Safety and privacy
C1 Ai is a spoken AI tutor used mostly by children. This page sets out, in one place, how we protect them. The binding texts are our privacy policy and terms.
1. Who can use it
- Only adults (18 or over) can create an account. Adults may study for themselves.
- A child studies only in a profile inside a parent's or guardian's account. At sign-up the adult confirms they are 18 or over and, for any child they add, that they are the child's parent or guardian and consent to the child's data being processed for the lessons. The date and version of that consent are recorded.
- Before a child can be added or a lesson started, the adult confirms their email address through a link we send to it (a reasonable check under GDPR Art. 8(2) that the consent comes from the parent). Sign-in with Apple or Google counts as confirmed, since those providers have verified the address.
- There is no way for a child to create an account or to start a lesson without one: our server refuses it.
- Parents set limits per child: a daily time limit, a bedtime window, microphone on or off, slower speech and captions.
2. What the AI tutor does, and does not do
- It says it is an AI. The lesson screen always shows "you are talking with an AI, not a person" in the child's language (EU AI Act, Art. 50), and the tutor says so if asked.
- It keeps to the lesson. Its instructions forbid asking for personal details such as an address or school, steer away from topics unsuitable for children, and, if a child says they are being harmed, tell the child to speak to a trusted adult or call 112.
- It teaches, it does not judge. Marks, progress stars and quiz results are feedback for practice. They have no legal or similarly significant effect and are not used to decide anything about a child (GDPR Art. 22).
- No emotion recognition. The child's voice is turned into text so the tutor can answer. We do not infer feelings, mood or stress from the voice, face or words (prohibited in education by EU AI Act Art. 5(1)(f)). The teacher character's expressions are animations chosen for the lesson, not a reading of the child.
- Anything can be reported. Every lesson has a Report button; reports reach us with the last turns of the conversation so we can review them.
3. Where data goes
| Our servers | Hetzner, Helsinki (Finland, EU). Nightly encrypted backups in Germany, kept for at most 8 weeks. |
|---|---|
| Live voice | Google Gemini through Google Cloud Vertex AI, in the EU region europe-north1 (Finland), under the Google Cloud terms and data processing addendum. We do not use the consumer Gemini API, whose terms exclude services for under-18s. On this paid service Google does not use the data to train its models. |
| Text tasks | Anthropic Claude (following the lesson, marking answers, homework, quizzes), used in line with Anthropic's guidance for organisations serving minors: AI disclosure, child-safety instructions, and a way to report content. Anthropic's commercial API does not train on this data by default. Anthropic may process outside the EU under standard contractual clauses or the EU–US Data Privacy Framework. |
| Voice recordings | Not stored. The lesson transcript is kept while the account exists. |
| Uploaded books and photos | Private to the account that uploaded them; read on our own server where possible. |
| Access to our systems | The admin dashboard needs an allow-listed account with two-step verification; the database is not reachable from the internet; the server accepts SSH keys only. |
| Advertising, profiling, selling data | None. |
| Usage statistics | Anonymous; nothing is stored on the device for them (no cookies). |
4. Deleting data
A child's profile, or the whole account with all its data, can be deleted at once from Settings → Privacy and data. A copy of all data can be downloaded there too. Deleted data leaves our backups within 8 weeks.
5. Risk assessment
We have carried out a data protection impact assessment (GDPR Art. 35) covering children's data, voice and the use of AI, together with a record of processing activities (Art. 30). It covers, among others: the AI providers' terms for services used by children, training on children's data, inappropriate AI output, data leaving the EU, loss of data, consent that does not come from a parent, and the EU AI Act (transparency, emotion recognition, and the rules for AI in education that apply from December 2027). We review it whenever the service changes; a summary is available on request.
6. Contact
Questions, concerns or a report about a child's data: support@c1ai.org. You can also complain to the Cyprus Commissioner for Personal Data Protection.