Where the data lives
Everything is stored on servers inside the EU. Account and learning data sits in MongoDB Atlas; voice recordings are held in Amazon Web Services (AWS S3) in Ireland. All data is encrypted in transit over HTTPS/TLS.
For schools · Data & privacy
How we handle your students' data
A plain-English summary for school owners and academic coordinators — where student data lives, who can see it, how long we keep it, and the rights everyone keeps. For the full legal detail, see our Privacy Policy.
What we store
A student's account details (name, email, and date of birth to confirm the minimum age), their learning progress and the grammar mistakes we tag, their submitted writings, and — only with their explicit consent — voice recordings for speaking practice.
How long we keep it
Account and learning data is kept until the student deletes their account, plus 30 days in backups. Voice recordings are automatically deleted after 90 days, and a student can delete any individual recording at any time.
Who can see it
The student, the teacher(s) at your school they're assigned to, and LingoLugo staff when needed for support. We never sell student data and never use it for advertising.
AI marking & where it's processed
To draft a correction, a student's writing or speaking response is sent to be processed by AI — and that processing can happen in more than one place. Your school always has a choice: keep it within the EU, or run it entirely on our own in-house servers here in Lugo. Either way, your teacher reviews and edits every correction before the student sees it, and we won't use your students' work to train AI models or sell it to third parties.
Sub-processors
We rely on a small set of trusted providers: AWS (EU/Ireland) for storage, MongoDB Atlas for the database, and Stripe for payments. Where any data is processed outside the EEA, it's covered by Standard Contractual Clauses or the EU-US Data Privacy Framework.
Students and minors
In line with Spanish law (LOPDGDD), accounts are for ages 14 and above; under-14s require parental or guardian consent. Each student sets up their own free account and joins your class with a code — schools don't create accounts on students' behalf, so every student gives their own consent.
Everyone's rights
Students can request access to their data, correct it, delete it (the "right to be forgotten"), withdraw consent, and export it. Anyone who believes their data has been mishandled can complain to the Spanish Data Protection Agency (AEPD).
At a glance
- Hosting
- EU servers — MongoDB Atlas & AWS S3 (Ireland)
- Encryption
- HTTPS/TLS in transit
- AI processing
- Your choice — within the EU, or our in-house servers in Lugo
- Voice recordings
- Consent-based, auto-deleted after 90 days
- Account data
- Kept until deletion, +30 days in backups
- Minimum age
- 14 (LOPDGDD); under-14 needs guardian consent
- Supervisory authority
- Spanish Data Protection Agency (AEPD)
- Selling / ad-targeting
- Never
Book a 10-min demo
→
Questions about data or compliance? Email info@lingolugo.com — or read the full Privacy Policy.