Privacy Policy

This Privacy Policy explains how TeleCetli Kft. ("we", "us") collects, uses, and protects personal data when you use the Teacher Service. We process personal data as a data controller under the EU General Data Protection Regulation (GDPR).

1. Data We Collect

1.1 Account data

• Email address, display name, and (optionally) preferred native and target language codes.
• Authentication identifier from Keycloak (a federated identity provider we operate).
• Hashed password if you sign up directly; OAuth identifier if you sign in via a social provider.

1.2 Learning content

• PDFs you upload, plus the extracted curriculum (sections, items, learning objectives).
• Free-text descriptions you provide to the "discuss with the teacher" onboarding flow.
• Your responses to exercises, scores, mastery state, and teaching-session transcripts.

1.3 Billing data

• Subscription tier, period start/end, cancellation state, minute balance, transaction history (kept by us).
• Full card details are not stored on our servers; they are held by Stripe, our PCI-compliant payment processor.

1.4 Technical data

• IP address, user-agent, request timestamps (for security and abuse-prevention).
• Anonymised performance metrics from Application Insights (Microsoft Azure).
• Cookie identifiers (see section 6).

2. Why We Process Your Data (Legal Basis under GDPR)

• Performance of contract (Art. 6(1)(b)): running the Service, processing your subscription, generating curricula, recording usage.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, abuse detection, security monitoring, service improvement, and aggregate analytics.
• Consent (Art. 6(1)(a)): non-essential cookies (analytics, functional preferences) — managed via the cookie banner and Cookie Settings page.
• Legal obligation (Art. 6(1)(c)): retaining accounting records as required by Hungarian and EU tax law.

3. Sub-processors

We share data with the following sub-processors strictly to deliver the Service:

We do not sell your personal data and do not share it with advertising networks.

4. Where Your Data Lives

Your account data, learning content, and billing records are stored in Microsoft Azure's West Europe region (Amsterdam) inside the European Union. Transfers to non-EU sub-processors (e.g. Anthropic for LLM inference) are governed by Standard Contractual Clauses (SCCs) approved by the European Commission.

5. How Long We Keep It

• Account data: as long as your account is active. Deleted within 30 days of account closure; encrypted backups expire within a further 90 days.
• Uploaded PDFs and topics: as long as you keep them in your library. You can delete them at any time.
• Teaching transcripts and exercise responses: retained while your account is active; anonymised aggregate metrics may persist for service improvement.
• Billing records: retained for 8 years as required by Hungarian accounting law (Act C of 2000).
• Audit logs and security telemetry: 13 months.

6. Cookies

We use three categories of cookies, all of which can be managed via the cookie banner or the Cookie Settings page:

• Necessary — keep you logged in, remember your cookie preferences, prevent CSRF. Always on; cannot be disabled.
• Functional — remember your locale and theme. On if you accept.
• Analytics — anonymised page-view counts via Application Insights. Off by default; on if you accept.

7. Your Rights (GDPR)

If your personal data is processed by us, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your account and all associated data.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — limit our processing of your data.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time for processing that relies on consent (e.g. analytics cookies).
• Complain to a supervisory authority — Hungarian National Authority for Data Protection (NAIH, naih.hu) or your national authority.

To exercise these rights, email [email protected]. We respond within 30 days as required by GDPR Art. 12(3).

8. Children's Privacy

The Service is not directed at children under 16. Learners under 16 may use Teacher only with verifiable consent from a parent or legal guardian. If you become aware that a child under 16 has provided personal data without parental consent, contact us at [email protected] and we will delete it promptly.

9. Security

We protect your data with encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logging, regular dependency scanning, and quarterly access reviews. No system is 100% secure; we encourage you to use strong, unique passwords and enable two-factor authentication when available.

10. International Transfers

We rely on EU Standard Contractual Clauses (SCCs) for any transfer of personal data outside the European Economic Area, including transfers to Anthropic in the United States for LLM inference. We do not transfer data to jurisdictions for which the European Commission has issued an inadequate adequacy decision.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes are notified by email at least 14 days before they take effect. The effective date at the top of this page always reflects the latest version.