Who is responsible
nt2trap is an exam-prep platform run by Iskander Al-Sarayfi (NT2 teacher). During beta this is a personal venture. For questions or requests, see the contact page.
What we collect
- Your name and email address (for your account)
- Your answers to exercises and scores achieved
- Login timestamps and failed sign-in attempts (for security)
- Your IP address, temporarily, for rate-limiting against brute-force attacks
- Feedback and survey answers you voluntarily provide
- Your writing assignments (free text), to provide writing feedback
- Your voice recordings and their transcript, for speaking feedback and transcription
We use no tracking cookies, no Google Analytics, no advertising pixels.
Where it's stored
Your account, exercise and security data are stored on servers within the European Union (Hetzner, Germany). For AI feedback, your written texts and the transcripts of your voice recordings are sent to Anthropic, and your voice recordings to OpenAI for transcription. These processors are located in the United States; that transfer is covered by the EU Standard Contractual Clauses (SCCs) in their data processing agreements.
AI feedback and external processors
To review your writing and speaking assignments we use two external AI services as sub-processors:
- Anthropic (Claude) processes your written texts and the text (transcript) of your spoken answers to give language feedback.
- OpenAI (Whisper) first transcribes your voice recording into text; that text is then sent to Anthropic for the feedback.
Both services process your data only to deliver this feedback and, under their API terms, do not use your input to train their models. The transfer to the United States is covered by their data processing agreements with EU Standard Contractual Clauses (SCCs).
How long we keep it
During beta the retention policy is still being built. General principles:
- Account data and exercise results: as long as your account is active
- Security logs (login attempts, IP for rate-limiting): up to 90 days
- On account deletion, your data is permanently removed within 30 days
- Voice recordings: automatically deleted after about 90 days, at the latest after 12 months
Your rights under the GDPR
You have the right to:
- Access the data we hold about you
- Correct inaccurate data
- Delete your account and associated data
- Restrict processing
- Receive a copy of your data (data portability)
- Object to processing
Request this via the contact page. You also have the right to lodge a complaint with the Dutch Data Protection Authority.
Cookies
We use one functional cookie (nt2_session) to keep you signed in. It expires automatically and is httpOnly and SameSite=Lax. No analytics, tracking or advertising cookies.
Beta disclaimer
nt2trap is in beta. The platform and this privacy statement may change. We'll notify you by email of material changes. nt2trap is not affiliated with DUO or the Ministry of Education.