DIALECTICA
Request a demo

Last updated · 27 September 2026

Privacy, security and compliance

Answers to the checks a data protection officer runs. Each section has its own link and can be forwarded on its own.

Scope
app.dialectica.education

Market: Italy. Other countries have separate documents.

01Roles

The school is the data controller: it decides the purposes and keeps the relationship with families. Dialectica is a data processor and acts only on the school's instructions. When the licence comes through a channel partner, the partner is the processor and Dialectica is a sub-processor.

The chain, in words: the school (controller) instructs the channel partner (processor), who instructs Dialectica (sub-processor), who relies on the five providers listed in point 02. In a direct sale the intermediate step does not exist and Dialectica is the processor.

The contract governing the relationship is the agreement under art. 28 GDPR, listed in point 06.

02Sub-processors

This list is complete. If it changes, this page changes and the school is notified before the change.

Supabase

Purpose
Database and authentication for school staff
Place of processing
Database in the European Union (Frankfurt, DE). Provider based in the US
Guarantees
Processor under art. 28; standard contractual clauses for transfers. The provider publishes its own certifications.

Vercel

Purpose
Application hosting and server functions
Place of processing
Functions run in Frankfurt (fra1, DE). Provider based in the US; its support and logs may process data in the US
Guarantees
Processor under art. 28; standard contractual clauses for transfers. The provider publishes its own certifications.

Mistral AI

Purpose
Language model: debate opponent and analysis of submissions
Place of processing
France
Guarantees
Processor under art. 28. Submissions are not used to train the model (opt-out enabled). Without zero data retention, the provider may keep texts for up to 30 days to monitor abuse, as an independent controller for that purpose only.

Resend

Purpose
Emails to adult staff only: invitations, password recovery and support requests
Place of processing
United States
Guarantees
Processor under art. 28; standard contractual clauses for transfers. No student addresses pass through here: we do not collect them.

IONOS

Purpose
Mailbox that receives contact-form requests and teacher support messages
Place of processing
Provider based in Germany (EU)
Guarantees
Processor under art. 28 for staff data; contact requests are processed by Dialectica as controller.

No other service receives data. Pages used by students load no third-party services, analytics included.

03Data processed

Of a student we process

  • The display name chosen by the school
  • The class and the institution
  • The texts the student writes in their debates
  • The analysis scores and the report confirmed by the teacher
  • The class code they joined with

We do not process

  • The student's email address: we do not ask for it
  • Photographs and images of the student
  • Phone number or other contact details
  • Geolocation

04Minors

For lower secondary school, authorisation from whoever holds parental responsibility is required before the student can start. The school collects it, with its own tools and forms.

In the application the teacher records only whether the authorisation is present or absent. A student without authorisation sees the assignment but cannot start a debate, and the screen explains it to them in plain words. The signed document is not uploaded to the system.

05Retention

Contract end + 180 days

Student data lives as long as the institution's contract, plus a grace period of 180 days. The grace period is written into the contract and can be shortened for a given institution. Once it runs out, the debates, the assessments, the classes and the institution record itself are deleted.

Deletion is automatic: a procedure in the database runs every night, and we can show it. When an institution is deleted, so are the accounts of students and staff with no other tie to a class or institution; a teacher who also works for another client institution keeps access. Erasing one account during the contract is a separate request we act on. Teacher invitations that are never accepted are deleted after 30 days.

06Available documents

We send them to the institution on request.

  • Data Processing Agreement (DPA) under art. 28 GDPR, ready to signon request
  • Pre-filled Data Protection Impact Assessment (DPIA) for classroom useon request
  • Privacy notice for familieson request
  • Privacy notice for the studenton request
  • Record of processing activities under art. 30on request
  • Description of security measures under art. 32on request

How to request them: the institution's DPO or head of administration writes to hello@dialectica.education

07Artificial intelligence

  • Which modelA language model from Mistral AI, a European provider. Inference — the debate text — runs in the European Union, in France. The infrastructure the provider uses to manage the service (API keys, billing, usage analytics) is not regional, and limited, protected transfers to sub-processors remain possible: the student's text stays in the EU, but not every part of the processing.
  • TrainingStudent texts are not used to train models, neither ours nor the provider's.
  • The score is a proposalThe analysis proposes a rubric score. It enters the register only after a person has confirmed it, and the teacher's edit stays on record. It cannot be switched off.
  • Score labelIn the application and in the printed report the score is called “World Schools–style score (training)”: it is not an official tournament score.

08Accessibility

The application's accessibility statement, in the European model format, lives on its own page: it declares the conformance level, the non-conforming content, and the channel for reports.

Accessibility statement