Privacy Policy

Last updated: April 2026

Overview

Gakimas provides AI-powered language learning services to K-12 schools. We take student data privacy seriously and comply with FERPA (Family Educational Rights and Privacy Act) and COPPA (Children's Online Privacy Protection Act).

Data We Collect

• Account information: Name, email address, school affiliation, and role (student, teacher, admin). Provided by school administrators.
• Conversation data: Transcripts of voice conversations with AI tutors, per-word pronunciation confidence scores, and AI-generated analysis (fluency, accuracy, grammar).
• Usage data: Session duration, conversation counts, and quota usage.

Data We Do NOT Collect

• Audio recordings are never stored. Audio is processed in real-time and discarded.
• We do not collect location data, device identifiers, or browsing history.
• We do not use student data for advertising or marketing.

How We Use Data

Student data is used solely to provide the educational service: AI conversation, pronunciation tracking, progress analysis, and teacher reporting. We do not sell, share, or use student data for any purpose other than delivering the service the school contracted for.

Data Security

• All data encrypted at rest (AES-256 via LUKS) and in transit (TLS 1.3).
• Passwords hashed with bcrypt (12+ rounds). Optional MFA for staff accounts.
• Multi-tenant isolation: each school's data is completely separated at the database level.
• Tamper-evident audit logs with cryptographic hash chains.
• No student personally identifiable information in application logs or error messages.

Third-Party Services

We use the following third-party services to provide our product:

• Deepgram: Speech-to-text transcription. We have a signed Data Processing Agreement (DPA) with Deepgram. All API requests include mip_opt_out=true, which means Deepgram does not store, retain, or use any audio or transcripts. Zero data retention.
• OpenAI: AI conversation responses and educational analysis. Conversation data is sent to OpenAI's API for processing.

We maintain Data Processing Agreements (DPAs) with our third-party providers to ensure they meet FERPA requirements.

Data Retention & Deletion

Student data is retained for the duration of the school's contract. When a school's contract ends, all data is permanently deleted via cascading database deletion. Individual student data can be deleted at any time by a school administrator.

Parental Rights (COPPA)

Gakimas is used under the direction of schools, which act as the consenting party under COPPA. Schools are responsible for obtaining any necessary parental consent. Parents may request to review or delete their child's data by contacting their school administrator.

Contact

For privacy questions or data requests, contact us at [email protected].