Privacy Statement

Last updated: 12 November 2026

1. Who we are

LudensFlow is a platform of teaching structures for education. The controller for the processing of your data is Oksana Oliinyk, based in the Netherlands. Contact: hello@ludensflow.com.

2. What data we keep

From your account: your email address, your name (optional), your language choice and, if you sign in with a password, a hashed version of it. If you sign in with Google or Microsoft, we receive only your email address and name from them; we never see your password. From your work: your preparations, lessons, variations, class labels, curriculum, reflections (including any free text), files you add to a lesson, ratings, comments, favourites and share links. From your usage: which structure you played, when, for how long, and with which class label. From your mail choices: whether you want the monthly tips, and when and where you said so. From signing in: a security log of sign-in attempts and password resets, holding your email address and IP address only as a one-way code (hash), the country and the type of browser; that is how we see someone trying to take over your account. From the structure assistant: which answers are chosen in the conversation and which structure is taken, not linked to any person or account, so we can see which questions help. From your first visit, if you accepted in the cookie banner: which link brought you here (for example a post on Instagram or LinkedIn) and which page you landed on; if you create an account, we keep that with your account, so we know which channels actually reach teachers. If you start a structure without an account after that, this browser remembers which one; if you then create an account here, we link those earlier runs to your account, only so we can see how teachers begin. They do not appear in your own overview. About your classes: the first names of your students, if you enter them yourself to draw turns and make groups; only you see them.

3. What we do not ask of students

Students have no account and we ask them for no name or email address. You may enter the first names of your class yourself, to draw turns and make groups; they live only in your account, are never linked to anything a student sends, and go when the class or your account does. A live link and a poll work with an anonymous device id, only so that one phone counts once. Poll answers and anonymous participant ratings are stored without any link to a person. Free text from a poll is seen only by the teacher, who can also delete it. A class feedback (three questions, once a month) is stored as counts per class only; there is no row per device, and the device id is erased after that day. A climate question to the class (at most once every three weeks) is stored only as a result for the whole class: how many students said yes, sometimes or no, or the estimate the teacher taps in herself. No device id, no names, no free text.

4. What we use your data for

To provide the service: signing in, saving and finding your work, playing and sharing structures. To improve the platform and give knowledge back to the profession: only anonymised and aggregated, so that no person, class or school is ever recognisable; free text from reflections never takes part in this. To email you: verification, password reset and account messages go through Resend. Until you have worked with a class, we send you a ready lesson on a Sunday at most four times, and one letter after your first lesson; every such letter has a link to stop them, and you can also switch them off under Email in your profile. Once a month we send tips on classroom structures. When you create your account you can tick that you do not want them; after that you switch them off in your profile or with the unsubscribe link at the bottom of every email. We keep your choice with the date and the place you made it, and unsubscribing has no effect on your account. For the AI help (questions and statements for a topic, cards, reading a photo of a textbook page or of your own lesson plan, tidying a dictated note) we send what you enter for it to Google Gemini: your topic, your class label, your text or your photo, and nothing else from your account. We use the paid version, under which Google does not use your input to improve its models. Please leave students' names out. What you dictate is not kept; only what you then save yourself. The speech recognition itself is done by your browser; Chrome and Edge send the sound to Google or Microsoft for it.

5. On what legal basis

Your account, your work and the AI help: performing the agreement you enter into when you accept the terms of use. Account emails and the reminders above: our legitimate interest in helping you actually start using the service; you can always stop them. The monthly tips: the rule for email about our own service to the people who use it (article 11.7(3) of the Dutch Telecommunications Act); you can say no when you register, and every email has an unsubscribe link. The security log and the check at registration that you are not a robot: our legitimate interest in protecting accounts. Statistics without cookies (Vercel, Ahrefs): our legitimate interest in seeing how the site is used without recognising you; Decline in the cookie banner switches Vercel off. The cookies that remember which link brought you here and what you tried without an account, and contact after a team scan: only with your consent. You withdraw it as easily as you gave it: through Cookie settings at the bottom of every page, or in the team scan's emails.

6. Who else is involved

We work with: Vercel (hosting in the EU, visitor statistics and speed measurement), Supabase (database and files, hosted in the EU), Resend (account emails and the reminders), Loops (our mailing list: your name, email address, language and whether you have worked with a class yet; the monthly tips unless you switched them off), Google Gemini (the AI help), Cloudflare Turnstile (checks at registration that a person is behind the screen), Google and Microsoft (only if you sign in with them) and Ahrefs (cookieless visitor statistics). Printable sheets and emails load their font from Google Fonts. If you add a YouTube or Vimeo video to a lesson, or a page shows one, it comes from their servers; YouTube in its no-cookie mode. These parties process data on our behalf under a data processing agreement. Some of them are in the United States; data goes there under the European Commission's standard contractual clauses or the EU-US Data Privacy Framework. We do not sell your data and do not pass it to third parties for their own marketing.

7. How long we keep your data

As long as your account exists. If you delete your account from your profile page, your account data and all your work are erased immediately, and we also remove your email address from our mailing list. The security log is kept for 180 days, even if your account goes in that time: that is exactly when it matters to see what happened. Anonymous data, such as poll answers, is linked to nobody and stays anonymous. Aggregated statistics stay aggregated.

8. Team scan

When you start a team scan we keep your name, e-mail address, the names of the school and the team, the team size, your language, and whether you agreed to be contacted. That agreement is a separate checkbox; without it you only get the scan’s own mails. Team members answer without an account: we keep their answers, a random device number (so one phone counts once) and the day of the answer, but no name, no IP address and no time of day. The report shows only the team’s total, only from five answers, and never a single answer. After 24 months we delete the answers, and your own details too unless you agreed to be contacted.

9. Cookies

We use a functional cookie to keep you signed in and a cookie to remember your language choice; these need no consent. If you choose Accept in the cookie banner, we set three more: lf_consent (one year) remembers that you accepted and on which version of the banner, lf_src (90 days) remembers which link brought you here, and lf_guest (90 days) which structures you started without an account. Without Accept we do not set them. Vercel Analytics, Speed Insights and Ahrefs count visits without cookies; Decline also switches Vercel off. You change your choice through Cookie settings at the bottom of every page.

10. Your rights

You have the right to access, correct, delete and port your personal data, and you can object to a processing. Send a request to hello@ludensflow.com, or delete your account directly from your profile page. Which emails you get, you choose yourself under Email in your profile. If you are unhappy with how we handle your data, you can lodge a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens).

11. Contact

For privacy questions: hello@ludensflow.com.