Privacy Policy
Information on the processing of personal data on the CHETI research platform
Last updated: 17 July 2026
1. Controller
Provider and person responsible for content
Dr. Nils Fitting
c/o RPTU Kaiserslautern-Landau
Department of Chemistry / Chemistry Didactics
Erwin-Schrödinger-Straße 52
67663 Kaiserslautern
Contact
Email: nils.fitting@chem.rptu.de
Project name
CHETI – AI learning platform for chemistry didactics
2. Types of data processed
CHETI is a non-commercial research and learning platform. We distinguish between two user groups:
The platform provides AI-assisted learning functions and supports scientific research into learning processes in chemistry education. Usage and learning data are generally evaluated under pseudonyms and used only for defined research purposes.
a) Teachers (registered users)
To use CHETI as a teacher and manage student access, you must register. We store:
- Username and optional display name
- Email address
- Non-reversible password hash
- Class assignments, created learning content, settings, and technical usage data
Legal basis: Art. 6(1)(b) GDPR (contract performance for account provision).
b) Students / learners (anonymous or pseudonymous use)
Students use the service via access codes or simplified logins generated by the teacher. As a rule, CHETI does not store real names or email addresses for these accounts. In particular, we process:
- Generated user ID, username, and optional profile information
- Chat histories, inputs (prompts), AI responses, and any uploaded images
- Solutions, learning progress, feedback, learning-journal entries, and learning observations
- Usage and research events (e.g. number of messages, completed tasks, selected topics, and timestamps)
Important: If a teacher or the study team keeps a separate assignment between an access account and a person outside CHETI, the data remain pseudonymized and therefore personal data. The assignment list is not stored in CHETI.
Legal basis for operating the technical platform: Art. 6(1)(f) GDPR (legitimate interest in securely providing and scientifically evaluating the learning functions).
Data collection and scientific evaluation within a specific study are additionally governed by that study’s participant information, consent materials, and the legal basis stated there.
3. Use of AI models & data transfer
To generate responses, CHETI transfers the inputs, contextual information, and, where applicable, images or document content required for the request to the configured AI provider. Real names should not be entered.
The model used is determined by the platform configuration or by an authorized user’s selection.
AI models used (third-party providers)
Depending on the configured model, data may be transferred to providers in the EU or the United States. Transfers to third countries take place only on the basis of an adequacy decision or appropriate safeguards, in particular standard contractual clauses. The providers actually used must be reflected in the applicable study or usage information.
Providers in the USA: OpenAI (GPT), Google (Gemini), Anthropic (Claude).
Provider in the EU: Mistral AI (France), also for text recognition (OCR) of uploaded images and documents.
4. Cookies & local storage
We use only technically necessary cookies: sessionId for authentication, _csrf to prevent forged requests, tz for the time zone, and locale for the language. Local storage contains only device-specific interface preferences, such as the theme, chat view, and dismissed notices.
There is no use of third-party tracking tools (such as Google Analytics) for advertising purposes.
5. Storage periods & technical logs
- IP addresses and rate limiting: Full IP addresses are not stored permanently in the database or application logs. To prevent abuse, the IP address is temporarily processed as a key in the Redis cache for rate limiting and is automatically discarded when the configured rate-limit window expires.
- Chat data: The currently effective retention period is loading.
- Administrative audit logs: The currently effective retention period is loading.
- Error logs: The currently effective retention period is loading.
- Recycle bin for deleted accounts and classes: The currently effective retention period is loading.
- Other research data: Solutions, usage events, learning progress, feedback, learning journals, and pseudonymized research data derived from them are retained only as long as required for the relevant study and its verifiability. They are then deleted or fully anonymized. The specific period is stated in the applicable study information and is not controlled by the chat period shown above.
- Accounts: Account data are retained until use of the platform ends. Account deletion and requests for access to or inspection of associated data must be submitted to the controller. Where data have already become part of a research dataset, the statutory limitations described below apply.
6. Your rights
Subject to the statutory requirements, you have the rights of access, rectification, erasure, restriction of processing, and objection, and, where applicable, data portability.
Access, inspection, rectification, or erasure are not performed automatically in the app and must be requested by email from the controller named above. Proof of the account or the user ID may be required for secure identification.
Because CHETI generally does not hold real names for student accounts, a request can only be processed if the relevant user ID or another unique identifier is provided.
The right to erasure is not absolute. Where data are required for scientific research purposes subject to the safeguards in Art. 89(1) GDPR, and erasure would be likely to render those purposes impossible or seriously impair them, an erasure request may be refused to the extent necessary under Art. 17(3)(d) GDPR. Every request is assessed and answered individually.
Fully anonymized research data can no longer be linked to an individual and are no longer subject to personal access or erasure rights.
Supervisory authority: State Commissioner for Data Protection Rhineland-Palatinate.