Last updated 13 October 2026
Privacy notice
This Article 13 notice explains what Syllabro (syllabro.com) processes when you use the invite-only tutor. Chat messages, the invite cookie, and IP addresses used for rate limits are personal data. We do not claim they fall outside GDPR. Document version 2026-10-13.
This document describes how Syllabro actually works today. It is an alpha tester agreement, not legal advice, not a completed DPIA, and not a contract with the University of Gothenburg or Instructure.
This deployment does not create a server-side user account or server-side chat history. Access is an invite cookie in this browser.
1. Controller
The controller for this website is Syllabro, operating https://www.syllabro.com. We are not the University of Gothenburg. GU does not run this service and has not authorized it as an official education system.
We have not published a legal-entity name, postal address, or organisation number on this page. Write to the contact address below if you need the operator’s identity.
Contact: hello@syllabro.com.
You can complain to the Swedish Authority for Privacy Protection (IMY) if you believe we process personal data unlawfully. See imy.se.
2. What this notice is not
This is not a data processing agreement with GU, not Canvas/Instructure privacy terms, and not a completed data protection impact assessment. This notice covers local Connector handling on your device. The Chrome Web Store listing is an extra permission summary, not a substitute for this notice.
3. Lawful bases
Checking the box on the invite form is agreement to the Terms of Use and an acknowledgement that you have read this notice. It is not GDPR consent for processing.
| Processing | Basis | Why |
|---|---|---|
| Invite check, session, chat messages, minimized context frames, permitted filtered Learn material, and the tutor reply | Art. 6(1)(b) | Needed to provide the tester service you asked for. |
| Rate limiting and attack prevention (hashed session id and hashed IP) | Art. 6(1)(f) legitimate interests | Keeping the service usable and safe for testers. |
We do not currently keep a separate archive because of a legal obligation of our own, so we do not rely on Art. 6(1)(c) for a retention duty we invented. We do not use GU’s public-task basis. We do not sell your data.
4. What we process
| Data | Recipient | Retention | Required to use? |
|---|---|---|---|
| Chat messages, restricted context frames, structured course facts and, when enabled for Learn, request-local privacy-filtered document text (up to four documents and 128 KiB combined text) | OpenAI Ireland Ltd. via the Responses API | OpenAI may keep standard abuse-monitoring logs, typically up to about 30 days. We set Responses store to false, so we do not keep extra Responses application state. That is not Zero Data Retention. Deleting a Syllabro chat does not instantly clear OpenAI’s security logs. | Yes, to get a tutor reply. |
| syllabro_session (opaque session id, document versions, and expiry; no name) | Syllabro on Vercel | About 30 days, or until you clear cookies. | Yes, to stay in the tutor after redeeming an invite. |
| HMAC of the session id (or account user id) and HMAC of a client IP — not the raw cookie or IP | Upstash Redis (hosted limiter on Vercel). Local and desktop builds keep the same buckets in memory. | About 40 tutor requests per 10 minutes per session, about 80 per IP, and about 8 invite guesses per 15 minutes. Keys expire with those windows. | Yes, to limit abuse. |
| Chat transcripts (syllabro-local-chats-v1) | This browser only (localStorage) | Until you delete chats in the sidebar, export a copy, or clear site data. This browser keeps at most 40 chats and 120 messages per chat. | No. You can use the tutor without keeping a history. |
| Chat drafts and course context (syllabro-chat-drafts-v1, syllabro-local-context-v1) | This browser only (localStorage). Not sent to Syllabro servers or OpenAI. | Until you delete the chat, switch course, or clear site data. | No. Drafts stay with the chat; context keys are local material references only. |
| Theme (syllabro-theme, syllabro-fun-palette) | This browser (localStorage) | Until you change it or clear site data. | No. It is a UI preference you asked the site to remember. |
| Sidebar, effort, and hints (syllabro-chat-sidebar, syllabro-effort, syllabro-hints) | This browser (localStorage or sessionStorage) | Until you change them or clear site data. | No. |
| Course context frames (syllabro-frame-cache-v1) | This browser tab only (sessionStorage). Not sent to Syllabro servers or to a new recipient. | Until you close the tab, change Canvas account/origin, or clear site data. | No. The cache holds extracted concepts and sanitized task facts so indexing can resume. Group mappings, case selections, file bytes and reader text are not stored in it. |
| Operator counters (syllabro-ops-metrics-v1) | This browser tab only (sessionStorage). Never sent to Syllabro servers or OpenAI. | Until you close the tab or clear site data. | No. Counts and coarse buckets only (connection kind, index outcome, save failure, interrupted send). No question text, frames, course names, or file bytes. |
Recipients for this live notice: Vercel, OpenAI, and Upstash (hashed limiter keys only). We do not share your chats with other testers.
5. What does not go to syllabro.com
Learn has a separately controlled document-context trial. After disclosure, the Connector may send the whole active document as privacy-filtered prose, or complete relevant sections with visible partial coverage when extraction is incomplete or the text budget is exceeded. Comparisons can include up to four requested documents. Follow-ups reuse the selected material; topic changes replace it. Quiz and grading keep their existing restricted context.
The initial trial uses synthetic or permission-cleared material. Before sending, choose Yes, always; No, always; Yes, once; or No, once under “Review the material before sending?”. Always is saved only on this device as syllabro-material-review-v1; once asks again next time. Review shows the exact filtered attachment and requires Send. Automatic sending retains an inspection control. Changed courses, source versions or selections invalidate pending review. These choices are not GDPR consent or permission to process another person’s material, and filters cannot guarantee anonymity.
The prose filter removes contacts, staff identifiers, credentials, Canvas links and identifiers, filenames and group mappings. Personal student or patient material and suspected peer submissions are withheld. Ordinary academic discussion is retained. Attached source text is request-local: it is not inserted into message history, hosted saves, exports, diagnostics or analytics. Generated replies can contain source-derived information and follow ordinary chat storage rules. Syllabro and OpenAI are the recipients of enabled attachments; OpenAI’s retention limits above still apply.
When task requirements are enabled, detection happens locally. The tutor can receive a limited checklist, qualified counts, case topics and an alternative-case agreement condition. Group labels, group-to-case mappings and evidence locations stay in browser memory. Those labels and selections can still identify people indirectly; this feature is not a claim of anonymity or copyright clearance.
Local course lookup can show groups, lectures, seminars and task lists in this browser. When structured course facts are enabled, Syllabro can send selected seminar dates, lenses, bibliographic readings, responsibilities and short normalized preparation actions with your question so the tutor can answer it. Shared preparation, a selected group role and a class output are kept distinct. Group names, membership mappings, full instructions, source identifiers and evidence locations stay in this browser. Lookup cards are not saved as hidden chat metadata. The saved user message is the minimized question. This is not a general anonymizer for names you type yourself.
We do not save task records or raw course-fact bundles as hidden chat metadata. The tutor may repeat allowed facts in its answers, and those answers follow the ordinary chat storage and export rules above. Use Open source on the local card to check the original wording.
- Course file bytes and page HTML; prose outside the separately enabled Learn material contract
- Canvas cookies, CSRF tokens, session cookies, or access tokens
- A Canvas personal access token (we never ask for one)
- Course ids and source ids in the tutor payload to OpenAI (item titles may still be sent)
- Assignment Status grids (those stay in the connector)
- Unselected source-reader text (opening a reader alone does not send it)
6. Special-category and sensitive data
Do not enter health or diagnosis information, personnummer, student IDs, or other special category data in chat. If you do, that text may still reach OpenAI with the message. We do not want that processing, we do not routinely inspect chats, and you can delete local chats and write to us.
7. The Connector and Canvas
The Syllabro Connector is a browser extension. It uses your already logged-in Canvas session on this device and may read a Canvas CSRF cookie or page token locally so it can call Canvas’s documented REST API (/api/v1) on this device. Cookies and tokens are not sent to syllabro.com. We do not ask for a Canvas personal access token.
This is not an institution-issued OAuth2 or LTI developer key. The University of Gothenburg has not authorized Syllabro as an official Canvas integration. The store listing complements this notice; it does not replace it.
You can use the site without the connector, but then there is no course frame — only what you type.
8. OpenAI
Hosted tutoring uses the OpenAI Responses API at https://api.openai.com/v1/responses with an operator key. This is not a consumer ChatGPT account you log into. Each tutor request sends your messages, the concept frames and any enabled selected structured course facts for that turn so a model can reply.
For an EEA customer, the contracting entity is OpenAI Ireland Ltd.. OpenAI affiliates and subprocessors may still process data outside the EEA. Safeguards are those in OpenAI’s data processing terms (adequacy decisions and/or standard contractual clauses, as applicable). We cannot promise that model inference stays in the EU.
Under OpenAI’s current API data-usage policy, API inputs and outputs are generally not used to train their models unless we opt in. We have not opted in. We have not enabled Zero Data Retention.
The hosted tutor uses the Responses API, not Chat Completions. The SDK we use defaults to storing Responses application state unless we set store to false. We set store to false, which turns off that extra application state. It does not enable Zero Data Retention. OpenAI may still keep standard abuse-monitoring logs (typically up to about 30 days) and other feature-specific data described in their docs. Deleting a Syllabro chat in this browser does not instantly clear those copies.
9. Hosting (Vercel)
Function compute for this project is configured in region arn1 (Stockholm). That is the function region only. Hosting, CDN, platform logs (IP, URL, timestamps), and Vercel subprocessors may process personal data outside Sweden, including the United States, under Vercel’s data processing terms. We do not claim that all Vercel processing stays in Sweden.
Hosted rate-limit counters live in Upstash Redis as HMAC keys with a short TTL. Prefer an EU Upstash region when you create the store. The keys are not raw cookies, IPs, chat text, or course frames. This is not Zero Data Retention.
We do not run a product analytics tool that records question text, frames, or course names. This tab may keep allowlisted operator counters (syllabro-ops-metrics-v1) in sessionStorage. Those counters never leave the browser.
10. Cookies and similar storage
We use only storage needed to run the tester service. We do not set advertising or analytics cookies, and we do not show a marketing cookie banner.
- syllabro_session — strictly necessary invite session, about 30 days.
- syllabro-local-chats-v1 — chat transcripts in this browser.
- syllabro-chat-drafts-v1 and syllabro-local-context-v1 — unsent drafts and local course-context references for a chat.
- syllabro-study-checklist-v1 — optional study checkmarks you control on this device. These contain local material references, stay in this browser, and are separate from Canvas submissions, grades and completion. Clear them in Settings → Local study data. Clearing site data also removes them.
- syllabro-theme and syllabro-fun-palette — a UI preference you requested, stored locally.
- syllabro-chat-sidebar, syllabro-effort, syllabro-hints — local interface state.
11. Your rights
You may request access, rectification, erasure, restriction, portability, or objection (especially where we rely on legitimate interests), and you may lodge a complaint with IMY.
In this cookie-only deployment we hold almost nothing server-side besides what Vercel and OpenAI process to deliver a turn, plus hashed limiter keys in Upstash Redis. Clearing this site’s data and uninstalling the Connector is the effective local erase. Portability of browser chats means copying them from this device; we do not run a Clerk or Neon export today.
Write to hello@syllabro.com.
12. Automated decisions
The tutor may say whether a practice answer looks right. That is formative only. It is not an official grade, admission, or grading decision and produces no legal or similarly significant effect under GDPR Art. 22.
13. Children
The alpha is for people 18 or older. Do not use it if you are under 18.
14. Changes
We will update this page when processing changes. The date and version at the top are the current notice. A material bump of the privacy version stored in your session may ask you to acknowledge the new notice. See also the Terms of use.