How Exersa handles your data

Public demo

The public demo works without an account. A necessary, signed session cookie lasts seven days. We store the generated questions and requested pronunciation audio for that session; after expiry they are inaccessible and cleared by daily cleanup. Edits, fictional Viktor assignments and the answers you enter stay in your browser tab's session storage, separate from real student records. Closing the tab removes this local state. Do not enter real student names or personal details.

The teaching topic and requested speech text go to the AI and speech providers described below. Scene searches and photo viewing use Pexels as described below. To prevent abuse and limit spending, we keep provider usage counts, cost estimates and a keyed, monthly changing hash of the network IP address, not the raw IP address. The IP hash is cleared with the expired content; the remaining session-hash and cost ledger is deleted after 60 days by daily cleanup. The demo does not send homework emails or add individual activity to teacher product analytics.

Who is responsible?

Exersa is operated by Jonathan Luis Santos Mendes. For questions or privacy requests, email Exersa.io@gmail.com. Teachers and schools decide which students they add and what they assign; Exersa processes that information to deliver the homework.

Teacher accounts

We store your name, email address, password hash, chosen languages, setup answers (including the optional "How did you find us?" answer), your homework, lessons, media library and usage counts for the monthly plan limits. Login sessions use cookies that are required for the service.

To limit automated login attempts, we temporarily keep your network IP address, the authentication endpoint, a request counter and a timestamp in a private security table. This table does not store passwords, email addresses or learning content. Entries older than 24 hours are removed during daily cleanup; ordinary application and hosting logs have separate retention.

Students

Teachers add a student name and, optionally, an email address. Students practise through a personal link with an optional access code; we store their answers, results, notes to the teacher, speaking recordings and vocabulary progress so the teacher can follow their learning. Student pages set no analytics cookies. Do not enter more personal details about a student than the name needed to identify them.

Your own lesson material

When you paste notes, upload a PDF or photograph an exercise, you confirm that you made the material or may use it. Exersa reads only the pages you select and uses the material as inspiration: it extracts the learning goal and exercise pattern and writes new sentences. You state whether you wrote the material yourself or have permission to use it; for material you have permission for, a check rejects generated sentences that repeat it word for word.

The PDF file itself is deleted right after reading (leftover uploads after two hours at the latest); a photo is never stored. The extracted text and pasted notes stay privately with that draft for 30 days after its last change and are then removed automatically; the learning points, the exercise blueprint and your settings remain. Material is never shared with other teachers, never shown to students and never used to train models.

AI and speech providers

Questions, lessons, explanations, hints, assessments of unexpected answers, image descriptions and material analysis are produced by OpenAI models through the OpenAI API. Requests are sent without storage on OpenAI's side ("store: false"); OpenAI does not use API data to train its models and may keep it for up to 30 days for abuse monitoring. Pronunciation audio is generated by ElevenLabs from the text of a question; dictation is transcribed by OpenAI. These providers receive the text or audio needed for the request and a pseudonymous account identifier, never your email address or a student list.

Providers that process data for Exersa

• Pexels: Optional external photo search receives scene search terms from Exersa's server, not teacher emails, student lists or answers. Viewing a photo loads it directly from Pexels, which receives the viewer's IP address and normal image-request information. Avoid personal details in photo searches. Only the external reference and attribution are stored with the exercise.
• OpenAI (USA): Text generation, grading of unexpected answers, image and material analysis, transcription. API data is not used for training.
• ElevenLabs (USA): Speech generation for question and explanation audio.
• Supabase: Database and private file storage (images, audio, temporary PDF uploads).
• Vercel (USA): Hosting of the application and its server functions.
• Resend: Transactional email such as verification, invitations and student notifications.
• PostHog (EU Cloud): Daily aggregated product totals only; see the product analytics page.