a complaint with your supervisory authority.

better-ed is designed for K-12 educational use. We follow the child-protection rules that apply in each jurisdiction we operate in, including the GDPR Article 8 child-consent framework in the EU/EEA, COPPA and applicable state laws in the United States, and DepEd Order No. 003 s. 2026 (which requires parental consent for all learners under 18) in the Philippines.

The school remains responsible for obtaining and documenting consent and for age-appropriate supervision in the school-deployed assessment Service.

New York-based school districts can request our Parents’ Bill of Rights for Data Privacy and Security and Supplemental Information by emailing privacy@better-ed.ai.

We use cookies and similar technologies on our marketing site (PSI-controlled). See our Cookie Policy. The cookie banner provides a consent mechanism. User session analytics on the marketing site are active only after consent is given and are not used inside the pupil-facing assessment Service.

Data Protection Officer (DPO): Allan C. Tan, privacy@better-ed.ai

Privacy and data-protection enquiries: privacy@better-ed.ai
Legal and contractual matters: legal@better-ed.ai

Better Oy (EU/EEA contracting entity)
Lapinlahdenkatu 16, 00180 Helsinki, Finland

Predictive Systems, Inc. (US, Philippines, Rest of the world)
Unit 3006, One Corporate Centre, Julia Vargas Avenue, Ortigas Center, Pasig City, Metro Manila, Philippines

We may update this Privacy Policy. Material changes are notified by updating this page and the “Last updated” date. For institutional customers we provide written notice to the account administrator at least 30 days before material changes take effect.