Privacy Policy
HAI-Co² is a research study run by TU Darmstadt's UKP Lab, not a commercial product or service. Its purpose is to collect human–AI co-construction interaction data for scientific research. This policy explains what personal data is collected when you take part, the legal basis for processing it, how it is used (including publication of anonymized data), the third parties involved, and your rights under the EU General Data Protection Regulation (GDPR). Taking part is voluntary. Because recording your sessions and publishing the resulting anonymized data are the very purpose of the study, consenting to both is required to participate; if you do not consent, you simply do not take part (no service is withheld). Only the e-mail updates below are optional.
Last updated: June 2026.
Who is responsible & legal basis
The data controller is the Ubiquitous Knowledge Processing (UKP) Lab, Department of Computer Science, Technical University of Darmstadt, Hochschulstr. 10, 64289 Darmstadt, Germany. For privacy questions you can reach the HAI-Co² research team (see Contact below).
We process your personal data on the basis of your consent (Art. 6(1)(a) GDPR), given through the in-app consent gate when you choose to take part. Because HAI-Co² is a research study whose purpose is data collection, consenting to the recording of your sessions and to the publication of your anonymized data for research is required to participate; these are inseparable from the study itself, not add-ons to an unrelated service. Consent is freely given in that participation is entirely voluntary and can be withdrawn at any time (with effect for the future). The e-mail updates opt-in is separate and optional.
What we collect
How we use your data
Session continuity. The AI agent reads your previous sessions to provide coherent, context-aware assistance when you return.
Scientific research & system improvement. Session data may be analysed to study human–AI co-construction and improve the framework.
Publication of anonymized data. As a core part of the study, anonymized data may be published in scientific venues and research repositories (see below).
We do not sell or license your data, and access to raw session content is limited to the HAI-Co² research team at TU Darmstadt's UKP Lab, except as described under third-party processing or where required by law.
Third-party AI processing
To generate responses, the content of your sessions (your messages and the shared workspace) is transmitted to third-party large-language-model providers (for example OpenAI, Anthropic, Google, or Mistral, depending on the model selected), which process it on our behalf to return a response.
These providers may process data on servers outside the European Economic Area (EEA); where this occurs, transfers are made under appropriate safeguards (such as the EU Standard Contractual Clauses). Each provider processes data under its own terms, and we transmit only what is necessary to fulfil your request.
For debugging and quality monitoring, session content may also be processed by an LLM-observability service; and if we investigate an issue you reported, a short excerpt of the relevant conversation may be stored in our issue tracker. These operational providers process the data only on our behalf.
Please do not enter sensitive data
Because session content is processed by third-party AI providers and may be published in anonymized form, please do not enter sensitive personal data, such as special categories under Art. 9 GDPR (e.g. health, religion, political opinions), passwords or credentials, or personal data about other identifiable people, into your conversations or artifacts. Only enter information you are comfortable having processed for research.
Anonymization & publication
Before any public release, data is anonymized so that it can no longer be attributed to you (direct identifiers are removed and pseudonymous codes are severed). Anonymized datasets and results may be published in scientific venues and released in suitable research repositories under an open license (e.g. CC BY-NC 4.0). Once data has been anonymized and published, it can no longer be withdrawn or deleted.
Data retention
Account data and session history are kept for the duration of the research project and for a reasonable period afterwards (typically no longer than two years after the end of the project), and are then deleted or anonymized. Activity logs are retained for up to twelve months. You may request earlier deletion at any time by contacting the research team.
Your rights
Under the GDPR you have the following rights. To exercise any of them, contact the research team.
Cookies and local storage
The application stores your authentication token in the browser's local storage solely to keep you logged in. We do not use advertising or analytics cookies. To protect registration and login from abuse we use Google reCAPTCHA, and Google Sign-In if you choose it; these Google services load their own scripts and may set their own cookies, governed by Google's privacy policy.
Email communications
If you opt in, we may e-mail you about new releases and research updates. You can opt out at any time by contacting the research team. We do not use your e-mail for advertising.
Contact
For any privacy-related questions or to exercise your rights, please reach out to the HAI-Co² research team.