The platform runs in an EU region, and participant assessment data is stored there. Some service providers may process data outside the EEA, including the AI model vendors (Anthropic and OpenAI) and the email provider.
Stima does not use assessment data to train or fine-tune any AI model, its own or a third party's, and the model vendors are contractually barred from training on what participants send. Stima does create de-identified data, which no longer identifies anyone, and uses it to operate, calibrate and improve the service, including to design and test its own rubrics, prompts and evaluation sets, and for aggregate research it may publish: no participant, customer, role or course is identified, and no individual session is published. Research on a session record that still identifies the participant needs that participant's explicit consent. In a course, no de-identified data is created and no research is done unless the institution has signed a Research Annex. Stima does not sell participant data.
The session, the report and the evidence behind them are kept for 12 months after the campaign or assignment closes, or 24 months with extended retention, then deleted; a legal hold placed by the customer suspends deletion. The decision record (every scoring run, review action and dispute) is kept for three years, and the participant's acceptance and consent records for as long as the session is kept and three years after. A session record a participant agreed to share for published research is kept until they withdraw. De-identified data is kept indefinitely.
FERPA-aligned for campuses, DPA on request, built to WCAG 2.1 AA. Every retention period is in the Privacy Policy.