Privacy notice · Computor

Computor is a free TU Graz learning service. Public material needs no account. For accounts, courses, submissions, workspaces, communication and learning help, we process the data below. There is no advertising, sale of data or external behavioural tracking. Configured courses also route messages automatically to Lena AI learning assistance. You may request account deletion at any time at privacy@computor.at.

1. Controller and legal bases

Graz University of Technology, Rechbauerstraße 12, 8010 Graz, Austria (“TU Graz”, “we”), is controller for computor.at, including sign-in, Git and workspaces. The Institute of Theoretical Physics – Computational Physics, Petersgasse 16, 8010 Graz, operates the service. Contact privacy@computor.at or datenschutz@tugraz.at. The data protection officer is x-tention Informationstechnologie GmbH, Friedhofstraße 57, 4600 Wels, datenschutzbeauftragter@tugraz.at.

The service fulfils TU Graz's statutory teaching, continuing education and science communication tasks. Necessary processing, including secure operation, relies on Art. 6(1)(e) GDPR with §§ 2 and 3 Universities Act 2002; Art. 32 GDPR requires appropriate security. Legally required disclosures rely on Art. 6(1)(c) GDPR, including reports under Articles 16–18 DSA where applicable. Accepting the Terms of Use is not data protection consent or permission for arbitrary future processing.

An account requires a verified email address and password; without these you cannot sign in. The minimum account age is 14. We delete a younger person's account when we learn of it.

2. Data, purposes and visibility

Area	Data and purpose	Who sees the data
Account	Email, username, provided name, password hash, internal ID, terms acceptance and last sign-in; for access and account messages. Passwords are not stored as readable text.	Operations staff; teachers and tutors see their course participants' names and usernames.
Courses and submissions	Enrolments, groups, code and other submissions, Git history, test results, points, feedback and timestamps; for exercises, support and learning-progress/test-error overviews.	Course teachers and tutors; other learners only for designated group work. Submissions are not public.
Hosted workspaces	Files, running processes, start/stop times; for the programming environment on our servers. Home files remain when it is stopped.	Technical operations access; content access where necessary for operation, recovery, support or security.
Course messages	Messages with revision history and timestamps; for communication and support.	The relevant audience, not every course participant by default.
Lena	Questions, selected text, assignment/thread context and answers; for learning assistance described below.	Only you for button requests; the thread's audience for messages.
Support and reports	Email, contact details, descriptions, chosen attachments and technical details such as application, version, page or command; for handling and replying.	Support staff; requests and attachments are not published automatically. A reviewed summary without personal data may appear in the public GitHub issue tracker.
Access and security	IP, time, requested resource, size, status, browser/OS and referring page, account or workspace identifiers where applicable, login events, administrative actions and diagnostics; for fault/attack detection, availability and secure operation.	Technical operations and security roles, limited to their role and the stated operational and security purposes.

Technical server access serves operation, troubleshooting and abuse prevention through the designated operations and security roles. Tests and points are computed automatically but do not decide grades. The responsible teacher assesses work; there is no solely automated decision with legal or similarly significant effects under Art. 22 GDPR.

Lena: “Ask Lena” sends your question, selected text and visible assignment. In course messages you may mention @lena and reply in the thread. With automatic routing enabled, learner messages mentioning nobody else are also addressed to Lena when it is available and within the audience; a visible mention is added. Processing includes the message and earlier thread, plus the assignment, your latest submission and its tests for assignment messages. The reply is stored in that thread with the same audience. Lena neither executes code nor decides grades.

Current Lena inference runs on TU Graz machines in Austria without an external AI provider, additional content logs or model training on your data. Bounded memory and disk caches reuse computations; learners cannot access them. Entries are replaced for capacity or cleared, without a fixed time expiry. Numeric size, status and timing measurements contain no questions, submitted text or answers.

3. Locations and additional ways of working

Platform data are processed in Germany and Austria. We operate the platform services ourselves. Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, provides servers, storage and backups in Nuremberg and Falkenstein as a processor under Art. 28 GDPR. TU Graz operates learning assistance and service administration in Austria. Section 4 explains deletion of recovery copies. Email notifications use the TU Graz mail server. Authorities and courts receive data only when legally required or for legally specified serious-offence reports. Fonts come from our servers; no external advertising, tracking, analytics, content-delivery or AI services are embedded in the current web pages.

We do not sell your data or use it for advertising or model training.

Device-local computation and storage differ from upload, sync, submission and hosted processing. New purposes, recipients or transfers are explained before introduction as required by law; this notice is not blanket consent for them.

4. Retention and deletion

Data	Period or deletion rule
Account, course data, submissions, repositories, results, home files and course messages	Until account deletion, handled across the services involved. Leaving a course or archiving an account is not deletion.
Lena button request	At most 15 minutes, removed on completion.
Lena button answer	24 hours, retrievable only by the requester.
Lena thread answers and inference caches	Threads follow course-message retention; caches follow the capacity rule in section 2.
Web and scanner access logs	Daily rotation with 14 archived files, including empty log files; this is not a fixed 14-calendar-day limit.
Diagnostics and technical security records	Depending on the service, size-based rotation (often five files of 10 MB each) or no automatic age deletion; no uniform period.
Sign-in service login and administrator events	Login events 30 days, detailed administrator events 90 days, separately from diagnostic logs.
Technical attack blocking	Scanner ban history 35 days; related log files keep four weekly archived rotations of nonempty files.
Support and reports	Until closure, then at most three years for traceability and defence of claims.

Evidence needed for a specific security incident or legal obligation is separately restricted to that purpose and the period it requires.

For accounts unused for 24 months, we give reasonable advance warning of deletion by email; signing in then keeps the account. Longer contractually agreed warning periods remain unaffected. Deletion requests also cover sign-in, Git, workspaces and file storage. If specific data must remain for a concrete legal reason, we explain the reason and period and restrict them to that purpose.

Backups: We retain backup copies of personal platform data for no longer than 30 days.

5. Cookies and security

We use functional cookies and local browser storage for sign-in, session protection and your chosen appearance, without advertising or analytics cookies. Technically necessary storage falls under § 165(3) TKG 2021 and does not require a cookie banner.

Function	Duration
Sign-in and protection for account and workspace sessions	Session, or until sign-out/expiry.
Platform access token / renewal token	One hour / seven days.
Chosen light/dark appearance	Until you clear local browser storage.

Browser settings control storage; session cookies are necessary for sign-in. Web access uses TLS and user programs run in separate containers with resource limits. Report vulnerabilities confidentially to security@computor.at.

6. Rights and changes

Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction and portability. You may object to public-interest processing on grounds relating to your particular situation (Art. 21 GDPR). You may request an export separately from the narrower statutory portability right; the terms also promise export when services are restricted or discontinued.

Write to privacy@computor.at or datenschutz@tugraz.at, preferably from your registered address so we can identify you securely. We normally respond within one month and explain any legally permitted extension within that time (Art. 12(3) GDPR). You may complain to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.