DATA & SECURITY
What your IT director will ask, answered before they ask
Including the parts that are not reassuring. If something here rules us out, it is better that it rules us out now.
Last checked 12 August 2026. Questions: marketing@mathiter.com — first reply within 24 hours on working days.
What is collected
Account
Email address, display name, and the grade or learning stage the student selects. Sign-in is by email and password or by Google. Registration also offers an optional guardian email for progress notifications — it is optional, there is no age field and no consent gate, so guardian consent is not something the product collects. If your school needs it on file, it has to be captured on your side.
Learning
Answers submitted, which option was chosen on a wrong answer, time per question, lecture progress, placement-test responses and the ability estimates derived from them, and exam attempts. Also the free-text questions a student types into the AI Tutor and the answers it returns — that is student-authored content rather than a click, so it is called out separately below.
Usage
Pages visited, features used, and session statistics.
Payment
Handled by Toss Payments. Mathiter stores a billing key and the last four digits of the card; it never stores a full card number, CVC or expiry.
Where it runs
Google Cloud, Seoul region (asia-northeast3), on Firebase, Cloud Run and Firestore. The marketing site runs on Firebase App Hosting. Data at rest and in transit is encrypted by the platform; passwords are hashed by Firebase Authentication and are never visible to us.
Who else processes it
| Sub-processor | What for | Where |
|---|---|---|
| Google LLC | Hosting, database, authentication, and both of the model paths described below | Seoul (asia-northeast3); model inference may run outside it |
| Toss Payments | Card processing for individual subscriptions | Republic of Korea |
| Whois Corp | Domain registration | Republic of Korea |
What goes to a language model, and what does not
The teaching path never calls a language model. Every Socratic step a student sees was written in advance and stored; there is no model call when a student answers a question wrong. That is why the same wrong option produces the same teaching every time, and why a teacher can read it before a student meets it.
Two features do call one, and it is Google Gemini in both cases. The first is analysis: accumulated learning data is turned into a student profile and, for the Digital SAT, a projected score. What it receives there is problem-solving data and a grade level — no student name, no email address and no school identity. That data is matched back to a student only inside our own database.
The second is the AI Tutor, and it is the one to read twice, because the student decides what it sends. A student can type a maths question, paste or upload an image up to 5 MB, or attach a PDF up to 10 MB, and the question is sent to the model — the typed text, the image, and the text extracted from the PDF. Ten a day on a free account. The service answers only mathematics, but that judgement is itself made by the model, which means the content has already been sent by the time anything is rejected. So: a student can put whatever they photograph in front of a third-party model, and nothing on our side stops it beforehand.
Of that, the typed question and the model's reply are stored against the account, so the student can find them again in their review history. The uploaded image is not — it goes with the request and is never written to our database. There is no setting that turns the AI Tutor off, for a school or for a student. If that rules us out, it rules us out today rather than in week three.
One detail rather than a rounded-off claim
One honest detail rather than a rounded-off claim: a pseudonymous account identifier is currently included in the analysis payload. It is not a name and not an email, and it is meaningless outside our database — but it is a persistent identifier, so calling the data anonymous would be wrong. Removing it is a small change and it is on the list.
Retention, export and deletion
Retention
Learning data is kept while the account is active. Korean e-commerce law requires certain payment and dispute records to be retained separately for a statutory period.
Export
A school can request its students' learning history at any time and we will provide it. We have not committed to a turnaround in working days and will not put a number here until we can hold it.
Deletion
On request, or on account closure. Deletion removes the learning record; statutory payment records are handled separately as above.
Your data processing agreement
Yes — we will sign a school's DPA on request. It must disclose Google as a sub-processor for the analytics path described above; we will not sign a document that omits it.
What we do not have
None of this is in progress with a date attached, so it is listed as absence rather than as roadmap.
- No SOC 2 and no ISO 27001 certification.
- No independent penetration-test report.
- No single sign-on, no SCIM, no domain restriction. Google sign-in works for an individual account; there is nothing above that.
- No school-admin console, so there is no administrative view over a school's accounts.
- No named school reference. You would be the first.
Who to ask
Mathiter is operated by Elicova, a sole proprietorship registered in the Republic of Korea, and one person answers this address. Write to marketing@mathiter.com with a data question and you get a first reply within 24 hours on working days.
The full privacy policy and terms of service are linked in the footer.