# Privacy Statement *This statement explains which personal data are processed when you visit the TELucation website, use the regular search and use the optional AI summary. The website is publicly accessible and can be used without signing in. The AI summary is a voluntary additional feature; the regular search also works without it.* *Updated: 15 October 2026* ## 1. Controller and contact The controller responsible for data processing is Graz University of Technology (TU Graz), Rechbauerstraße 12, 8010 Graz, Austria. Please send questions about the content or technology of TELucation to [telucation@tugraz.at](mailto:telucation@tugraz.at) and data protection concerns to [datenschutz@tugraz.at](mailto:datenschutz@tugraz.at). The data protection officer of TU Graz is x-tention Informationstechnologie GmbH, Friedhofstraße 57, 4600 Wels, Austria, who can be reached at [datenschutzbeauftragter@tugraz.at](mailto:datenschutzbeauftragter@tugraz.at). ## 2. Visiting the website and technical server logs Whenever a TELucation page is visited, a file is downloaded or a search is made, the web server processes technical access data. This may include in particular the IP address and any forwarded IP information, date and time, the requested URL and URL parameters, HTTP method and status code, the amount of data transferred, browser and device information, the referring page and technical request identifiers. If search terms are transmitted as URL parameters, they may also be contained in the server logs. The logs serve secure and reliable operation, technical error analysis and the detection of malfunctions or abusive access. The regular server logs are deleted after 14 days. For backup copies, see section 7. ## 3. Regular TELucation search The regular search shows matching TELucation content with links and text excerpts. It requires no sign-in, no activation of the AI summary and no request to Microsoft Azure. The text entered for the search is processed to find matching content. If the search query is part of the URL, it may also appear in the server logs described in section 2, which are kept for 14 days. ## 4. Optional AI summary The AI summary is switched off by default. It can be explicitly activated in the search area and deactivated again at any time. While it is active, a search produces an AI-generated summary with source links in addition to the regular results. An AI summary may be incomplete or wrong; the linked original pages are authoritative. To create the AI summary, the search query and suitable text excerpts from the TELucation content are sent via a proxy on TU Graz infrastructure to Microsoft Azure AI services deployed in the Sweden region. The models used are GPT-5 mini for the summary and text-embedding-ada-002 for semantic search functions. As currently configured, the proxy does not pass on the direct IP address or any user identifier of the person making the request to the AI service. The search text itself may, however, contain personal data. Please do not enter any personal or confidential information in the search field. For internal, systematic quality control, TU Graz stores on its own infrastructure the search query, the text excerpts used for the answer (RAG context), the generated answer and related technical metadata, in particular the time of creation and technical identifiers. No user name and no chat history are kept for TELucation. Only authorised administrators have access to these quality logs. The records are deleted automatically after 24 months at the latest. They are not used to train AI models or to pass on individual user queries to research projects. Microsoft processes the transmitted content to provide the models and for security checks under the applicable contractual and technical terms. According to Microsoft’s published information, inputs and outputs are not used to train the base models. As part of its abuse monitoring, Microsoft may review inputs and outputs. ## 5. Setting stored in your browser If you choose to activate the AI summary, this is recorded in your browser’s local storage (localStorage) without any user identifier. The setting is limited to twelve months from activation and is then automatically reset to “deactivated”. You can deactivate the AI summary in the search area at any time. This storage serves solely to apply the setting you have chosen on later visits. It is not used to recognise you across websites or for personalised advertising. Deactivating the feature prevents future AI summaries but does not automatically delete quality logs that have already been created. As currently configured, the TELucation website uses no analytics or marketing cookies, no external tracking scripts and no embedded social media services. A cookie banner for obtaining tracking consent is therefore not provided. ## 6. Aggregated usage statistics and OER report To understand how TELucation content and the Open Educational Resources (OER) provided are used, TU Graz derives aggregated counts from server-side access records, for example the number of views of a page or downloads of a file. Search terms are not analysed for this report. The analysis takes place on TU Graz infrastructure; the statistics database stores no IP addresses, user identifiers or individual access events. The underlying server logs are deleted after 14 days. The anonymous, aggregated counts may be kept indefinitely for long-term documentation and the scientific OER report, provided that no conclusions about individual persons can be drawn. No personal profiling takes place. ## 7. Purposes, legal bases, recipients and retention The processing serves to provide a university information service, the regular and optional AI-assisted search, secure technical operation, systematic quality assurance of the AI summary and the production of anonymous usage statistics. The legal basis for these university tasks is Art. 6(1)(e) GDPR in conjunction with § 3 of the Austrian Universities Act 2002. Only authorised units of TU Graz and service providers engaged by TU Graz are involved in the technical provision, to the extent necessary. Microsoft Azure is used as the AI service for the optional AI summary. Backups of the TU Graz systems are made by the Central Computing Services (ZID) as part of the university infrastructure. *Retention at a glance* | Data or storage location | Retention | | --- | --- | | Technical nginx/server logs, including any search parameters they contain | 14 days | | EdTechRAG quality logs (question, context, answer, technical metadata) | Planned: automatic deletion after 24 months at the latest | | Local AI activation in the browser | 12 months from activation or until earlier deactivation | | Anonymous aggregated view and download counts | Indefinitely, as long as there is no personal reference | | Backup copies on ZID infrastructure | 14 days | | Any security/abuse logs on Microsoft’s side | Configured for data minimisation | International data processing: For regular model processing, the Azure models are deployed in the Sweden region. ## 8. Your rights and provision of data Where the legal requirements are met, you have in particular the right of access, rectification, erasure, restriction of processing and the right to object to processing under Art. 6(1)(e) GDPR. Please contact [datenschutz@tugraz.at](mailto:datenschutz@tugraz.at). Since TELucation is used without a user account and quality logs contain no direct user identifier, it may only be possible to a limited extent to attribute a request to a person. We are not obliged to collect additional identification data solely for the purpose of later attribution; where a record can be found using the information you provide, your request will be examined in accordance with the legal requirements. Use of the TELucation website is voluntary. Without a search query, the search cannot be carried out; without activating the AI summary, the regular search remains fully available. The AI summary does not make decisions with legal or similarly significant effects on individuals. You may also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, email [dsb@dsb.gv.at](mailto:dsb@dsb.gv.at), if you believe that personal data are being processed unlawfully.