Privacy Policy & AI Usage
Last updated: July 14, 2026 · Privacy by Design
1. Introduction & Commitment
At Belayfy, we treat privacy and personal data protection as a fundamental right. Our platform operates in strict compliance with the EU General Data Protection Regulation (GDPR) and Spanish data protection laws. Our architecture is built on the principle of data minimization: we only collect the information strictly necessary to connect students with verified teachers and provide pedagogical assistance.
2. Collected Data & Legal Basis
To provide our services, we process the following data based on your express consent and service contract performance:
- Identification & Contact Data: First name, last name, email address, and profile picture (or authentication via Google OAuth).
- Academic & Progress Data: Learning and teaching languages, diagnostic test results, booking history, and pedagogical scores (CEFR, fluency, grammar).
- Audio & Temporary Transcripts: In online lessons (Daily) or in-person lessons (voluntary browser recording), audio is captured only when both parties grant consent for the sole purpose of generating the lesson report.
3. European AI Act Policy & Human Supervision
Belayfy utilizes Artificial Intelligence technologies (via secure providers such as OpenRouter and AssemblyAI for transcription and linguistic analysis) under the EU's «limited risk AI» classification. Our core philosophy is:
«The teacher teaches, validates, and decides. AI assists, summarizes, transcribes, and proposes.»
AI never makes automated decisions with legal or definitive academic impacts. All AI-generated reports undergo mandatory review by your real teacher (Human-in-the-Loop), who edits, validates, or dismisses them before they are shared with the student. Furthermore, we guarantee that your data and audio are never shared publicly or used to train third-party public models.
4. Sub-processors & Infrastructure Providers
In compliance with Article 28 of the GDPR, to ensure the secure and reliable delivery of our technological service, we partner exclusively with infrastructure and artificial intelligence providers operating under strict Data Processing Agreements (DPA / EU Standard Contractual Clauses):
Core web application hosting and encrypted PostgreSQL database infrastructure.
Temporary encrypted object storage for in-person lesson audio recordings.
WebRTC infrastructure for online video classrooms and temporary cloud recording.
Specialized speech-to-text transcription and assistential AI models for drafting reports (zero data retention for public model training).
Transactional email service for double opt-in verification and booking alerts.
Product usage analytics that only activates if you accept the cookie banner. Not used for advertising or commercial profiling.
5. Data Retention & Deletion
Binary audio and video files are never stored indefinitely. Once the teacher validates and sends the pedagogical report (which becomes part of your permanent educational history), raw audio files are scheduled for automatic deletion from our cloud storage within the shortest window compatible with technical troubleshooting. You may always request immediate deletion or account anonymization.
6. Your GDPR Rights
As a user, you retain full control over your information. You have the right to:
- Access: Request and obtain a copy or export of your personal data and report history.
- Rectification: Modify and update your profile, languages, and contact details at any time.
- Erasure: Request complete deletion or anonymization of your account from our systems.
To exercise any of your rights or make privacy inquiries, please contact us at info@belayfy.com.