1. Data controller
The controller of the data processed through AIKI is Isidro Álvarez Jiménez (Spain). You can contact us regarding privacy at info@aikitutor.com.
2. What data we process
- Parent or guardian account: name, email and password (encrypted).
- Child profile: name or nickname, age/date of birth and avatar. We do not request more of the child's data than necessary.
- Educational activity: the child's questions, answers, progress, levels and learning metrics.
- Technical data: session cookies, IP address and device data necessary for operation and security.
- Payments: handled by the payment provider (Stripe). We do not store full card details.
- Voice dictation (microphone): the chat with the teacher includes an optional microphone button. Its use is always on demand: the microphone is only activated when the child presses the button to speak.
When the child uses the microphone, the speech-to-text transcription is performed by the device's own browser through its speech recognition service (for example, Google's on Chrome/Android or Apple's on Safari); that browser or operating-system provider may process the audio on its servers under its own policies. AIKI does not record or keep that audio: we only receive and process the already transcribed text, just as if it were a typed message. Recommendation for families: if you do not want this processing, simply do not use the microphone button; the chat works normally by typing.
3. Purpose
- Provide the educational service and adapt learning to the child's age.
- Generate progress reports and safety alerts for parents.
- Manage the account, subscription and support.
- Ensure security, prevent abuse and comply with legal obligations.
We do not use children's data for advertising purposes or to train third-party AI models.
4. Legal basis
- Performance of the contract (art. 6.1.b GDPR) to provide the contracted service.
- Consent (art. 6.1.a) of the holder of parental authority for processing the child's data.
- Legitimate interest (art. 6.1.f) in security and the prevention of improper use.
- Legal obligation (art. 6.1.c) where applicable.
5. Minors and parental consent
AIKI is aimed at children aged 6 to 17 and is always used under a parent or legal guardian account. In accordance with the LOPDGDD, processing the data of children under 14 requires the consent of the holder of parental authority or guardianship, which is obtained when the child's profile is created. The adult can review, edit or delete the child's data at any time.
6. Retention
We retain data while the account is active. If you delete a child's profile or your account, the associated data is permanently erased, except for data we must retain by legal obligation (for example, invoicing) for the required periods.
7. Recipients and data processors
We do not sell or transfer data. To provide the service we work with providers that act as processors:
- AI provider (language models) to generate the educational answers.
- Hosting and infrastructure (hosting of the application and the database).
- Payments: Stripe.
- Email (notifications, password recovery, reports and communications): Resend.
Each processor handles the data only according to our instructions and with the guarantees of the GDPR.
8. Email communications
We send two kinds of email: (i) operational emails necessary for the service (account verification, password recovery, the child's progress reports and safety alerts) and (ii) informational or news communications, which we only send if you have given us your prior consent.
- Delivery and open metrics: to check that our emails arrive and are useful, we include a tracking pixel (an invisible image) that tells us whether the email has been opened and from what type of device, as well as links redirected through our own domain that record whether you click on them.
- How we use them: in aggregate form, to measure the effectiveness of our communications and improve them. Never to build advertising profiles or with children's data.
- Legal basis: performance of the contract and our legitimate interest in measuring and improving the service's communications (art. 6.1.b and 6.1.f GDPR); for commercial communications, your consent (art. 6.1.a).
You can disable these communications and withdraw your consent at any time via the “Unsubscribe” link or the preferences page included in every email, without needing to log in. The email provider (Resend) acts as a data processor.
9. International transfers
Some of our processors handle data outside the European Economic Area (mainly in the United States). In those cases we apply adequate safeguards under the GDPR: the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework. Specifically: the AI provider (Anthropic, USA) under Standard Contractual Clauses; payments (Stripe) and email (Resend) under the Data Privacy Framework; and the hosting of the application and database (Railway, Vercel). You can request information about or a copy of these safeguards by writing to the contact email.
10. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time:
- From the app itself (download or deletion of the child's data in one click).
- By writing to info@aikitutor.com.
If you believe we have not properly handled your request, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
11. Security
We apply appropriate technical and organizational measures: encryption in transit (HTTPS), hashed passwords, sessions with httpOnly cookies, per-family access control and content moderation to protect the child.
12. Affiliate program (influencers)
AIKI runs an affiliate program through which creators (influencers) recommend the service in exchange for a commission. In that context we process:
- Affiliate data: identity, email, declared social media and tax details (tax ID and address), to manage the sign-up, calculate and pay commissions and comply with tax obligations.
- Attribution data: when someone reaches AIKI through an affiliate's link (the “aff” parameter), we store that attribution linked to the account that registers, in order to calculate the corresponding commission.
Legal basis: performance of the contract with the affiliate (art. 6.1.b GDPR), our legitimate interest in measuring attribution (art. 6.1.f) and tax-related legal obligations (art. 6.1.c). We do not share any personal data of the families they refer with affiliates: they only see aggregate figures of their own activity (sign-ups, active clients and commission).
13. Changes to this policy
We may update this policy to reflect legal or service changes. We will publish the current version on this page with its update date.