Privacy Policy

Data controller

The data controller for personal data is the operator of teachthemall.com. You can contact the controller at [email protected].

Data we collect

We collect the following personal data:

• Email: required for registration and authentication.
• Name: encrypted in the database. Used to personalize the experience.
• IP address: hashed (non-reversible). Used exclusively for security and abuse detection.
• Usage data: interactions with the platform (sessions, progress, modes used). Used to improve the service and personalize learning.

Legal basis

• Consent: for registration on the platform and processing of data necessary to provide the service.
• Legitimate interest: for service security, abuse prevention and platform improvement.

Purpose of processing

• Provision of the AI tutoring service.
• Security: detection of unauthorized access and abuse prevention.
• Continuous improvement of the service and user experience.

Data processors

To provide the service, personal data may be processed by the following providers (data processors):

• Anthropic, PBC (USA) — AI chat conversation processing. International transfer with Standard Contractual Clauses (SCCs).
• OpenAI, Inc. (USA): Processing of AI tutor queries and educational content generation. Legal basis for international transfer: Standard Contractual Clauses (SCCs) and EU-US Data Privacy Framework.
• Google LLC (USA): Processing of AI tutor queries as an alternative provider. Legal basis for international transfer: Standard Contractual Clauses (SCCs) and EU-US Data Privacy Framework.
• Resend, Inc. (USA) — Transactional email delivery. SCCs.
• Cloudflare, Inc. (USA) — Hosting, CDN, database. EU data centers available. SCCs.

Data sent to AI (Anthropic)

When you use the AI tutor, the following data is sent to Anthropic to generate responses:

• User messages in chat sessions.
• Pedagogical context (level, learning style, course concepts).
• Course document fragments (RAG — Retrieval Augmented Generation).

This data is processed exclusively to generate educational responses and is NOT used to train AI models.

Data retention

The specific data retention periods are:

• Account data: while account is active + 30 days after deletion request.
• AI chat conversations: while account is active.
• Login attempts: 90 days.
• Analytics events: 365 days.
• Security logs: 180 days.
• Password reset tokens: 24 hours.

User rights (GDPR)

As a user, you have the right to:

• Access: obtain confirmation of whether your data is being processed and access it.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your personal data.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to the processing of your data in certain circumstances.
• Restriction: request restriction of your data processing.

How to exercise your rights

You can exercise your rights in the following ways:

• Access and portability: from Profile > "Export my data".
• Erasure: from Profile > "Delete my account".
• Rectification: from Profile > edit personal data.
• Objection/Restriction: email [email protected].

If you believe your rights have not been properly addressed, you may file a complaint with the Spanish Data Protection Agency (aepd.es).

Processing of minors' data

In accordance with the Spanish LOPDGDD (Art. 7), minors aged 14 to 17 may consent to the processing of their personal data. TeachThemAll implements the following protective measures for minors:

• No marketing communications or profiling for marketing purposes (DSA).
• The AI adapts its tone and content for minors, avoiding inappropriate material (EU AI Act — minors as a vulnerable group).
• The date of birth is stored encrypted with AES-256-GCM. The legal guardian's email, if provided, is encrypted with the same standard.
• The legal guardian is notified of the minor's registration, but their consent is not required for account creation (LOPDGDD Art. 7).

Cookies and local storage

This website does not use cookies. Authentication and user preferences are stored in the browser via local storage (localStorage), strictly necessary for the service to function. No third-party, advertising or tracking cookies are used. We use PostHog (EU Cloud, Frankfurt) as a product analytics tool to understand platform usage and improve the service. PostHog does not share data with third parties and all data is processed within the European Union.

International transfers

Data may be transferred to providers located in the USA (see Data processors section). All international transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of data protection.

Delete my account

If you do not have access to the app, you can request account deletion from the public page: Delete my TeachThemAll account (web form).

More on our use of AI

To understand what we generate with artificial intelligence, how we do it and what you decide as a teacher, see our AI transparency page.