The institution is the controller of its students' and instructors' data: it decides the educational purposes, which features and integrations to enable, who has access, and its retention requirements.

Wonder is the processor: we provide and secure the platform and process that data under the institution's documented instructions and our DPA. We manage the technical implementation and service providers within those agreed boundaries. Academic decisions remain with the institution and its instructors.

We process account details, including names, emails, institution-provided student or personal identifiers, and roles; course enrollments; submissions; grades; and feedback. Depending on the features used, we also process attendance, messages, forum posts, recordings and transcripts, AI interactions, and learning activity and technical logs.

Sensitive institutional identifiers are encrypted before database storage.

We send AI providers the content needed for each feature—for example, the question, reference solution, and student's answer for grading support—without attaching the student's name, personal identification number, or other account identifiers. Other uses include course assistance, study-content generation, and transcription.

Personal information may nevertheless appear within the content users submit, and we warn users against including it in submissions and AI chats. Class recordings may also contain identifiable voices, images, or spoken names, which can be passed to the relevant providers for transcription and AI processing.

Wonder does not use personal data processed on behalf of an institution to train AI models, and none of our AI providers train on your data.

We may use genuinely anonymized usage data to improve our own models only with the institution's written approval.

Our core backend, primary database, and private file storage are hosted in Frankfurt, Germany. Web application processing runs in European regions. Depending on the features used, external providers may also process relevant data outside Europe, including in the United States.

Our main infrastructure and AI providers maintain independently audited security programs, including SOC 2 Type II reports and/or ISO 27001 certifications. Our DPA sets out the contractual protections required of our subprocessors.

See our Subprocessor Register for providers, purposes, and processing locations.

Institutional data is retained while the institution uses the platform, subject to its retention requirements and documented instructions. This includes academic records, submissions, recordings, AI chat history, and generated content.

When the agreement ends, the institution can request return or deletion of its data within 90 days. Residual backup and log copies are isolated from active use and deleted on their normal expiry cycles.

Deactivating an account prevents access while preserving academic records the institution needs to retain. At the institution's request, personal data can be deleted or anonymized, subject to applicable academic and legal retention requirements.

When the agreement ends, we return or delete institutional data, according to the institution's choice, within 90 days. Residual backup and log copies remain isolated from active use until their scheduled deletion.

Access is limited to authorized personnel who need it to operate, secure, or support the platform. They are subject to confidentiality obligations, with access controls and periodic access reviews. Infrastructure administrative accounts are protected by multi-factor authentication.

Data is encrypted at rest, and selected sensitive identifiers receive additional application-level encryption. These protections do not prevent authorized administrators from accessing readable data where their permissions allow it.

Each institution has a separate MongoDB database, and its files are stored in institution-specific storage namespaces. Access within the platform is controlled by institutional roles, course enrollment, and permissions. AI retrieval uses separate OpenAI vector stores for each course.

This is logical separation: institutions share the application runtime and some supporting infrastructure, while their records, files, and access permissions remain institution-scoped.

The institution leads the response to requests concerning data we process on its behalf. Wonder provides reasonable technical and operational assistance to locate and supply relevant data, make corrections, or carry out deletion under the institution's instructions and applicable retention requirements.

If we receive a request directly, we notify the institution without undue delay. We may acknowledge receipt, but otherwise respond only on the institution's instructions or as required by law. Users can also view and update certain account information directly in the platform.

AI provides grading suggestions and feedback for instructors to review, accept, change, or reject. The final grade is the instructor's decision.

Our DPA requires meaningful academic review before AI outputs are relied upon. They must not be the sole or determining basis for decisions about admission, assessment, progression, certification, disciplinary status, or access to education. Learning analytics do not automatically change enrollment, access, or student status.

We follow a documented incident-response process to investigate, contain, and address the breach. We notify affected institutions without undue delay, and no later than 48 hours after becoming aware of a personal data breach affecting their data.

We provide relevant information as it becomes available and cooperate with the institution's investigation and remediation, helping it meet its own notification obligations.

Our DPA authorizes the subprocessors listed in our Subprocessor Register. We notify the institution at least seven days before adding or replacing a subprocessor.

The institution may object during that period on reasonable privacy or security grounds. We work together to resolve the objection; if it cannot be resolved, the institution may terminate the affected portion of the service without penalty. Wonder remains responsible for its subprocessors' performance under the DPA.

Yes. On reasonable request, we provide security documentation sufficient to demonstrate compliance with our DPA. If that documentation does not address the institution's reasonable compliance concerns, it may request an on-site audit by an independent auditor under confidentiality obligations.

Audits normally require 30 days' notice, are limited to relevant systems and information, and are at the institution's expense. Routine reviews are limited to once every 12 months, with exceptions following a confirmed personal data breach or where required by a supervisory authority.

The institution is responsible for providing the required privacy notices and obtaining any consent required for recording and the intended processing. Wonder retrieves and processes recordings the institution has already made available to us.

Our Privacy Notice explains how recordings, course materials, and student work are used by AI features. We identify the course-support assistant as AI and mark AI-generated study content where technically feasible.