AI in We Are Learning

This document provides IT security and compliance teams with a detailed overview of how We Are Learning uses artificial intelligence within its platform. It covers model selection, data handling, infrastructure, and governance — the information typically needed for vendor security assessments and AI risk evaluations.
​

We Are Learning is an interactive learning platform. AI is used in five distinct areas, each serving a different user type.
​

Content authors use the Script Assistant to draft, refine, and iterate on scripts for interactive learning scenarios. The AI assists with text generation, suggestions, and rewrites within the authoring tool.

User type: Content creators (authenticated, named users)
Data involved: Script text, scene context, creator prompts
Model: GPT-5.4 Chat via Microsoft Azure AI Foundry
Data persistence: Creator content is stored as part of the Story in our platform database
​

Learners can engage in open-ended, contextual conversations with AI-powered characters during a learning experience. These conversations are scoped to the learning content configured by the Creator. Learner input in Open Response nodes is processed in real time for two purposes: matching the response against possible outcomes defined by the Creator using embedded search, and reformulating text-to-speech (TTS) so that the response fits the context of the learning scenario.

User type: Learners (end-users)
Data involved: Learner messages (input), AI responses (output)
Model: GPT-5 mini via Microsoft Azure AI Foundry
Data persistence: AI sub-processors do not retain input or output data. Conversation logs are stored by We Are Learning as part of the learner’s completion record, as described in sections 4.3 and 4.4.
​

Creators can translate scripts and learning content into multiple languages directly within the platform.

User type: Content creators
Data involved: Source text, translated output
Model: GPT-5 mini via Microsoft Azure AI Foundry
Data persistence: Translations stored as part of the Story content
​

AI-generated voiceovers for characters, enabling creators to produce spoken content without recording studios.

User type: Content creators
Data involved: Script text (input), audio files (output)
Provider: ElevenLabs / Microsoft Azure AI Foundry
Data persistence: Generated audio files stored as Story assets in Azure Blob Storage
​

AI Studio lets creators generate short avatar videos: a We Are 3D character or an uploaded image is animated using uploaded recording or AI voice. The animation (image-to-video) is performed by the VEED Fabric 1.0 model hosted on Fal AI GPU infrastructure.

User type: Content creators
Opt-in: AI Studio is a separately activated, paid add-on. No data is sent to Fal AI unless the customer has activated AI Studio and a creator generates a video.
Data involved: A synthetic character image and a synthetic AI-generated voice track (inputs); the generated video file (output).
No personal data by design: Creators are instructed at the point of upload to use synthetic or rights-cleared characters and not to upload identifiable real people without consent.
Provider: Fal AI (US-based) — see privacy policy and sub-processors: https://www.wearelearning.com/legal/subprocessors
Data persistence: Media files processed by Fal AI are automatically deleted from Fal AI’s systems within 6 hours (configured media expiration). The finished video is transferred to our platform and stored permanently as a Story media asset in Azure Blob Storage (EU).
​

We access GPT-5 through Microsoft Azure AI Foundry rather than directly through OpenAI. This means:

All API traffic stays within our Microsoft Azure tenant
Microsoft’s enterprise data protection commitments apply (including the Data Protection Addendum)
No customer data is used by Microsoft or OpenAI to train, retrain, or improve AI models
Processing occurs within Azure’s EU data centers
Azure’s compliance certifications (ISO 27001, SOC 2, etc.) cover the AI Foundry service

Fal AI is a specialized inference platform for generative media models and acts as our sub-processor for AI Studio avatar video generation.

Security posture: SOC 2 Type II certified (report published April 2026), with regular penetration testing
Hosting: Google Cloud Platform, US-based infrastructure
Retention: Input and output media are automatically deleted from Fal AI within 6 hours; long-term storage happens only in our EU-based Azure environment.
Training: Customer inputs and outputs are not used to train or improve models.

We confirm that no input or output data from any customer’s use of the platform is used to train, fine-tune, or improve any AI model — neither by We Are Learning nor by our sub-processors (Microsoft Azure AI Foundry, ElevenLabs, Fal AI).

This is guaranteed through:

Microsoft Azure AI Foundry enterprise terms (data processing opt-out by default, plus abuse-monitoring retention exemption)
ElevenLabs enterprise agreement
Fal AI service terms (no training on customer inputs or outputs)
Our own Data Processing Agreement with customers

Some AI-related data is stored in Azure Cosmos DB and Azure Blob Storage, both within our primary Azure region (Norway East), with geo-replication to our disaster recovery region (EU West / Amsterdam).

Specifically:

AI Conversation logs (learner input/output): Stored as part of the learner’s completion record. Available to the customer organisation through reporting and analytics.
Generated scripts and translations: Stored as part of the Story content.
Generated audio files: Stored as Story media assets.
AI Studio videos: Stored as Story media assets in Azure Blob Storage.
Retention: Data is retained for the duration of the customer contract. Upon contract termination, data is deleted per our exit procedures (data return available upon request, followed by permanent deletion with written confirmation).

The following data is collected about learner interactions with AI-powered features:

Conversation transcripts (input and output)
Completion status and interaction timestamps
Aggregated analytics (e.g. number of conversations, average length)

This data is:

Accessible to the customer organisation (the tenant) through the platform’s analytics and reporting
Not accessible to other tenants or customers
Not used by We Are Learning for any purpose other than delivering the service to that customer
Subject to GDPR data minimization principles — we collect only what is necessary for the learning experience and reporting

Creator/Learner (Browser)
│
▼
Vercel Edge (CDN/SSL)
│
▼
Azure App Services / Functions (Backend)
│
├──▶ Azure AI Foundry (GPT-5.4 / GPT-5 mini)
├──▶ ElevenLabs API (TTS)
├──▶ Fal AI API (AI Studio avatar video)
├──▶ Langfuse (LLM tracing)
├──▶ Azure Cosmos DB (data storage)
└──▶ Auth0 (authentication/SSO)

We Are Learning operates as a data processor under GDPR
A Data Processing Agreement (DPA) is provided to all customers
Sub-processors are listed at wearelearning.com/legal/subprocessors
Right to erasure (Article 17) is supported
Data Protection Impact Assessments (DPIAs) have been conducted for AI features

No automated decision-making: AI Conversations are informational/educational — no automated decisions are made about learners based on AI output
Human oversight: All AI-generated content (scripts, translations, voiceovers, avatar videos) is reviewed by a content creator before publishing
Transparency: Learners interacting with AI Conversations are aware they are engaging with an AI character; avatar videos feature clearly synthetic characters
Content safety: AI Conversations are scoped and guided by the creator’s learning content, limiting off-topic or inappropriate responses

Q: Which AI models and providers do you use?
We use GPT-5.4 Chat and GPT-5 mini for language AI features, accessed through Microsoft Azure AI Foundry (not directly through OpenAI). Text-to-Speech is provided by ElevenLabs and Microsoft Azure AI Foundry. Avatar video in AI Studio is generated by Fal AI (VEED Fabric 1.0). Azure, ElevenLabs, and Fal AI operate under enterprise agreements.

Q: Are different models used for learners vs. content creators?
Yes. Script Assistant uses GPT-5.4 Chat via Azure AI Foundry, while AI Conversations and Translation use GPT-5 mini via Azure AI Foundry.

Q: How is input/output data from learner AI conversations handled?
Conversation data is stored in our Azure Cosmos DB database in Norway East (EU). It is available to the customer organisation through analytics and reporting. It is not shared with other customers or used for any purpose beyond delivering the service.

Q: Can you confirm that no data from our use of the platform will be used to train AI models?
Yes. No input or output data generated by any customer or learner is used to train, fine-tune, or improve AI models — by We Are Learning, Microsoft, OpenAI, ElevenLabs, or Fal AI. This is contractually guaranteed through our enterprise agreements with all AI sub-processors.

Q: What statistics or aggregated data is collected about learner activity?
We collect completion status, interaction timestamps, conversation transcripts, and aggregated usage metrics (e.g. number of conversations, average duration). This data is accessible only to the customer organisation that owns the tenant. We Are Learning does not use individual learner data for any purpose other than service delivery.

Q: Where is AI processing performed?
Language AI goes through Azure AI Foundry in Azure’s EU data centers. Text-to-Speech is processed by ElevenLabs’ EU infrastructure or Microsoft Azure AI Foundry. AI Studio avatar video generation is processed by Fal AI using US infrastructure. All stored data resides in Azure Norway East with DR replication to EU West (Amsterdam).

For questions about AI usage, data handling, or to request additional documentation:

Security: [email protected]
Sub-processor list: wearelearning.com/legal/subprocessors
Legal page: wearelearning.com/legal