Privacy statement
1. Who is responsible
Stichting VU (Vrije Universiteit Amsterdam), De Boelelaan 1105, 1081 HV Amsterdam, Chamber of Commerce number 53815211, is the controller. The service is operated by the VU Education Lab (Onderwijswerkplaats) of the Centre for Teaching and Learning. Questions about this statement go to onderwijswerkplaats@vu.nl. VU Amsterdam's data protection officer can be reached at functionarisgegevensbescherming@vu.nl.
2. What this statement covers
The VU Education Lab AI Assistant browser extension (for Chrome, Edge, Brave and Firefox), the server it talks to, and this website. It does not cover Canvas, vu.nl or any other site you use the assistant on; those have their own statements.
3. What the assistant sends, and when
The assistant sends content to our server only when you ask it to do something: you run a tool, send a message in the panel, or import a Canvas course. What is sent is what you chose to work with:
- the text of the web page, Canvas page or PDF you have open, or the text you selected on it, together with the page's title and web address;
- the transcript of a YouTube video you have open;
- documents you upload with the + button and other open tabs you add as sources;
- your follow-up messages, and a course profile if you have selected one;
- the course material the Canvas import reads (description, modules, pages, assignments, files), never people, grades, submissions, discussions or announcements.
The assistant does not read Canvas pages that show students' work, grades, messages or personal details, such as SpeedGrader, the gradebook, submissions, the People list, groups, discussions and the Inbox, and our server refuses material from those pages. It works with course material such as pages, modules and assignment descriptions.
Nothing is sent in the background. One small thing is read in the background and stays in your browser: when you select text on a page, the extension remembers your latest selection so the panel can offer it as a source. It is replaced by your next selection, forgotten when you close the tab or the browser, and sent nowhere unless you run a tool on it. Opening the panel reads the page you are on so that the tools can use it; that text stays in your browser until you run a tool. The assistant never sends pages you did not choose, browsing history or anything from tabs you did not add.
4. What we do with it
One request produces one answer. The server checks the text for hidden instructions, has an AI model produce the material you asked for, streams it back to you and forgets it. Page content is held in memory only for the duration of the request. It is not written to a database, not written to logs, not used to train or improve any model, and not read by staff. Our AI models are hosted by Microsoft on Azure; section 7 describes what Microsoft does and does not keep.
5. What we store about you
| Data | Purpose | Kept |
|---|---|---|
| Your institutional email address, and when you last used the assistant | Signing you in (a 6-digit code is emailed to it), fair-use limits, and showing you which devices are signed in | Until you delete your account in Settings, and at most 12 months after you last used the assistant; then the account is deleted automatically with everything below that belongs to it |
| Sign-in code requests (the address, the time, the network part of your IP address: the first three parts of an IPv4 address or the first three groups of an IPv6 address; the code itself only as a hash) | Verifying that the address is yours; limiting abuse | The code works for 10 minutes; the request is deleted after a day |
| Sign-in sessions (a token per browser, with the browser name, the network part of your IP address and the time last used) | Keeping you signed in; letting you sign out other devices | 90 days, or 30 days without use, or until you sign out; then removed from the server |
| Daily usage count per account (number of generations and tokens; no content) | Fair-use limits | 2 days (today and yesterday) |
| Aggregate statistics per day: generations per tool and model, number of active teachers, exports per format, errors per code, refused pages (see section 10) | Understanding and improving the service; reporting to the Lab | Indefinitely; contains no personal data |
| Server logs (time, the kind of request, tool and model, error messages; for sign-ins and security events a pseudonymous account number) | Security and troubleshooting | 30 days |
| Course profiles, saved settings and your history of results | Convenience | Only in your own browser, until you remove them or uninstall the extension |
Logs never contain page text, generated material, email addresses or sign-in codes. Deletion is automatic: the server runs this clean-up at least once a day, also when nobody uses the assistant, so an item can outlast its period above by up to a day.
6. Legal basis
We process this information on the basis of VU Amsterdam's legitimate interest in supporting its teachers in preparing education (Article 6(1)(f) GDPR). We weighed that interest against yours: we keep only what is needed to sign you in and to share the service fairly, we never store the material you work on, the periods above are short, and using the assistant is voluntary, so not using it has no consequences for you. You may object to this processing at any time (section 9). Providing your email address is necessary to use the service; without it you cannot sign in.
7. Who processes it for us
Our processor is Microsoft, under the Microsoft Products and Services Data Protection Addendum that applies to VU Amsterdam's Azure subscription. Microsoft hosts the server, the database, the email service and the AI models on Azure, in the Netherlands and Sweden, inside Microsoft's EU Data Boundary.
- The AI models are OpenAI GPT-5 models that Microsoft runs itself (Azure OpenAI). They run in Microsoft data centres in the European Union and the European Free Trade Association (Azure EU Data Zone). Microsoft states that prompts and outputs are not available to other customers or to OpenAI and are not used to train any model.
- VU Amsterdam's subscription is approved by Microsoft for modified abuse monitoring. Microsoft therefore does not store the page text, your instructions or the results for abuse monitoring, and Microsoft staff do not review them. Microsoft's systems still screen each request automatically while it is processed, without storing it.
- We ask Microsoft not to keep the conversation. To answer follow-up questions faster, the service keeps short-lived technical caches that are not shared with other customers and expire automatically.
Microsoft documents all of this at learn.microsoft.com. Version 4.0 of the extension also sent optional usage events to PostHog if you had them switched on; version 4.1 and later no longer do.
Web search with Microsoft Bing
Web search is off unless you ask for it. You can ask for one search with your next message (+ › Search the web), or switch on automatic search in Settings › Page access & privacy; the AI model then searches in the chat (a question of your own or a follow-up) when the page does not contain what it needs, normally once per reply. It writes a short search query of a few words, which is sent to Microsoft Bing; Bing returns links and short extracts that the model uses in its answer.
- The query is written by the model, which is instructed never to put page text, names of people or other personal details in it. The page text itself is not sent to Bing. Microsoft sends the query without showing it to us first, so the instruction to the model is the safeguard here; that is one reason why web search is off by default.
- Automatic searches never run on Canvas pages (which may show students), when a tool such as Summary or Quiz runs, or on a page that tries to give the model instructions.
- Every query is shown under the answer it belongs to, with the web pages used. We do not log or store the queries.
- Automatic search, if you switched it on, can be switched off in the same place.
Bing is not one of our processors: Microsoft handles the query as an independent controller under its own terms and the Microsoft Privacy Statement, outside the EU Data Boundary and outside the data processing agreement between VU Amsterdam and Microsoft. Microsoft may process the query in the United States. The request goes from our server to Bing, so your own IP address is not part of it.
Apart from these search queries, no other party receives your data. We do not sell data, do not share it with advertisers or data brokers, and do not transfer it outside the European Economic Area.
8. Other people's data
A page you use the assistant on may contain other people's personal data, for example student names on a Canvas page. You decide what to send. VU Amsterdam's framework for generative AI in education asks staff not to put personal data or confidential information into AI tools; please follow it, and do not send student work or student data. Canvas pages that show students are not read at all (section 3). Whatever is sent is processed as described in section 4 and not retained by us. The instructions for use explain what the assistant is for and what it may not be used for.
9. Your rights
You have the right to access, correct and erase your data, to restrict or object to its processing, and to data portability. Most of this you can do yourself in the extension's Settings:
- Download my data (Settings › Page access & privacy) gives you a file with everything the server holds about you, with what this browser keeps and an explanation of each part;
- see which devices are signed in and sign them out (Settings › Account);
- Delete my account (Settings › Account) removes your email address, your sessions and earlier usage counts from our server at once. Today's count of generations stays until the clean-up removes it with the other counts, so that deleting and recreating an account does not restart the daily limit. It holds the number and an account number derived from your address, not the address itself.
For anything else, write to onderwijswerkplaats@vu.nl. Requests to erase data can also go to the IT Service Desk (servicedesk.it@vu.nl, 020 59 80000), and formal requests to the data protection officer (functionarisgegevensbescherming@vu.nl), who answers within four weeks. Objections can also go to privacy@vu.nl.
10. Usage statistics
When you export a result or the panel shows an error, the extension tells our server which export format or which error code it was. The server adds one to that day's total and keeps nothing else: no account, no device identifier, no address, no page text. Our server also counts, per day, how many generations each tool and model made and how often a page showing students was refused. No other party receives these statistics. In Firefox the extension sends export and error counts only if you allow "technical and interaction data", which Firefox offers in the installation dialog and in the add-on's permission settings.
11. Complaints
If you are not satisfied with how we handle your data, contact the data protection officer first. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
12. Security
All traffic is encrypted in transit; stored data is encrypted at rest. Sign-in codes and session tokens are stored hashed. Access to the server is limited to the Lab's engineers, and the server has no access to your browser beyond the requests you send.
13. Automated decisions and profiling
The assistant generates suggestions for you to review. It makes no decisions about you or about students, does not grade anyone, and builds no profiles. It is not meant for assessing students' work: asked to grade or give feedback on a student's work, it declines and offers to help with the assignment instead.
Files you export say that they were made with generative AI and name the page they were made from, in the file's properties and, in Word and PowerPoint files, in one visible line. Question banks for Canvas and Moodle carry this statement as a comment in the file only, so that it does not appear in the quiz your students see.
14. This website and cookies
This website sets no cookies and uses no analytics. The demo video on the home page loads from YouTube (youtube-nocookie.com) only when you click it; from then on Google's privacy policy applies to the video. The extension stores its settings in your browser's extension storage; nothing there is read by us.
15. Browser store disclosures
The extension asks for access to all websites so that it can read the page you are on and other tabs you add, without a prompt per site. It reads a page only when the panel is open and sends its text only when you run a tool. The use and transfer of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The Chrome Web Store listing declares: personally identifiable information (your email address), authentication information (sign-in codes and sessions), location (the first three parts of your IP address), web history (the title and web address of pages you work with, and your history of results in the browser), user activity (only the anonymous daily totals of exports and errors in section 10) and website content. The Firefox listing declares website content, browsing activity (the web address of the page you work with), personally identifying information (your email address) and authentication information, with technical and interaction data optional.
16. Children
The assistant is for VU Amsterdam staff and students with an institutional address. It is not aimed at children.
17. Changes
- Version 5, 7 October 2026. The clean-up runs at least once a day, also when nobody uses the assistant. Deleting your account keeps today's usage count until the clean-up removes it, so the daily limit cannot be restarted.
- Version 4, 5 October 2026. PostHog removed: usage statistics are anonymous daily totals in our own server. Web search off by default. Canvas pages that show students are not read. Microsoft's modified abuse monitoring described: Microsoft does not store or review the content. EU Data Zone and short-lived caches described. Daily usage counts per account kept 2 days instead of 31. Server logs described as they are: no IP addresses, a pseudonymous account number only for sign-ins and security events; IPv6 network prefixes. Exported files marked as made with generative AI. Link to the instructions for use.
- Version 3, 3 October 2026. Web search with Microsoft Bing in the chat. Legal basis is now legitimate interest (Article 6(1)(f)). Automatic deletion of unused accounts after 12 months and of usage counts after 31 days; IP-address prefixes listed; "Download my data" in Settings; erasure and privacy contacts; usage statistics described as on by default with an off switch. The page's title and web address named among what is sent; each browser store's declared data categories listed. The demo video on the home page, loaded from YouTube only on click.
- Version 2, 22 September 2026. Full statement: legal basis, processors, Microsoft's abuse detection, Firefox, rights and complaints.
- Version 1, 11 September 2026. First draft with the processing table.
Changes are listed here with their date. The English version is leading; the Dutch version is a translation.