This Privacy Policy describes how Gakimas LLC ("Gakimas," "we," "our," or "us") collects, uses, and protects information through the Gakimas language-learning platform and related websites and applications (the "Services").
Gakimas LLC is a Pennsylvania limited liability company with its principal place of business at 100 Academy Drive, Mercersburg, PA 17236.
Overview
Gakimas provides AI-powered language-learning services to K–12 schools. Students engage in voice conversations with an AI tutor; the platform transcribes the conversation, generates a tutor response, and provides educational analytics to teachers and administrators.
We take student privacy seriously. We comply with the Family Educational Rights and Privacy Act (FERPA) and, where applicable, the Children's Online Privacy Protection Act (COPPA) and applicable state student-privacy laws.
How the relationship works
Gakimas provides the Services to schools (each, a "School") under a written subscription. Where a School processes student records through the Services, Gakimas acts as a school official with a legitimate educational interest in those records, under FERPA's school official exception (34 C.F.R. § 99.31(a)(1)(i)(B)), and processes student data on the School's behalf consistent with the Data Processing Agreement signed with the School.
Data we collect
We collect only the information operationally necessary to deliver the Services:
- Account information. Name, email address, school affiliation, and role (student, teacher, administrator). Provided by School administrators.
- Conversation data. Text transcriptions of voice conversations with the AI tutor and per-word pronunciation confidence scores.
- Educational analytics. AI-generated daily analyses of student progress, including measures of fluency, accuracy, grammar, and topic engagement.
- Usage data. Conversation timestamps, durations, counts, and weekly quota usage.
Data we do not collect
We do not collect, store, or use the following:
- Audio recordings. Audio is processed in real-time by our speech-to-text service provider under zero-retention terms and is not persisted by Gakimas.
- Biometric identifiers. No voiceprints, faceprints, or other biometric data are extracted, stored, or used.
- Geolocation data. We do not collect device location.
- Advertising identifiers. We do not collect advertising IDs and do not serve advertisements.
- Browsing history outside the Services. We do not track user activity outside the Services.
How we use data
Student data is used solely to provide the educational service: AI conversation, pronunciation tracking, progress analysis, and teacher reporting. We do not:
- use student data for advertising or marketing of any kind;
- sell, rent, or trade student data to any third party;
- build user profiles for any purpose other than providing the Services to the School;
- use student data to train, fine-tune, or otherwise improve generally available artificial intelligence models; or
- use student data for any purpose other than delivering the Services contracted by the School.
Gakimas may generate fully de-identified, aggregate data from student data and use such de-identified data to develop and improve the Services. We do not attempt to re-identify de-identified data.
Service providers (sub-processors)
To deliver the Services we engage a small set of third-party service providers, including providers of artificial intelligence (for speech-to-text and conversational AI), infrastructure (for hosting and content delivery), and security. Each provider is bound by a written Data Processing Agreement that prohibits training on customer data and limits processing to what is necessary to deliver its service to Gakimas.
The current list of service providers is included in the Data Processing Agreement signed with each School and is updated as needed. Schools may request the current list at any time by contacting us.
Data security
Gakimas maintains administrative, technical, and physical safeguards reasonably designed to protect student data:
- All data encrypted in transit (TLS 1.3) and at rest (LUKS2 / AES-XTS-256 disk encryption).
- Passwords hashed with bcrypt (12 or more rounds). Multi-factor authentication required for administrative accounts.
- Strict per-school data isolation enforced at the database query layer.
- Append-only record of administrative actions for security monitoring.
- No personally identifiable information in application logs or error messages.
- Daily automated backups with managed rotation.
- Daily dependency vulnerability scanning; high and critical advisories remediated promptly.
A more detailed Security Overview is available to Schools on request.
Data retention and deletion
Student data is retained for the duration of the School's subscription plus a reasonable retention window configurable per School. After the retention window, student data is purged from production systems within a commercially reasonable timeframe. Backups expire on normal rotation.
Within a reasonable period after termination of a School's subscription (typically 30 days), the School may request export of its student data in a usable format (CSV or JSON). After the export window, student data is deleted from production systems on the schedule above.
Individual student records can be deleted at any time by a School administrator.
Parental rights and FERPA access
Where the Services process student education records, requests by parents or eligible students to access, correct, or delete those records should be directed to the School. Gakimas does not respond directly to such requests; we cooperate with the School to fulfill them in accordance with FERPA.
Children's privacy (COPPA)
The Services are directed to students aged 13 and older. Where a School elects to authorize Gakimas to process information of students under age 13, the School represents that it has obtained any verifiable parental consent required under COPPA, including consent obtained by the School on behalf of parents under the school authorization framework recognized by the Federal Trade Commission. Gakimas processes any such information solely for the educational purposes authorized by the School.
State student-privacy law promises
Consistent with California's Student Online Personal Information Protection Act (SOPIPA) and analogous state laws, Gakimas does not:
- engage in targeted advertising to students;
- sell student data;
- build advertising profiles or non-educational profiles of students; or
- use student data for any purpose other than providing the Services to the School.
Data residency
Production student data is stored in data centers located in the United States.
Security incident notification
In the event of a security incident affecting student data, Gakimas will notify the affected School in writing without undue delay, and in any case within 72 hours of confirmation of the incident, consistent with the Data Processing Agreement.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The version and "Last updated" date at the top of this Privacy Policy reflect the current version. Material changes will be communicated by reasonable means (such as in-product notice or email to School administrators).
Contact
Questions about this Privacy Policy or our data practices? Contact us at [email protected] or:
Gakimas LLC, 100 Academy Drive, Mercersburg, PA 17236
End of Privacy Policy v1.1.0.