Privacy Policy

Last updated: 27 July 2026

At Aulify we take the protection of your personal data seriously. This Privacy Policy explains what information we collect, why we process it, the legal basis we rely on, who we share it with and what rights you have, in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE).

1. Data controller

• Owner: Aulify (trade name)
• Contact: hello@aulify.app

2. Data we process

2.1. Data you provide

• Account: depending on the sign-in method you choose, we receive:
  • Sign in with Google: your email address, name and profile picture.
  • Sign in with Apple: your name and the email address you choose to share, including Apple's private relay address if you decide to hide your real email.
  • Email and password: your email address and a password stored only as a secure hash. New accounts must confirm their email address through a verification link before they can use the service.
• Language preference: the interface and teaching language you choose during onboarding.
• Study material: documents, images or text you upload to generate your subjects and topics.
• Personalisation instructions: tone, language or special guidance you add when creating a topic.

2.2. Data generated by using the service

• Generated content: mini-lessons and exercises created from your material.
• Progress and gamification: completed exercises, exercises you have hidden, strength of each exercise, knowledge points, daily streak and current topic.
• Preferences: topics or curiosity cards you mark as liked or not interesting, used to tailor suggestions.
• Usage metrics: number of topics created per day (to apply the daily free limit), mini-lessons completed, last activity date and daily message volume (anti-abuse protection described in the terms).

2.3. Technical data

• IP address, browser type, operating system and session identifiers.
• On the iOS app, basic device and app version information needed for stability.
• Error logs and basic telemetry to keep the service stable.

2.4. Voice, audio and images

• Voice dictation: handled entirely by your device or operating system. We never receive or store the audio.
• Read-aloud (text to speech): only the lesson text is sent to the speech provider to generate audio; no recording of you is involved.
• Photos you upload: stored in a private bucket, used only to generate your content and automatically deleted within 24 hours.

We do not collect card or payment data, precise location, contacts, voice recordings, biometrics or special category data. We do not track you across other companies' apps or websites.

3. Purposes and legal bases

4. Retention periods

• Account and content: for as long as your account remains active.
• Archived or hidden subjects, topics or exercises: until you delete them permanently.
• Uploaded photos: maximum 24 hours.
• After account deletion: data is erased within a maximum of 30 days, unless a legal retention obligation applies.
• Technical logs: 90 days.

5. Recipients and processors

To provide the service we share strictly necessary data with the following providers, all of them bound by data processing agreements under art. 28 GDPR:

• Supabase / Lovable Cloud — database hosting, authentication and storage (European Union).
• AI model providers (Google Gemini, OpenAI) — text and image processing to generate mini-lessons, exercises and covers. Only the fragments needed for each generation are sent.
• Google (Sign in with Google) — account authentication. We only receive the basic profile data you authorise.
• Apple (Sign in with Apple) — account authentication on the iOS app and the web. We only receive your name and the email address (real or private relay) you choose to share.
• Transactional email provider — account confirmation, verification links, essential notifications and, where consented, re-activation emails.
• Google Ads (website only, after cookie consent) — measuring the effectiveness of our own advertising campaigns. Not used in the iOS app.
• Wikimedia Commons — public illustrative images shown with their source attribution. No personal data of yours is sent.

We do not sell or transfer your data to third parties for commercial purposes.

6. International transfers

Some providers may be located outside the European Economic Area (EEA). In those cases we ensure transfers are covered by appropriate safeguards: European Commission adequacy decisions or Standard Contractual Clauses (SCC).

7. Your rights

As a data subject you have the right to:

• Access: obtain confirmation of processing and a copy of your data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: delete your data when no longer necessary.
• Restriction: limit processing in certain cases.
• Portability: receive your data in a structured, commonly used format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent at any time, without retroactive effect.
• Not be subject to automated decisions with significant legal effects.

You can delete your account directly from your profile inside the app, use the rights request form, or write to hello@aulify.app. We reply within one month. If you believe your rights have not been properly handled you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

8. Security

We apply appropriate technical and organisational measures: encryption in transit (TLS), encryption at rest, role-based access control, activity logging, regular backups, private storage buckets with signed time-limited URLs, and row-level security (RLS) policies so each user can only access their own content.

9. Minors

Aulify is intended for people aged 16 or over, the age at which article 7 of the LOPDGDD allows valid consent for the processing of personal data in digital services. It is not designed for children under 16. Aulify has no technical means to reliably verify the age of a user who registers: when signing up, the user declares under their own responsibility that they meet the age requirement. If we have reasonable evidence that an account belongs to a child under 16, we will suspend it and delete the associated data. Parents or legal guardians may request erasure at any time by writing to hello@aulify.app.

10. Artificial intelligence

Aulify uses generative AI models to create mini-lessons, exercises and covers from your material. Generated content may contain errors and should not replace professional advice. Uploaded material is also automatically screened to block content that breaches our community rules. The material you upload and the answers you give are sent to the AI providers listed in section 5 solely to provide the Service, and are not used to train third-party AI models for commercial purposes.

11. Payments

Aulify is currently offered free of charge, with a limit of 10 new topics per day. We do not collect or store payment data. Should paid features be introduced in the future through Apple In-App Purchase, the transaction and any billing data would be handled entirely by Apple under its own privacy policy; we would only receive the status of your subscription.

12. Cookies

For more information about cookies and similar technologies we use, see our Cookie Policy.

13. Changes to this policy

We may update this policy to reflect legal, technical or service changes. The current version is always published on this page with the last update date at the top. The July 2026 update added Sign in with Apple, email and password sign-up with email verification, the iOS application, local voice dictation, read-aloud, automated content moderation and the removal of paid plans.