Who we are
Echelio is a coding assessment platform for schools. In this policy, “we” means Echelio.
It covers the Echelio website and application. For questions about your data, write to [email protected].
Our role: controller and processor
Echelio is used by schools and other training organizations. For the data of its teachers and students (classes, questions, answers, results), the organization is the data controller: it decides why and how the data is used. Echelio acts as its processor, handling that data on the organization’s behalf and following its instructions.
For its own website and for the accounts needed to sign in and keep the service secure, Echelio is the controller. That covers account and sign-in data, security records, and the emails the service sends.
If you are a student, your school is your first contact for questions about your results and about how your data is used in your course. You can also write to us.
What we collect and why
We collect only what the service needs. This list comes from what the application stores.
- Account: your name, email address, and a hash of your password (never the password itself), your role (teacher or student), and whether the account is active.
- Organization and classes: the organization you belong to and your role in it, the classes you are in, and each class’s name and dates.
- Invitations: the email addresses teachers invite to a class or share a folder with, and whether and when the invitation email was sent.
- What teachers write: questions, test cases, solutions, quizzes, folders, skills, and the tests they schedule.
- What students produce in code tests: the code they write, which is saved as they type, each run and submission with its time, the result of every test case (including run time and memory), the score, and the output of visible test cases.
- Quiz answers: each answer, the automatic result, the final result, and who set it.
- Test activity: when a student joined, finished, ran examples, or submitted, and, only when the teacher turned the option on for that test, each time the student left the test page and for how long.
- Grading and progress: teachers’ corrections, the verdict and short reason of an AI grading when a teacher asked for one (the reason is for the teacher only), and the skill levels Echelio calculates from a learner’s results.
- Security records: to limit guessing of passwords and join codes, we keep for 24 hours the email address and network address of failed sign-in attempts and password reset requests, and a hash of the network address and browser identifier of join-code attempts.
- Preferences: the language you choose for the interface.
We do not run advertising, we do not sell personal data, and we do not use analytics trackers. Echelio does not profile people for marketing.
Legal bases
Under the GDPR and similar laws, we rely on these bases.
- Performance of a contract (providing the service to the organization and its members), for account data and for the data processed on the organization’s behalf.
- Legitimate interests, for keeping the service secure, preventing abuse and cheating on tests, and fixing faults.
- Legal obligations, when the law requires us to keep or hand over information.
For the data it controls, the organization chooses its own legal basis, for example its teaching mission or its contract with the student. We do not rely on consent for ordinary use of Echelio.
Who sees your data
Access depends on role, and an organization never sees another organization’s members or results.
- Teachers see the classes they teach, and their students’ code, answers, results, and test activity. They see questions and quizzes shared with them.
- Organization administrators manage members and settings of their own organization.
- Students see their own work and results.
- A teacher can open a live class display on a screen. It shows participants’ names and scores to the people in the room.
Service providers
We use the providers below to run Echelio. Each handles personal data only to provide its service.
- Hetzner Online GmbH (Nuremberg, Germany): Hosts the application, its database, its job queue, and the server that runs students’ code. Holds all the data described above.
- Resend (United States): Delivers the emails Echelio sends: class invitations, test assignments, folder invitations, and password reset links. Receives the recipient’s email address and the content of the message.
- OpenRouter (United States): Only when an organization has added its own OpenRouter key and a teacher uses an AI feature. Receives the text described below and forwards each request to the model provider it selects.
- jsDelivr (served worldwide): A public content delivery network that delivers the code editor’s files. Your browser contacts it when the editor opens, so it sees your network address and browser details.
Code execution. Echelio runs students’ code itself, on its own server at Hetzner Online GmbH, in Nuremberg, Germany. When a student runs or submits code, the code and the test input go to that server, which runs it in an isolated sandbox with time and memory limits and returns the output. No other company receives it, and nothing that identifies the student is sent with it.
AI features. They are off until an organization adds its own OpenRouter key, and they run only when a teacher uses them. AI quiz drafting sends the teacher’s request (topic, level, question types, language) and the beginning of the quiz’s existing questions, so the model does not repeat them. AI grading sends, for each open answer a teacher chose to grade, the question, any code shown with it, the grading notes, the explanation, and the student’s answer. It sends no name, email address, or account number. If a student writes personal data in an answer, that text is sent too. OpenRouter forwards each request to the model provider it selects for the chosen model (for example, the provider of the DeepSeek model). The key belongs to the organization, so its OpenRouter account and that model provider handle the text under their own terms.
Email. Echelio sends only service emails (invitations, test assignments, password resets). It sends no newsletters or advertising.
International transfers
Echelio’s servers, including the one that runs code, are in Nuremberg, Germany. Resend and OpenRouter are in the United States, outside the European Economic Area, and the model providers OpenRouter forwards requests to may be elsewhere too.
These transfers rely on the contractual safeguards those providers offer.
How long we keep data
Some records expire on their own; the rest stays while the organization uses Echelio.
- Sign-in sessions last 7 days at most and are then deleted.
- Password reset links are valid for one hour and are deleted once expired.
- Failed-attempt records are deleted after 24 hours.
- Accounts, classes, questions, and results are kept while the organization uses Echelio. They are deleted immediately when it stops using Echelio, and a student’s data is deleted immediately when their account is deleted.
- Backup copies are kept for up to 30 days and then permanently deleted. Until then they are used only to restore the service after an incident.
How we protect data
These measures are part of the application.
- Passwords are stored only as bcrypt hashes. Sign-in session tokens and password reset tokens are stored only as hashes.
- The sign-in cookie cannot be read by page scripts and is sent only over secure connections in production.
- Students’ code runs on a separate execution server, in a sandbox with time, memory, and output limits.
- An organization’s AI key is encrypted before it is stored, and only its last four characters are ever shown again.
- Sign-in attempts, password resets, and join-code attempts are rate-limited.
- Each person sees only what their role and organization allow, and hidden test cases are never sent to students’ browsers.
Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data erased, where the law provides for it;
- object to processing based on legitimate interests, and ask us to restrict processing;
- receive the data you provided in a portable format, where the law provides for it;
- lodge a complaint with the data protection authority of your country.
To use these rights, write to [email protected]. We may ask you to prove who you are, and we answer within one month.
For data an organization controls, we pass your request to it or point you to it, because it decides what happens to that data.
Children and students
Echelio sets no minimum age. Students use it through their school or training organization, and whether they are under 18 depends on the school.
The organization decides who uses Echelio. It is responsible for informing students and for any parental consent its law requires.
Changes to this policy
When we change this policy, we update the date at the top. For a significant change, we also tell organization administrators in the application or by email.
Contact
For any question about this policy or your data, write to [email protected]. The publisher’s details are in the legal notice.