Privacy notice

Koja Research AS · Version 2026-10-06

This notice covers everyone with an account on kojai.no and everyone who requests access. kojai.no is a teaching platform for learning to work with agentic AI in business economics. It is developed and run by Koja Research AS, a developer of educational technology. It has no commercial purpose. Nothing you store is sold, shared with advertisers or used to train models.

1. Who is responsible

Koja Research AS, organisation number 938 417 822, Tangen terrasse 22, 1450 Nesoddtangen, Norway, is the data controller. Questions and requests: personvern@kojai.no.

2. What we process

• Account: your email address, a salted hash of your password, the course code you signed up with, and your session tokens.
• What you create: chats, memory entries, project folders, uploaded files, agent tasks and their results, essays you write for practice, the grades and comments you receive, and the ratings you give.
• Use and cost: tokens and cost per account, so the budget each account has can be enforced.
• Technical logs: the tutor's log records which problem was asked about and whether the check ran. It carries a hashed project id, not your email.
• Access requests: the email you give when you request access, your consent and its time.
• Visits: an anonymous first-party visit counter with a random visitor id. No third-party trackers, no advertising cookies.

3. Why, and on what legal basis

• To run the service you have an account for: GDPR Article 6(1)(b), performance of a contract.
• To contact you about access when you have asked for it: Article 6(1)(a), your consent, which you can withdraw at any time.
• To keep the service secure and within budget: Article 6(1)(f), our legitimate interest in running it safely.
• Research on the AI tutor in a course: governed by the research letter shown to the cohort before first use. The research part uses no personal data. The research export carries no email, no name and no user id.

We make no decisions about you by automated means that have legal or similar effects, and we do not profile you.

4. Where the data is, and who processes it for us

• Hosting: Fly.io, Inc., a US company. Your data is stored in Stockholm, Sweden, in the EU, on an encrypted volume with daily snapshots. Fly.io provides a data processing addendum for its customers.
• Model calls: OpenRouter, Inc., a US company, routes each request to the model provider. The models used in teaching are Anthropic's Claude and Mistral AI's models. The setting that forbids training on the data is on for every call. OpenRouter states in its privacy policy that transfers out of the EEA rest on an adequacy decision or on the standard contractual clauses approved by the European Commission.
• Email: our email provider delivers password-reset and access emails.

Access to the systems is limited to Koja Research AS.

5. How long we keep it

• Account data and what you create: until you delete your account. Deleting it erases your memory, files, chats, essays, grades, ratings, and the research rows that pointed to the account.
• Snapshots of the storage volume: 30 days, then they are gone.
• Access requests: until we have contacted you, or until you withdraw consent, whichever comes first.

6. Your rights

You can see and download everything you own with Export my data, and remove it all with Delete my account, both on the site. You also have the right to have data corrected, to restrict or object to our processing, and to withdraw consent. Write to personvern@kojai.no and we answer without undue delay. You can complain to the Norwegian Data Protection Authority, Datatilsynet, at datatilsynet.no.

7. Changes

When this notice changes, the version date at the top changes with it.