1Data controller and scope

EddyAi.top (“the Platform”, “we”, “us”) is an AI learning platform and toolset for faculty members and staff of Thai higher education institutions. It is developed and operated by the College of Teacher Education, Phranakhon Rajabhat University, which acts as the data controller under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

This policy applies to the website https://eddyai.top and all services offered under that domain, including the nine modules of the AI Learning Hub and the AI Support Hub. By signing in to or using the Platform, you acknowledge that you have read this policy.

2Information we collect

We collect only the information necessary to provide our services, in the following five categories.

3How we access, use, store, and share Google user data

This section specifically describes how the Platform handles information received through Google APIs (“Google user data”).

4Purposes and legal bases

We process your personal data for the following purposes: (1) to provide the services you request, including account creation, sign-in, courses, AI tools, competency assessment, the Community, and the Helpdesk; (2) to recommend learning paths and produce your competency reports and portfolio, both on the basis of performing our service agreement with you; (3) to maintain security, prevent misuse, and resolve technical problems; (4) to analyze aggregate, de-identified usage statistics in order to improve the Platform and support educational quality assurance, both on the basis of our legitimate interests; and (5) to comply with applicable laws.

If we ever wish to use your data for any purpose other than those listed here, we will notify you and ask for your consent first.

5AI processing (Google Gemini API)

AI features on the Platform, such as the AI Toolkit, Prompt Generator, AI Tutor, the Innovation Lab AI Sandbox, and the Helpdesk AI Chatbot, work by sending the text or content you enter to the Google Gemini API, which generates a response that we display to you. We send only the content needed to generate the response and do not attach your name, email address, profile picture, or Google Account ID to these requests. Google’s processing is governed by the Gemini API Terms of Service and the Google Privacy Policy.

We recommend that you do not enter sensitive personal data, or personal data of students or other individuals (such as names, ID numbers, or individual grades), into AI tools, and that you always check AI output for accuracy before using it, because AI can produce incorrect information.

6Disclosure to third parties

We do not sell or rent your personal data. We disclose it only in the following cases: (1) to service providers that are necessary to operate the Platform, namely Google LLC for sign-in (Google Sign-In) and AI processing (Gemini API), and our web hosting provider, which process data only on our instructions and only to the extent necessary; (2) content published in the shared library or the Community, such as prompts, Showcase entries, and discussion posts, whether you publish it yourself or an administrator selects it for the benefit of members, which will display your name and institution to other members of the Platform (you can unpublish your content at any time); and (3) when required by law or by a lawful order of a government authority or court.

7International transfers

Google services used by the Platform may process data on servers located outside Thailand. Such transfers are made as necessary to perform our service agreement with you and are subject to the data protection safeguards set out in Google’s terms of service, as permitted under the PDPA.

8Cookies

The Platform uses only cookies that are necessary for the website to function: a session cookie that keeps you signed in, and a preference cookie that remembers settings such as your chosen language. We do not use advertising cookies or third-party tracking cookies. If you disable cookies in your browser, you may not be able to sign in.

Our pages also load fonts from Google Fonts, which means Google receives your IP address as part of the normal operation of that service.

9Data retention

We keep your account and usage data for as long as your account remains active on the Platform. When you request account deletion, we will delete or de-identify your data within 30 days of receiving the request.

The exceptions are computer traffic data (logs), which we keep for 90 days as required by Thailand’s Computer-Related Crime Act and then delete unless a competent authority orders longer retention, and de-identified statistics, which may be kept for aggregate analysis.

10Security

We use appropriate technical and organizational security measures, including encryption in transit with HTTPS (TLS), access restricted to authorized administrators, keeping API keys and system secrets on the server side only, data backups, and never storing your Google password.

However, no system on the internet is completely secure. If a personal data breach occurs that poses a risk to your rights and freedoms, we will notify the Office of the Personal Data Protection Committee within 72 hours and inform you without undue delay, as required by law.

11Your rights and account deletion

Under the PDPA, you have the right to access and obtain a copy of your personal data; to have it corrected and kept up to date; to have it deleted or destroyed; to restrict its use; to object to its processing; to receive it or have it transferred in a machine-readable format; and to withdraw any consent you have given at any time.

You may exercise these rights by emailing prasert2005@gmail.com. We will respond within 30 days of receiving your request. If you believe we have not complied with the law, you have the right to lodge a complaint with the Office of the Personal Data Protection Committee (PDPC).

12Children

The Platform is designed for faculty members and staff of higher education institutions and is not intended for minors under 20 years of age (the age of majority in Thailand). We do not knowingly collect personal data from minors. If we learn that we have collected a minor’s data without the consent of a parent or guardian, we will delete it promptly.

13Changes to this policy

We may update this policy to reflect changes in our services or in the law. The date of the latest update is shown at the top of this page. If we make material changes to how we use your data, we will notify you through the Platform or by email before the changes take effect.

14Contact us

If you have questions about this policy or wish to exercise your rights regarding your personal data, please contact: