DIALECTICA
Request a demo

Privacy, security and compliance

This page answers the checklist of a data protection officer. Every section has a stable anchor: the direct link to a single section can be sent by email.

Scope: app.dialectica.educationLast updated: 27 September 2026

Market: Italy. Compliance documents are written per market. The AI Act layer is the same across all 27 member states; the age of digital consent and the grading scale are not, and each market gets its own folder before it opens.

01Roles

The school is the data controller: it decides the purposes and keeps the relationship with families. Dialectica is a data processor and acts only on the school's instructions. When the licence comes through a channel partner, the partner is the processor and Dialectica is a sub-processor.

The chain, in words: the school (controller) instructs the channel partner (processor), who instructs Dialectica (sub-processor), who relies on the four providers listed in point 02. In a direct sale the intermediate step does not exist and Dialectica is the processor.

The contract governing the relationship is the agreement under art. 28 GDPR, listed in point 06.

02Sub-processors

This list is complete. If it changes, this page changes and the school is notified before the change.

Supabase

Purpose
Database and authentication for school staff
Place of processing
European Union — Frankfurt (DE)
Guarantees
Processor under art. 28. The provider publishes its own certifications.

Vercel

Purpose
Application hosting and server functions
Place of processing
European Union — fra1 region, Frankfurt (DE)
Guarantees
Processor under art. 28. The provider publishes its own certifications.

Mistral AI

Purpose
Language model: debate opponent and analysis of submissions
Place of processing
France
Guarantees
Processor under art. 28. Submissions are not used to train the model.

Resend

Purpose
Emails sent only to adult staff: invitations and password recovery
Place of processing
European Union
Guarantees
Processor under art. 28. No student address passes through here, because none exists.

No other service receives data. Pages used by students load no third-party services, analytics included.

03Data processed

Of a student we process

  • The display name chosen by the school
  • The class and the institution
  • The texts the student writes in their debates
  • The analysis scores and the report confirmed by the teacher
  • The class code they joined with

We do not process

  • The student's email address: we do not ask for it
  • Photographs and images of the student
  • Phone number or other contact details
  • Geolocation

04Minors

For lower secondary school, authorisation from whoever holds parental responsibility is required before the student can start. The school collects it, with its own tools and forms.

In the application the teacher records only whether the authorisation is present or absent. A student without authorisation sees the assignment but cannot start a debate, and the screen tells them so in their own words. The signed document is not uploaded to the system.

Final wording of the regulatory references — to be drafted with Italian legal counsel.

05Retention

Contract end + 180 days

Student data lives as long as the institution's contract, plus a grace period of 180 days. The grace period is written into the contract and can be shortened for a given institution. Once it runs out, the debates, the assessments, the classes and the institution record itself are deleted.

Deletion is a scheduled job that runs every night, not a procedure someone has to remember: it is in the database, and we can show it. Staff accounts are detached from the institution rather than destroyed, so a teacher moving school does not lose their access. Erasing an individual account is a separate request we act on. Teacher invitations that are never accepted are deleted after 30 days.

06Available documents

These documents exist and we send them. They are not available for download because they contain our corporate structure's data and travel accompanied by the name of the requesting institution.

  • Data Processing Agreement (DPA) under art. 28 GDPR, ready to signon request
  • Pre-filled Data Protection Impact Assessment (DPIA) for classroom useon request
  • Privacy notice for familieson request
  • Privacy notice for the studenton request
  • Record of processing activities under art. 30on request
  • Description of security measures under art. 32on request

How to request them: the institution's DPO or head of administration writes to hello@dialectica.education

07Artificial intelligence

  • Which modelA language model from Mistral AI, a European provider. Inference — the debate text — runs in the European Union, in France. The provider's control plane (API keys, billing, usage analytics) is not regional, and limited, protected transfers to sub-processors remain possible: the student's text stays in the EU, not the entire processing.
  • TrainingStudent texts are not used to train models, neither ours nor the provider's.
  • The score is a proposalThe analysis proposes a rubric score. It enters the register only after a person has confirmed it, and the teacher's edit stays on record. This is a product choice, not a setting that can be switched off.
  • Score labelIn the application and in the printed report the score is called “World Schools–style score (training)”: it is not an official tournament score.

08Accessibility

The application's accessibility statement, in the European model format, lives on its own page: it declares the conformance level, the non-conforming content, and the channel for reports.

Accessibility statement