1. Data controller
The controller of the data processed through AIKI is Isidro Álvarez Jiménez (Spain). You can contact us regarding privacy at info@aikitutor.com.
2. What data we process
- Parent or guardian account: name, email and password (encrypted).
- Child profile: name or nickname, age/date of birth and avatar. We do not request more of the child's data than necessary.
- Educational activity: the child's questions, answers, progress, levels and learning metrics.
- Technical data: session cookies, IP address and device data necessary for operation and security.
- Payments: handled by the payment provider (Stripe). We do not store full card details.
- Voice dictation (microphone): the chat with the teacher includes an optional microphone button. Its use is always on demand: the microphone is only activated when the child presses the button to speak.
- Documents the child attaches to the chat: on paid plans, the child can attach a PDF document —homework, a worksheet, a test— so their teacher can help them with it. We process its content, including the text and the images of its pages, for the sole purpose of answering the child's question about that document and checking that it is appropriate for their age.
- Photos and PDFs the adult uploads to have homework marked: from their dashboard, and only the adult account holder, may upload a photograph (up to three) or a PDF of a homework sheet or test belonging to their child so that AIKI marks it. We process its content — the printed question and whatever the child wrote by hand — for the sole purpose of reading it, marking it and producing the report returned to the adult.
When the child uses the microphone, the speech-to-text transcription is performed by the device's own browser through its speech recognition service (for example, Google's on Chrome/Android or Apple's on Safari); that browser or operating-system provider may process the audio on its servers under its own policies. AIKI does not record or keep that audio: we only receive and process the already transcribed text, just as if it were a typed message. Recommendation for families: if you do not want this processing, simply do not use the microphone button; the chat works normally by typing.
A school document can contain more data than the child realises: their full name, the name of their school and class, marks, or other people's details. That is why the document is never published or shared with anyone, cannot be downloaded from the application —not even by the adult, who can however see in their dashboard which document was sent and when—, is not used to train Artificial Intelligence models or for advertising purposes, and is kept only for a short period (section 6). We ask families NOT to upload medical, educational-psychology or diagnostic reports, or documents containing other people's personal data: they are not needed for the teacher to help with homework. If we detect such a document, we delete it.
Three things about this feature that we want stated with complete clarity. FIRST: the image IS NOT KEPT. It is processed in memory during the request and discarded; it is not saved on our servers, is not included in backups and cannot be seen again afterwards, not even by the adult who uploaded it. The only thing kept is text: the subject, the date, the sheet's title, the grade and, for each exercise, the question as read, what the child wrote, the correct answer and the explanation of its score. SECOND: this upload exists only in the adult's account and is protected by the parental-control PIN; the child's app has no camera and does not allow uploads of this kind. THIRD: the child sees their marked sheet in their own profile, inside the child's app: the grade, each exercise with what they wrote, the correct answer and an explanation written for them. What is NOT shown to them is the guidance addressed to the adult on how to help, which stays in the adult's dashboard only. The adult still decides whether a piece of homework is marked at all, and may delete any correction from their dashboard, at which point it also stops being available to the child.
A homework sheet may contain other people's data — a classmate's name, the school's or the teacher's. That is precisely why the image is not kept: it is discarded as soon as it has been read. We ask families not to upload documents containing unnecessary personal data of third parties, nor medical, psycho-educational or diagnostic reports: they are not needed to mark homework.
3. Purpose
- Provide the educational service and adapt learning to the child's age.
- Generate progress reports and safety alerts for parents.
- Manage the account, subscription and support.
- Ensure security, prevent abuse and comply with legal obligations.
We do not use children's data for advertising purposes or to train third-party Artificial Intelligence models.
4. Legal basis
- Performance of the contract (art. 6.1.b GDPR) to provide the contracted service.
- Consent (art. 6.1.a) of the holder of parental authority for processing the child's data.
- Legitimate interest (art. 6.1.f) in security and the prevention of improper use.
- Legal obligation (art. 6.1.c) where applicable.
5. Minors and parental consent
AIKI is aimed at children aged 6 to 17 and is always used under a parent or legal guardian account. In accordance with the LOPDGDD, processing the data of children under 14 requires the consent of the holder of parental authority or guardianship, which is obtained when the child's profile is created. The adult can review, edit or delete the child's data at any time.
6. Retention
We retain data while the account is active. If you delete a child's profile or your account, the associated data —including attached documents and their files— is permanently erased, except for data we must retain by legal obligation (for example, invoicing) for the required periods.
Documents the child attaches to the chat also have their own, shorter period: a document that is uploaded but never actually sent to the teacher is deleted after 24 hours, and a document that has been sent is deleted after 30 days. That deletion is carried out by an automatic daily process and does not depend on the family doing anything.
The photographs and PDFs the adult uploads to have homework marked have no retention period because they ARE NOT KEPT at any point: they are read and discarded within the same request. The text report resulting from that correction is stored, and lives as long as the child's profile does: it is deleted when that profile or the account is deleted, and it is included in the data download the adult can request in one click.
7. Recipients and data processors
We do not sell or transfer data. To provide the service we work with providers that act as processors:
- Artificial Intelligence provider (language models) to generate the educational answers.
- Hosting and infrastructure (hosting of the application and the database).
- Payments: Stripe.
- Email (notifications, password recovery, reports and communications): Resend.
Each processor handles the data only according to our instructions and with the guarantees of the GDPR.
8. Email communications
We send two kinds of email: (i) operational emails necessary for the service (account verification, password recovery, the child's progress reports and safety alerts) and (ii) informational or news communications, which we only send if you have given us your prior consent.
- Delivery and open metrics: to check that our emails arrive and are useful, we include a tracking pixel (an invisible image) that tells us whether the email has been opened and from what type of device, as well as links redirected through our own domain that record whether you click on them.
- How we use them: in aggregate form, to measure the effectiveness of our communications and improve them. Never to build advertising profiles or with children's data.
- Legal basis: performance of the contract and our legitimate interest in measuring and improving the service's communications (art. 6.1.b and 6.1.f GDPR); for commercial communications, your consent (art. 6.1.a).
You can disable these communications and withdraw your consent at any time via the “Unsubscribe” link or the preferences page included in every email, without needing to log in. The email provider (Resend) acts as a data processor.
9. International transfers
Some of our processors handle data outside the European Economic Area (mainly in the United States). In those cases we apply adequate safeguards under the GDPR: the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework. Specifically: the Artificial Intelligence provider (Anthropic, USA) under Standard Contractual Clauses; payments (Stripe) and email (Resend) under the Data Privacy Framework; and the hosting of the application and database (Railway, Vercel). You can request information about or a copy of these safeguards by writing to the contact email.
When the child attaches a document to the chat, that document is transmitted in full to the Artificial Intelligence provider (Anthropic, United States) so that their teacher can read it and to check that its content is appropriate, under the same safeguards indicated above (Standard Contractual Clauses) and without it being used to train models. The file is stored on the application server for the periods set out in section 6 and is not transmitted to any other recipient.
When the adult uploads a photograph or a PDF to have homework marked, that image is transmitted to the Artificial Intelligence provider (Anthropic, United States) so that it can be read, under the same safeguards stated above (Standard Contractual Clauses) and without being used to train models. To be clear: although we never store it, the image does travel to that provider, which processes it under the retention policy of its programming interface. It is not transmitted to any other recipient.
10. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability at any time:
- From the app itself (download or deletion of the child's data in one click).
- By writing to info@aikitutor.com.
If you believe we have not properly handled your request, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).
11. Security
We apply appropriate technical and organizational measures: encryption in transit (HTTPS), hashed passwords, sessions with httpOnly cookies, per-family access control and content moderation to protect the child.
12. Affiliate program (influencers)
AIKI runs an affiliate program through which creators (influencers) recommend the service in exchange for a commission. In that context we process:
- Affiliate data: identity, email, declared social media and tax details (tax ID and address), to manage the sign-up, calculate and pay commissions and comply with tax obligations.
- Attribution data: when someone reaches AIKI through an affiliate's link (the “aff” parameter), we store that attribution linked to the account that registers, in order to calculate the corresponding commission.
Legal basis: performance of the contract with the affiliate (art. 6.1.b GDPR), our legitimate interest in measuring attribution (art. 6.1.f) and tax-related legal obligations (art. 6.1.c). We do not share any personal data of the families they refer with affiliates: they only see aggregate figures of their own activity (sign-ups, active clients and commission).
13. Changes to this policy
We may update this policy to reflect legal or service changes. We will publish the current version on this page with its update date.