Privacy Policy
This policy explains what personal data C1 Ai processes, why, and your rights under the EU General Data Protection Regulation (GDPR). The data controller is Ediz Veli Tuncay, Gialousas Street, Engomi, 2414 Nicosia, Cyprus. Contact: support@c1ai.org.
1. Data we process
- Parent account: name, email address, a salted hash of the password (never the password itself) or, if you sign in with Google or Apple, the account identifier they give us, the date you accepted these terms and gave consent, trial and subscription status.
- Child's lesson data: only a parent or guardian (18 or over) can create an account, and a child uses C1 Ai only through their parent's account, with the parent's knowledge and the consent given at sign-up. We process the first name and age you enter, the lesson conversation (what the tutor said and the child's typed or transcribed answers), lesson progress, homework and quiz results.
- Uploaded documents: the text of the pages you upload (for example school-book pages), read so the tutor can teach from them. Uploading needs an account: documents are visible only to the account that uploaded them and are deleted with it.
- Reports: if you use the "Report" button in a lesson, the reason, your note and the last few messages of the lesson are sent to us so we can check what happened.
- Voice: when the microphone is used, the child's voice is streamed to our AI provider in real time to hold the conversation. We do not store voice recordings.
- Payments: handled entirely by Paddle, our Merchant of Record. We never see or store card details; we receive only the subscription status and a Paddle customer reference.
- Technical data: IP address and timestamps, used for security and abuse protection (rate limiting) and kept for a short period.
- Anonymous usage statistics: while the app is open we count visits, active time, the screens reached, the interface language, the device type (mobile/desktop), the referring website and the country. The country is derived from the IP address, which is then discarded; a visit is recognised only by a random number held in the page's memory while it is open, and nothing is stored on your device for it. No cookies, no advertising or cross-site tracking. The same statistics (country, duration, lesson topic) are kept for lessons and account sign-ups. Country data by DB-IP.
2. Why, and on what legal basis
- To provide the lessons and your account (performance of the contract, Art. 6(1)(b) GDPR).
- Processing of a child's data is based on the consent of the parent or guardian given at sign-up (Art. 6(1)(a) and Art. 8 GDPR). You can withdraw consent at any time by asking us to delete the account.
- Security and abuse prevention, and anonymous usage statistics to improve the service (legitimate interest, Art. 6(1)(f) GDPR).
- Invoicing and tax records, kept by Paddle (legal obligation).
We do not sell personal data, do not show advertising, and do not use children's data for profiling or marketing.
3. Who processes data for us
- Google (Gemini): the tutor's real-time voice, and backup for text tasks.
- Anthropic (Claude API): the AI for text tasks (following the lesson, marking answers, homework and quizzes, reading uploaded pages).
- Hetzner Online GmbH: hosting, in Helsinki, Finland (EU).
- Cloudflare: domain name services.
- Paddle: payments, as Merchant of Record.
Some of these providers may process data outside the EU. Where they do, the transfer is covered by that provider's data processing terms, which rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.
4. How long we keep data
Account data, the children's lesson data and uploaded documents are kept while the account exists. You can delete the account and all of this data at once, immediately, under Settings → Privacy and data → Delete account; or write to us from the account's email address and we delete it within 30 days. Lesson statistics that no longer identify anyone are kept for 400 days. Encrypted backups of the database are kept for at most 8 weeks on a separate server in the EU (Hetzner, Germany), so deleted data also disappears from the backups within that time.
- Anonymous visit statistics: 400 days.
- Reports from the lesson screen: one year, or until the account that sent them is deleted.
- IP-based rate-limit records: 24 hours.
- Server logs, which include IP addresses: rotated automatically and kept for a few days at most.
- Password-reset and email-verification links: deleted 7 days after they are used or expire.
Lesson data on the device itself (browser storage) is deleted when you clear it. Paddle keeps invoicing records as required by tax law.
5. Your rights
You can ask for access to, correction, deletion or a copy of your and your child's data, restrict or object to processing, and withdraw consent, by writing to support@c1ai.org. You also have the right to complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or the authority in your country.
6. Children
The service is used by children only through an account created by their parent or guardian. If you believe a child's data was provided without that consent, contact us and we will delete it.
7. AI in lessons: scores, and no emotion recognition
The tutor is an artificial intelligence, and the lesson screen always says so (EU AI Act, Art. 50). Marking of answers, the progress stars and homework and quiz results are produced automatically to guide practice. They are for information only: they have no legal or similarly significant effect on you or your child (Art. 22 GDPR) and are not used to make any decision about your child. You can ask us to review any result.
We do not recognise or analyse emotions. The child's voice is turned into text so the tutor can answer; we do not infer feelings, mood or stress from the voice, the face or the words, and no voice recording is stored. The teacher character's expressions on screen are animations chosen for the lesson, not a reading of the child.
8. Risk assessment
We have carried out a data protection impact assessment (Art. 35 GDPR) covering children's data, voice and the use of AI, and we review it when the service changes. A summary is available on request.