Version 1.3 · Last updated 8 October 2026
Provider: NUADU Holding Pte. Ltd. | Contact: privacy@nuadu.com
Purpose: disclosure of the AI systems used on nuadu.com under EU AI Act Art. 50 and GDPR Art. 13 and 22.
1. AI Systems on nuadu.com
The live demos use Microsoft Azure AI services. Text models are OpenAI-family GPT models deployed on Azure AI Foundry (Azure OpenAI); speech is analysed by Azure AI Speech; uploaded documents are read by Azure AI Document Intelligence. OpenAI, Inc. has no access to data processed through these deployments; Microsoft is the sole processor.
| Demo | URL | Service and model | Input | Output | Oversight |
|---|---|---|---|---|---|
| Content Scanner | /demo/content-scanner | Azure AI Document Intelligence (prebuilt-layout) reads uploaded images; Azure OpenAI, GPT-4.1 mini generates the questions | Text, or an image of a document | Four exam questions (three multiple-choice, one short-answer) with Bloom's level and answer key; the extracted text | Demo only |
| Writing Grading | /demo/writing-grading | Azure OpenAI, GPT-4.1 mini | Essay text | Rubric-anchored draft scores (argument, evidence, grammar, vocabulary, coherence), CEFR estimate and written feedback | Demo only; in institutional use the marker reviews, overrides and signs |
| Speaking Grading | /demo/speaking-grading | Azure AI Speech (speech-to-text); Azure OpenAI, GPT-4.1 mini scores the transcript | Audio recording | Recognised text; rubric scores (fluency, coherence, grammar, vocabulary, task response), CEFR estimate and feedback | Demo only; see the audio disclaimer shown above the microphone |
| Pronunciation Check | /demo/pronunciation | Azure AI Speech (pronunciation assessment) | Audio recording | Word- and phoneme-level pronunciation feedback | Demo only; see the audio disclaimer shown above the microphone |
All text demos use the Azure OpenAI deployment gpt-41-mini-lp (model gpt-4.1-mini, version 2025-04-14). The model version is pinned (automatic version upgrades are disabled); changes are tested before release and recorded in the internal change log.
2. Data Flow
Your browser ──Turnstile check──▶ Cloudflare
│
├─ text / image ──▶ NUADU server functions (Cloudflare Workers) ──▶ Azure OpenAI / Document Intelligence (Sweden Central, EU) ──▶ result ──▶ your browser
│
└─ audio (streamed, temporary 10-min token) ──▶ Azure AI Speech (Sweden Central, EU) ──▶ recognised text (+ pronunciation scores) ──▶ your browser
speaking demo only: recognised text ──▶ NUADU server functions ──▶ Azure OpenAI ──▶ rubric scores ──▶ your browser| Data | Stored by NUADU? | Stored by Microsoft? | Purpose |
|---|---|---|---|
| Submitted text or image | No | Azure OpenAI: not stored, unless flagged for potential abuse (see the Privacy Policy, Section 6); Document Intelligence: up to 24 hours, then deleted automatically | Abuse monitoring; asynchronous document analysis |
| Submitted audio | No | No — processed in real time by Azure AI Speech; audio logging is off | — |
| Recognised speech (speaking demo) | No | As for the submitted text (Azure OpenAI) | Abuse monitoring |
| AI scores and feedback | No | As for the submitted text | Abuse monitoring |
| NUADU's system prompts | No (runtime only) | As for the submitted text | Abuse monitoring |
| Your email (demo gate) | Yes, 2 years (website database and CRM) | No | Demo access; see Privacy Policy |
| Hashed IP address and request time (rate limiting) | Yes, 24 hours | No | Abuse protection; usage limits |
| Turnstile token | No | n/a (Cloudflare) | Bot protection |
No training on your data. Microsoft does not use prompts, completions, audio or documents to train or improve any Microsoft or third-party model. This is a binding commitment under the Microsoft Products and Services DPA.
3. Data Residency
All AI processing for the nuadu.com demos runs in one Azure region in the EU, Sweden Central, using a regional deployment that does not route prompts to other regions. Requests reach Azure through NUADU's server functions on Cloudflare's network; see the Privacy Policy, Section 7. The NUADU assessment platform hosts data on Microsoft Azure in the region each customer requires; EU residency is the default, and regions in use include West Europe, North Europe, Sweden Central, Poland Central and France Central (see nuadu.com/trust).
4. Processor Chain for AI Processing
NUADU Holding Pte. Ltd. (controller for nuadu.com) ├── Microsoft (processor) — Azure OpenAI, Azure AI Speech, Azure AI Document Intelligence │ └── Microsoft sub-processors per the Service Trust Portal └── Cloudflare, Inc. (processor) — website hosting and server functions (Workers), Turnstile bot protection
OpenAI, Inc. is not in this chain. The current Microsoft sub-processor list is available at the Microsoft Service Trust Portal.
5. EU AI Act
Transparency (Art. 50). NUADU discloses AI involvement through this notice, through "Results generated by AI" labels on every demo, and through the audio disclaimer above every microphone control.
Classification (Annex III, point 3(b)). AI systems intended to evaluate learning outcomes are high-risk under the Act. This applies to NUADU's AI assessment capabilities when they are used in institutional settings. The public demos are demonstration tools: their outputs are not used for grading, progression or any decision with legal or similarly significant effect, and users are told the results are illustrative.
NUADU's posture — EU AI Act-ready. Human oversight, logging and documentation are built into the platform workflow: every AI output is logged and reviewable; AI prepares evidence and proposes; a named educator or approver decides and signs; every override is recorded. "EU AI Act-ready" describes these controls. It is not a certification claim, and NUADU does not claim to be "EU AI Act certified" or "compliant".
Status of formal obligations (as of 8 October 2026; updated here when it changes):
- Risk management system, data governance and technical documentation (Art. 9–11): in preparation
- Conformity assessment (Art. 43): in preparation
- Registration in the EU database (Art. 49): in preparation
- Machine-readable marking of AI-generated output (Art. 50(2)): in preparation
Allocation in institutional deployments. The Institutional Agreement allocates obligations between NUADU (provider) and the Institutional Client (deployer):
| Obligation | Responsible |
|---|---|
| Risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11) | NUADU |
| Record keeping and logging (Art. 12) | NUADU and the Institutional Client |
| Transparency to deployers (Art. 13) | NUADU |
| Human oversight in operation (Art. 14) | Institutional Client, using the review, override and sign-off capability NUADU provides |
| Accuracy, robustness, cybersecurity (Art. 15) | NUADU |
| Conformity assessment (Art. 43), EU database registration (Art. 49) | NUADU |
6. Automated Processing (GDPR Art. 22)
The demos produce automated scores without human intervention. For demo users these are informational and non-binding and have no legal or similarly significant effect.
In institutional deployments no decision about a named learner is taken solely by automated means: the marker reviews, may override and signs every result, and the platform records who decided what and when. A learner may contest an AI-assisted result through the institution's appeals process, or by writing to privacy@nuadu.com; NUADU responds within one month.
7. Limitations and Accuracy
- Accuracy: models can mis-score, miss errors or give irrelevant feedback. No output is definitive without human review.
- Bias: models can reflect biases in their training data and may treat some dialects, non-native speakers or writing styles less fairly. NUADU monitors for this and adjusts prompts and rubrics; monitoring results are available on request.
- Language: performance varies by language and domain; English inputs are the most reliable.
- Audio: speaking and pronunciation scores depend on microphone quality and background noise.
- Scope: each demo assesses specific dimensions (structure, grammar, pronunciation) and not the full range of communicative competence.
Governing principle: AI prepares the evidence; a named educator decides.
Opting out: AI processing is integral to the demos; if you do not want your content processed by AI, do not submit it. In institutional deployments, opt-out mechanisms are set in the Institutional Agreement.
8. Information Requests
Data subjects and institutional deployers may request: the model versions in use, the categories of system prompts (not the proprietary text), bias-monitoring results, the DPIA summary, and the current status of the formal EU AI Act obligations in Section 5. Write to privacy@nuadu.com; NUADU responds within one month.
9. Updates
This notice is updated when models, services, processors or regulatory obligations change. Material changes are communicated to registered demo users and Institutional Clients. The version and date are in the header.