In compliance with the General Data
Protection Regulation
(Regulation (EU) 2016/679),
at Refuerzo.ai we inform you about how we process
your personal data.
1. Data Controller
Any personal data that may be collected directly
from the data subject will be treated confidentially
and incorporated into the corresponding processing
activity owned by
Saboner Technologies OÜ (hereinafter
Refuerzo.ai).
2. Data We Collect and Purpose of Processing
Refuerzo.ai is designed to
strictly minimize the collection of
personal data from minors.
In particular:
under no circumstances do we collect the
email address or real name of underage
students. A minor's account is created and managed through
their guardian's account (parent or legal guardian)
or, in the case of educational institutions, through
the school itself.
Data of the guardian or legal representative
(the adult who creates and manages the account):
-
Email address —
required to create and manage the account,
to recover access if you forget your password,
and to receive subscription billing notifications.
-
Password — stored
always in encrypted format (hashed), never
in plain text.
-
Name voluntarily entered
by the guardian upon registration, solely to
personalize in-app communication.
Student data (typically a minor):
-
A PIN code or
alphanumeric identifier assigned by their guardian
or school.
We do not collect their email address,
real name, or any other direct information
that would allow them to be personally
identified.
-
Exercise photos
that the student chooses to upload for AI
correction. The images must contain only the
handwritten solution to the problem: we apply
automatic safeguards so that nothing else is
retained (see section 2.1). The student can also type
their answer using the keyboard, in which case no photo
is uploaded.
Images are stored associated solely with the
student's PIN code, not with a personal identity.
Since we never collect their real name or email
address, we have no technical way of knowing which
individual a specific image belongs to. In this sense, the images are anonymized
with respect to Refuerzo.ai and any third party that
might access them.
-
Academic activity data
(exercises completed, correct and incorrect answers,
practice time) linked to the PIN code, not to a
personal identity.
2.1 Image minimisation: faces and surroundings
Many students photograph their work with the
computer's webcam rather than pointing a phone at
the notebook, so their face or part of the room
may appear in the frame. Because these are images
of minors, we apply two automatic safeguards
before the image is retained
anywhere:
-
Face blurring. A face
detector runs on our own server, without
sending the image to any third party, at the
moment the image is received and before the
file is ever stored. If it detects a face, it
blurs it irreversibly: the copy we keep no
longer contains it. We retain no version
prior to blurring, and
we never use this detection to identify
anyone, nor do we generate or store
biometric data.
-
Discarding images that do not show the
exercise.
A photo is kept only if the sheet with the
exercise is visible in it. If the image is a
close-up, a shot of the room, or any framing
in which the paper cannot be located, the
file is deleted from our servers and is never
stored; the student receives a prompt to
retake the photo showing only the sheet. The
correction is still shown to them.
Images that are kept are stored cropped to the
area of the sheet wherever possible, and are
served through signed links that expire, not
through permanent public addresses.
These safeguards are automatic and are intended to
minimise the personal information present in the
images; we nevertheless advise students to frame
only the paper.
Refuerzo.ai under no circumstances collects
the user's location, contacts, or calendar,
does not profile users, and
does not display third-party ads
on the platform.
Only when a user arrives from one of our own ads
(for example, Google Ads), a click identifier
(gclid) is temporarily stored in the technical
session cookie solely to measure campaign effectiveness.
This identifier is not shared with third parties
as a tracking cookie, nor is it used to profile
the user.
The purpose of processing the guardians' data listed above
corresponds to each of the processing activities carried
out by Refuerzo.ai, detailed below:
-
User management:
Registration and management of guardian and student
accounts for access to the educational platform.
-
Service provision:
Academic progress tracking, AI-powered exercise
correction, and personalized learning.
-
Communications: Sending notifications
related to the service, platform updates, and
improvements (where applicable).
-
Billing: Payment and subscription
management (where applicable).
3. Legal Basis
Your data is processed to comply with legal
obligations applicable to Refuerzo.ai, as well as when
the purpose of processing requires your consent,
which must be given through a clear affirmative
action.
In the case of providing the educational service,
the legal basis is the performance of a contract
(acceptance of the terms and conditions) to which
the user is party.
4. Data Retention
The provided data will be kept for as long as
necessary to fulfill the purpose for which it was
collected and to determine any potential liabilities
that may arise from that purpose, in addition to
the retention periods established by applicable
regulations.
Specific retention periods applied by Refuerzo.ai:
-
Literal responses to exercises
(text and images uploaded when grading homework,
exams, and practice tests):
365 days from the date of the response.
After that period, the literal content and
images are automatically deleted; only the
verdict, grades, dates, teacher comments, and
aggregated metrics are kept, with no possibility
of recovering the original content.
-
AI-generated comments
(automated corrections and detailed feedback):
365 days.
-
Login IP addresses:
90 days.
-
Anti-brute-force operational security logs
(IP address and, if applicable, email associated with
login or credential recovery attempts):
24 hours.
-
Account identification data
(name, email, link to school or parent/guardian):
for as long as the account remains active.
Upon account deletion, all personal data and
associated content are deleted immediately,
applying the same anonymization described above.
-
Accounting records
(subscription and billing events):
6 years, due to legal obligation.
-
Technical logs (application
logs, security events):
1 week.
Refuerzo.ai notifies you 30 days in advance when one
of your responses is close to being anonymized, so
you can download it if you wish to keep it.
5. Data Sharing
As a general rule, data will not be shared with third
parties, except under legal obligation, which may include
disclosures to the Ombudsperson, judges, and courts.
However, in order to provide the service to you,
we share strictly necessary data with technology
service providers (data processors) such as:
-
Stripe (Stripe Inc. /
Stripe Technology Europe Ltd.) — subscription
management and payment processing. Refuerzo.ai
does not store credit card details; it only
receives customer and subscription identifiers.
-
Google Cloud — Vertex AI
(Gemini model) — automated exercise
grading using artificial intelligence. When you
upload a photo of a solved exercise, the image
is sent to Google servers in the European
Union to be analyzed by the AI model.
According to Vertex AI product terms, images and
responses are not permanently stored by
Google nor are they used to train its
models. Processing is carried out solely for the
purpose of returning the correction to you.
-
Amazon Web Services (S3) —
storage for exercise photos you upload to the
platform. Files are stored on servers in the
European Union (Madrid).
All of them have appropriate security measures in
place and comply with European data protection
regulations.
6. Your Rights
Anyone has the right to obtain confirmation regarding
how their personal data is being processed by Refuerzo.ai.
You can exercise your rights to access, rectify, erase,
and transfer your data, to restrict or object to its
processing, as well as the right not to be subject to
decisions based solely on automated processing, where
applicable, by contacting Refuerzo.ai at
info@refuerzo.ai.
For the right to erasure (deleting
your account and data), you also have self-service access
right within the app at
/cuenta/borrar, without needing to contact us. See section 8 of
this policy for full details.
7. Data Security
Refuerzo.ai applies appropriate technical and organizational
measures to ensure a level of security appropriate to
the risk, taking into account the state of the art,
application costs, and the nature, scope, context, and
purposes of processing, as well as varying probabilities
and severity of risks to the rights and freedoms of
individuals.
8. Deleting Your Account
You can delete your Refuerzo.ai account at any time
directly from the app, without needing to contact us,
at the following link:
https://refuerzo.ai/cuenta/borrar
(You must log in first. The link is also available
inside the My Account section of the app, under
"Delete my account".)
What gets deleted:
If you have a parent/guardian account
(mother, father, or legal guardian):
-
Your email address, password, and Google login
identifiers.
-
Your name and other personal profile data.
-
All exercise images uploaded from your account
(also removed from S3 storage).
-
All session history, solved exercises, and AI
corrections associated with your account.
If you have a student account
(PIN code access):
-
Your PIN code stops working and is deleted.
-
All exercise images you uploaded (also removed
from S3 storage).
-
All your session history, solved exercises,
and AI corrections.
-
Reminder: since we never collected
your email address or real name, there is none of
that to delete.
What is retained (for legal accounting
and tax obligations):
-
Stripe identifiers (customer and subscription)
linked to issued invoices, for the statutory period
required by Estonian tax law (minimum 4 years, up to
6 depending on the case). These identifiers do not
allow anyone to contact you or log into your account.
Account deletion takes effect immediately. Any active
subscription will be automatically canceled in Stripe.
You won't be able to recover your account—if you want
to return, you will need to sign up again with an email
address.
High school students: if your account
was created by a school, deletion is handled by your
school administrator or teacher. Please contact them
to request it.
9. Minors
Refuerzo.ai is designed for middle and high school students,
most of whom are minors. For this reason, on Refuerzo.ai
no student creates their account on their own:
a student's account is always created by a responsible adult.
-
Personal/family use: the parent
or legal guardian signs up, creates the student's
account, and grants consent for data processing.
Upon registration, they explicitly confirm that
they hold parental responsibility or legal guardianship
and accept this Privacy Policy and the Terms. This
declaration is logged as proof of consent (Art. 7
GDPR) and satisfies the requirement for parental
consent for children under 14 (Art. 8 GDPR and
Art. 7 LOPDGDD).
-
School/educational center use:
the school creates and manages student accounts
within the scope of its relationship with families.
In this case, the school acts as the data controller
and Refuerzo.ai as the data processor.
As an additional protective measure, registering a personal
parent/guardian account includes a verification step to
confirm that the person creating it is an adult.