Privacy policy

1. Who is responsible

PATH is made by Daniel Fernández Barreiros, self-employed (autónomo), NIF 54225836R, Santiago de Compostela, Spain. For anything about your data: privacy@yourpath.io. There is no data protection officer because the law does not require one for this activity. If your academy uses PATH, the people who run it on PATH see what your teacher sees.

2. What we keep

Only what the homework needs to work and the teacher needs to know how you are doing:

• Your account: name and surname, email, date of birth, phone, address and ID number if you give them at sign-up, English level, language and role (student, teacher or academy). Under 14, a parent's or guardian's name and email.

• Your homework: what you answered on each question, whether you were right first time, how many tries, how long each answer took, and the texts you write with their mark and comments. When nearly every answer in an exercise goes in within a few seconds, PATH flags it in the results the teacher sees. The flag uses timing only, never appears on your screen, and the teacher decides what to do with it.

• What you write to the teacher: the reflections you leave when correcting an exercise, and class chat messages with their attachments.

• Your voice, only if you turn it on: Speaking recordings in class, who spoke and the transcript; audio from the placement test and the level test. The section "Your voice" says what happens to each.

• Payments: handled by Stripe. PATH keeps your customer id, what you paid and the invoices. We never store card numbers.

• Live class, calendar and notifications: when you join and leave the video class, for the register (video is not recorded); your class events, only if you connect Google Calendar; your device identifier, only if you turn on phone notifications.

• Operations: when something breaks, an identifier for your account and the technical details of the error. To measure page speed, the page visited and the browser, without your name.

3. Why, and on what legal basis

Each use has a basis in the GDPR:

• Providing the service you signed up for: marking, showing results to the teacher, billing and service notices. Basis: contract.

• Showing the teacher how long you took and the burst flag. It is part of marking homework remotely. Basis: contract, and the teacher's legitimate interest in knowing the work is yours. You can object by writing to us; the teacher will then know.

• Recording and transcribing your voice. Basis: your consent, or your guardian's if you are under 14. You give and withdraw it in account settings; without it, Speaking does not record and the rest of PATH works as normal.

• Sending copies of homework, invoices and appointments to your family's email, if you gave one. Basis: contract.

• Issuing and keeping invoices. Basis: legal obligation (four years).

• Security, errors and abuse. Basis: legitimate interest.

• Analytics cookies. Basis: your consent, in the banner.

4. Artificial intelligence: what goes where

PATH writes its exercises with AI; nothing of yours is sent for that. Your data is sent in these cases. Your written texts, for the mark and comments (Anthropic, US); the teacher can change them and, for homework, you do not see the mark until the teacher releases it. Classroom Speaking transcripts, with the names of who spoke, for assessment (Anthropic, US); the audio is transcribed by Google Vertex AI (EU). Your live voice in the placement interview and Speaking Lab (OpenAI, US). Level test audio, for transcription (AssemblyAI, US). The teacher's notes on your progress, with personal details blanked before they leave (Anthropic). We use the paid versions of these services, whose terms do not let them train their models on your data; they use it only to return the result to us. AI gives marks and comments but makes no decision with legal effect on you: a teacher can always change them, and one exercise mark never decides your level or your place on its own.

5. Who processes data for us, and where

In the European Union: Vercel (web servers and file and audio storage, Paris), MongoDB Atlas (database, Paris), Google Vertex AI (transcription and pronunciation, EU multi-region) and Sentry (platform errors, Germany). In the United States, under the European Commission's standard contractual clauses or the EU–US Data Privacy Framework: Clerk (accounts and sign-in), Stripe (payments; also operates from Ireland), Resend (invitation, consent, invoice and report emails), LiveKit Cloud (the video class: live audio and video, not recorded), Google Firebase (phone notifications, which carry the message text), Anthropic, OpenAI and AssemblyAI (as in section 4) and Mapbox (address autocomplete at sign-up). On a worldwide network: Ably (chat and live presence; a UK company). With no data of yours: ElevenLabs (synthetic voice for questions). If you connect Google Calendar, Google receives your class events. The cookie banner is run by Usercentrics and analytics by Google Tag Manager, only if you accept them.

6. Who sees your data inside PATH

Your teacher sees your results, your timings, your texts and what you write when correcting. If the teacher works in an academy, the people who run the academy on PATH see the same. If you gave a family email, it receives copies of homework, invoices and appointments. The other students in your class see your name in the chat and the live class.

7. Your rights

Under the GDPR you can:

• Ask for your data and receive a copy.

• Correct wrong or incomplete data.

• Erase your data.

• Restrict what we do with it.

• Take it with you in a machine-readable format.

• Object to uses based on legitimate interest.

• Withdraw a consent at any time, without affecting what was done before.

From account settings you can download or delete your data without asking us. Without an account, at yourpath.io/data-rights or by writing to privacy@yourpath.io. We reply within a month of confirming it is you. If you think we are getting it wrong, you can complain to the Spanish Data Protection Agency (aepd.es).

Your voice

Speaking, the placement test and the level test record your voice. This is what happens to each recording.

Classroom Speaking audio is transcribed and assessed for pronunciation by Google Vertex AI (EU); the transcript, with the names of who spoke, goes to Anthropic (US) for assessment. In the placement interview and Speaking Lab you talk live to an OpenAI model (US). Level test audio is transcribed by AssemblyAI (US).

Your voice is biometric data (Article 9 GDPR). We process it only with your explicit consent, or your parent's or guardian's if you are under 14. You give and withdraw it in account settings. Without consent, Speaking does not record and the rest of PATH works as normal.

Recordings are stored in Vercel Blob, in Paris. Services outside the EU work under the European Commission's standard contractual clauses; none of them trains its models on your voice.

Classroom Speaking recordings are deleted after 90 days; the transcript and marks stay with your homework. Placement test audio is deleted when the score is computed; the transcript stays. Level test audio is deleted after 90 days; the transcript and the assessment stay. If you delete your account, your recordings are deleted at once.

You can withdraw voice consent at any time from settings; from then on nothing is recorded. To delete a specific recording earlier, write to privacy@yourpath.io.

8. Under 14

We ask for the date of birth at sign-up. Under 14, PATH asks for a parent's or guardian's name and email and sends them a link to give consent. You can use PATH for 14 days from that email; after that, exercises pause until consent is given. If your academy already holds your family's signed consent, it confirms it. Recording your voice needs a separate consent from your guardian. We keep who consented, when and from which device.

9. How long we keep things

Your account and homework, while the account exists. Voice recordings, as the section "Your voice" says. Invoices, four years as the law requires, then anonymised. If you delete your account from settings, we erase at once your account, homework, attempts, review cards, level tests, Stripe customer and recordings, and blank what you said in Speaking and what you wrote in the chat. We keep a record of the request (email and date) to show we handled it.

10. Cookies

Without your permission we only use the cookies PATH needs to work: language, session and a 90-second note at the end of sign-up. Analytics (Google Tag Manager) and session recording for debugging (Sentry, never on the public pages) run only if you accept them in the banner. You can change that at any time from the banner.

11. Security and changes

Everything travels encrypted (TLS) and access to data is limited by role. If we change anything important in this policy, we tell you by email or inside PATH.

12. Contact and complaints

For any question or complaint about your data, write to privacy@yourpath.io. You can also complain to the Spanish Data Protection Agency (aepd.es).