Privacy Policy

Who we are

CodeCogs is a trading name of Zyba Ltd (ZYBA LIMITED), a company registered in England and Wales, company number 5190331, VAT number GB 891 5952 78. Our registered office is Broadwood, Holford, Bridgwater, Somerset [[TODO: confirm the registered office postcode — TA5 1DU on invoices and in the Terms of Use, N19 5GU in the site footer]], United Kingdom.

• Data protection contact: email support@codecogs.com with “Privacy” in the subject, or use the contact form. [[TODO: name a data protection lead or Data Protection Officer, if one is appointed]]
• ICO registration number: [[TODO: ICO data protection fee registration number]]
• EU representative (Article 27 EU GDPR): [[TODO: name one, or remove this line if not required]]

Controller and processor

Data protection law asks who decides why and how personal data is used (the controller) and who handles it on their behalf (the processor).

• We are the controller for the data we collect for our own purposes: your account on this website, licences and billing, messages you send us, security and usage logs, and the advertising on our home page.
• We are a processor when a school, college, university or other organisation uses our tools in its own systems — through the LTI tool in its learning platform, a plugin in its own editor, or fxEditor built into its own site. The organisation is the controller, and we use the data only to provide the service it has asked for, on its instructions. In the United States, for an educational institution, we act as a “school official” with a legitimate educational interest under FERPA, under the institution's direct control as to how the data is used. See Student Data Privacy.
• An organisation that holds a licence is responsible for its own users' equations, quizzes and notes kept in My Home, and for anything it chooses to put in them.

If your school or employer gave you access to one of our tools, questions about your data are best put to them first; we will help them answer.

What we collect

Accounts, organisations and licences

• Your details: first and last name, email address and, if you give it, a phone number.
• Your organisation: its name, postal address, country and postcode, the website domain a licence covers, and who in it is an administrator or member.
• Signing in: we do not use passwords. You sign in with a single-use link we email to you, or with a passkey. For a passkey we store only its public key, an identifier, a usage counter, the kind of connection it uses, a name you can give it and when it was last used — never a fingerprint, face or other biometric, which stays on your device. If you sign in to our Office add-in with a Microsoft account, we receive your name, email address and Microsoft account and organisation identifiers from Microsoft.
• Licences: the licence, its domain and key, its dates, its usage allowance, and for add-in licences which members hold a seat and the identifier of each device the add-in is used on.
• Trials and free licences: the name, email address, company, domain and country you sign up with, and for trial and Sandbox sign-ups the IP address the request came from. For the free academic licence: your name, school or university email address, institution, and optionally your department and learning platform.
• Your session: while you are signed in, a session record holds your account details and the IP address of the session.

Payments

Payments are taken by Stripe. Your card details are entered into Stripe's own form and go straight to Stripe; they never reach our servers and we never see or store them. We keep the amount, tax, the Stripe reference for the payment and subscription, and the invoice we send you. Stripe receives your email address and your organisation's name and address so that it can take payment and calculate tax.

My Home and quizzes

• The equations you save, with their names, descriptions, links, tags and variables, and which member of your organisation saved or changed them.
• The quizzes you write. Students who answer a quiz you put online sign in with a candidate number and code you give them; we do not ask them for their names or anything else about them. We keep their answers and marks against that number, with any note you choose to add, until you reset the quiz or take it offline.

Messages and feedback

• The contact form sends us your name, email address, any phone number or company you give, and your message, by email. It is not stored on this website.
• Ratings and comments left through the editor's feedback box are kept, with an email address if you choose to give one, and the browser's description of itself (its “user agent”). Comments, and our replies, may be shown on our public feedback page; email addresses are not.
• If you are a customer, we may send you emails about your licence (renewal reminders, failed payments, invoices) and occasional announcements about our products, each with a link to unsubscribe. We record whom each announcement was sent to, and unsubscribes.

Equations and the rendering service

When a web page shows an equation from our rendering service (fxTeX Server, at fxtex.codecogs.com or latex.codecogs.com), the reader's browser asks our servers for it. For each request we record:

• the time, the kind of image or markup asked for, and whether it was served;
• the equation itself (its first 200 characters of LaTeX);
• the website it was shown on, taken from the address the browser sends with the request (the “referrer”), or the licence it was made under;
• the reader's IP address, anonymised before it is written: the last part of the address is removed (the last of four numbers for IPv4; everything after the first three groups for IPv6), so it identifies a network, not a person's device.

We use these records to run and protect the service (rate limits, abuse, faults), and to count how much each licensed site uses. Each day they are totalled into a count of equations per site, and a count of distinct visitors per licence made from a one-way scrambled (hashed) form of the anonymised address. The rendering service sets no cookies and does not record the reader's browser details.

When a licensed site or app downloads the editor or fxTeX Pro files from fxtex.codecogs.com, we record the time, the file, the IP address it was downloaded to and whether it was matched by licence key or by domain, to count usage against the licence. [[TODO: these download records currently keep the full IP address, unlike the render records — anonymise them as the render records are, or keep this sentence]]

fxTeX and fxTeX Pro convert equations in the reader's own browser and do not send them to us.

The editor and plugins on other websites

fxEditor and our plugins run inside someone else's website or system: what is done with the content you write there is up to that site. The editor and plugins load their files from our servers and insert equations as images or MathML; they do not send us anything about you. Some optional features send the equation being worked on to our own services to do their job: equation suggestions and picture recognition (fxpredictor.codecogs.com), and graphs (fxcode.codecogs.com). [[TODO: state what, if anything, fxpredictor and fxcode log about each request, and for how long]]

The editor remembers your preferences, such as whether to show the LaTeX, in your own browser (see Cookies).

The LTI tool for learning platforms

Our LTI 1.3 tool (lti.codecogs.com) lets teachers insert equations into course content in Canvas, Blackboard, Brightspace, Schoology, Moodle and other platforms. It is registered asking for no personal data: no names, email addresses or class lists, no grades, and none of the LTI Names and Roles or Assignment and Grade services. A launch from the platform still carries:

• an opaque user identifier the platform makes up, and the user's roles (for example “Instructor”);
• the course (context) identifier, and the details needed to return the equation to the right place in the course;
• the platform's own identifiers: its issuer address, client id and deployment id.

These are kept only for the editing session, and deleted automatically within at most 24 hours. They are used only to return the equation to the platform and to count the use against the institution's licence. The institution's licence is tied to its platform registration (issuer, client id and deployment id), and we log usage per deployment — a count, not who used it. If a platform is set to send names or email addresses anyway, they are not used, and are deleted with the session. The equation (its LaTeX) is rendered by our rendering service, described above, and placed in the course page.

This website

• Server logs. Our web servers log requests, including the IP address, browser details and address requested, to keep the site running and secure. Our front servers keep only requests that failed.
• Abuse protection. To stop automated sign-ups and spam we briefly keep a count of requests from each IP address for sign-in, feedback and similar forms, and use Google reCAPTCHA on the contact, purchase and enterprise forms (see who else sees it).
• Advertising. Our home page shows Google ads; no other page does. See Cookies.
• Analytics. Our home page, product pages and documentation use Google Analytics to count visits and see which pages are used. Account, sign-in, checkout and admin pages do not. In the UK, EEA and Switzerland it sets no cookies unless you agree. See Cookies.

Why we use it

Under UK GDPR and EU GDPR we need a lawful basis for each use. Where we act as a processor, the institution we act for decides the basis.

We do not sell personal data, use it for advertising or profiling outside our own home page (and the visit statistics Google Analytics gives us), or make decisions about anyone by automated means that have legal or similar effects. We do not use your equations or anyone's data to train AI models. [[TODO: confirm — check fxpredictor's use of submitted equations]]

Who else sees it

We use these service providers (sub-processors), each under a contract that limits what they can do with the data:

The editor, rendering, suggestion, graph and LTI services are our own, run on the same Vultr servers. We may also disclose data when the law requires it, to protect our rights or users' safety, or to a buyer of our business, who would be bound by this policy.

International transfers

We are based in the United Kingdom, and our servers are in the United States (New York). Data collected from the UK, the EEA and elsewhere is therefore transferred to and stored in the United States. We protect these transfers with [[TODO: the safeguard used — e.g. the UK International Data Transfer Addendum and EU Standard Contractual Clauses in Vultr's Data Processing Agreement; confirm it has been accepted]]. Stripe, Microsoft and Google transfer data under their own published safeguards.

How long we keep it

Cookies

The rendering service and the LTI tool's server set no tracking cookies. You can clear or block cookies in your browser; the site works without the preference cookies, but you will need them to stay signed in.

Children

Our tools are used in schools, but we do not knowingly collect personal data directly from children. Accounts on this website, and the free academic licence, are for teachers, lecturers and older students [[TODO: minimum age — e.g. 13 in the US and UK, 16 where required in the EEA]]. Students taking an online quiz give only the candidate number their teacher assigned; the LTI tool asks the learning platform for no personal data. Where a school uses our tools with children, the school is responsible for any consent needed and we act on its behalf as a processor. In the United States, a school may consent on parents' behalf under COPPA to the use of our tools for the school's educational purposes, and we act as a school official under FERPA. See Student Data Privacy. If you believe a child has given us personal data, tell us and we will delete it.

Security

All our sites and services are served only over encrypted connections (HTTPS); we hold no card details and no passwords; access to our systems and customer data is limited to the people who run them. The Security page describes our measures in more detail, including what we do not yet do. If we become aware of a breach affecting your personal data we will tell you, and the Information Commissioner's Office where the law requires, without undue delay.

Your rights

Under UK GDPR and EU GDPR you can ask us to:

• give you a copy of the personal data we hold about you (access);
• correct it — you can change most of your details yourself in the licence manager;
• delete it, where we have no legal reason to keep it;
• restrict or object to our using it, including for direct marketing at any time;
• give it to you, or another provider, in a portable format;
• withdraw consent you have given, such as for advertising cookies.

Email support@codecogs.com. We will reply within one month. Where we are processing data for your school or employer, we will pass your request to them and help them answer it. Residents of US states with privacy laws (such as California) have similar rights, and we will honour them the same way; we do not sell or share personal information for cross-context behavioural advertising outside our own home page.

If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the UK Information Commissioner's Office, or to the data protection authority where you live or work.

Changes to this policy

We will post any change on this page and update the date at the top. If a change materially affects how we use personal data we already hold, we will tell customers by email before it takes effect, and institutions we act for as a processor in line with our agreement with them.