TrulySpeak privacy
Privacy and Data Protection Policy
Last updated 13 August 2026. This notice explains how personal data is processed across the marketplace, accounts, applications, lessons, communications, payments and Staff functions.
1. Controller
- Controller
- Gabriel David Vasquez Alcantara
- Address
- Not configured — required before deployment
- Privacy contact
- Not configured — required before deployment
- Data Protection Officer
- Not configured — required before deployment
2. Data we process
Account and identity
Name, email, identifiers, roles, authentication, account status and session/security information.
Student profile
Photo, description, learning and spoken languages, goals, timezone and supported preferences.
Tutor and applicant
Profile, photo, languages, specialties, price, availability, introduction media, application, moderation, publication and genuinely collected verification information.
Lessons and bookings
Participant identifiers, references, times, timezone, duration, states, cancellations, reschedules, reports, attendance and supported lesson records.
Communications
Participants, messages, read or pinned state, notifications, support content and relevant metadata.
Financial
Ledger entries, amounts, holds, refunds, Tutor earnings and payouts, and provider references. TrulySpeak does not claim to store full payment-card data handled by Stripe.
Technical and Staff operations
IP address where processed, device/browser data, timestamps, logs, security events, audit records, role assignments, moderation and incidents.
3. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Accounts, profiles, applications, availability, lessons, messages, payments and refunds | Contract or steps requested before contract; legal obligations where applicable |
| Public Tutor discovery and marketplace operation | Contract and legitimate interests |
| Accounting, tax, fraud, security, audit, support and disputes | Legal obligations and legitimate interests |
| Optional product analytics and campaign attribution | Consent |
| Public approved Tutor media | Contract and any additional lawful basis required for the specific publication |
Consent is not used as a blanket basis for ordinary account or contract processing.
4. Public profile information
Approved Tutor profile fields and introduction media are public. Private identity, KYC and payout data are excluded from the public projection. Student information is not public except through an intentionally bounded supported feature.
5. Recipients
Data is disclosed only as needed to the lesson counterpart, authorized capability-scoped Staff, infrastructure and storage services, configured payment providers such as Stripe or PayPal, Google or Microsoft identity, email and communications services, Google Calendar/Meet, privacy-enhanced YouTube media, Cloudflare Turnstile, and professional or public authorities where legally required. Local mocks do not imply live transfer.
6. International transfers
If deployed processing transfers data outside the EEA, an applicable mechanism such as an adequacy decision or approved safeguards will be used where required. Actual production provider locations and mechanisms are Not configured — required before deployment.
7. Retention
The product has finite, auditable schedules for applications and media, KYC metadata, messages, incidents, operational logs, audit, financial records and backups, with legal holds preventing premature removal. Final production periods and legal bases remain subject to legal review. Account, profile, Session and closed-account data are retained only for their purpose and applicable legal, accounting, tax, security, dispute and limitation requirements.
8. Your rights
Subject to law, rights can include information, access, correction, erasure, restriction, portability, objection, direct-marketing objection, withdrawal of consent, and safeguards for qualifying solely automated decisions. Authenticated users should use the Privacy and data workspace for supported access, export, correction and closure actions. Identity verification may be required. External contact: Not configured — required before deployment.
9. Complaints
You may contact TrulySpeak first and may complain to the competent supervisory authority. For a controller established in Spain, this is the Agencia Española de Protección de Datos (AEPD).
10. Automated decisions and profiling
The implemented product does not make a solely automated decision that is represented as producing legal or similarly significant effects. Tutor filtering, stable ordering, optional sorting, fraud signals and Staff review support do not replace authorized human decisions.
11. Security
Implemented safeguards include role and capability authorization, authentication and session controls, CSRF protection, audit/security logging, secure transport outside local development, immutable financial evidence and provider-boundary validation. No online service can guarantee absolute security.
12. Children
TrulySpeak’s initial release is adult-only. Account creation requires a declaration that the user is at least 18. No guardian-consent journey or service for children is implemented.
13. Changes
Material changes will be communicated as required by law and this page will show its updated date and version.
14. Contact
Not configured — required before deployment