About this pilot

Where NAGchat runs and what happens to your data.

Terms, privacy, cookies and AI disclaimers — including outstanding legal matters

School and Chat are separate

School is for school accounts. Chat is for personal accounts without school login, a school profile or teacher rules. Even when the email address is the same, the two accounts have separate conversations, files and memories. School administrators cannot access the personal account. Chat administrators can see accounts and usage, but not conversation content. New personal accounts have a total AI allowance of about USD 1 until a Chat administrator approves them. Email addresses are not verified.

Who runs it and where

• NAGchat is a pilot developed and operated by one developer.
• The web application and database are hosted in Denmark. The servers are in Denmark.

The address

• NAGchat is available at nagchat.dk.

Data processing and AI answers

• Answers are generated through Mistral AI’s European API. EU routing alone is not evidence of GDPR compliance.
• When Mistral cannot answer (out of credit, overloaded or unreachable), the answer comes from GLM 5.3 Flash or DeepSeek V4.1 Flash through Melious instead (Germany; computed in Finland or Ireland). The answer then shows the model’s name. There is no signed processing agreement with Melious yet.
• At Mistral, Zero Data Retention is on and the setting that lets Mistral train on API calls is off (checked in the Mistral console on 19 October 2026). Agreements with all suppliers are not yet confirmed; see legal information.
• Web searches, in School and in personal Chat, go to Staan (Qwant/Ecosia, France), which keeps the search text for 25 months and can pass a search its own index cannot answer on to a US search provider.
• Scanned documents and photos are also read by Mistral AI in the EU.

Privacy and your data

• Conversations, files and memories are stored in the database in Denmark.
• Feedback includes a shared conversation only if you explicitly tick the box.
• Your teacher can see how many questions you ask in their subject and whether you have started an assignment – never what you write.
• The teacher can request a group overview of the class’s questions in the subject, based on at least 3 students. Questions are processed on the server and with AI; names are removed, and the summary is instructed not to quote questions. Small groups can still carry a risk of recognition; irreversible anonymisation is not guaranteed.

Security and access

• The database uses row-level security to keep each user’s content private.
• Chats, files and memories are encrypted in the database with a key per user, so backups hold no readable text. The key is on the same server, so this protects against database access and leaked backups, not against the developer.
• School IT can see usage and costs, not content.

Subprocessors and service providers

• Mistral AI (France): AI answers and document reading.
• Melious (Germany): AI answers when Mistral cannot answer, and model tests for selected accounts.
• Cloudflare (a US company): the HTTPS connection and tunnel to nagchat.dk. Cloudflare terminates TLS and can process traffic and connection data; the service is not end-to-end encrypted against Cloudflare.
• Staan (Qwant/Ecosia, France): web search.
• jsDelivr and cdnjs/Cloudflare: browser libraries for chat, maths and document viewing; they receive connection metadata such as your IP address.

Questions

Questions about the data processing agreement, security or operation are answered by the developer.