Version 1.2 — Last updated: 3 September 2026
This Policy explains what personal data we process in Socratista, for what purposes, on what legal basis, with whom we share it and what rights you have. It complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD).
When you access through an Institution (school, university, accelerator) that has licensed Socratista for its programme, the Institution is the controller of your data as a student of that programme and Socratista acts as a processor on behalf of the Institution, in accordance with the Data Processing Agreement. For Socratista's own processing described in section 3.5 (improving the Platform and training with anonymised data), Socratista is the controller.
| Category | Examples | Source |
|---|---|---|
| Identification and contact | First name, last name, email, profile photo, company/institution, role, LinkedIn | You, or the social login provider (Google, LinkedIn, Microsoft) |
| Profile and project | Description of your project, sector, stage, goals, uploaded documents and decks | You |
| Activity on the Platform | Programmes taken, progress, answers to exercises, messages, questions to the AI, ratings | Use of the Platform |
| Recordings and transcripts | Audio, video, shared screen and transcripts of mentoring sessions and classes; sheets and summaries derived from them | Sessions on the Platform or external tools (Zoom, Meet, Granola) |
| Voice and image | Your voice and your image in recordings | Sessions |
| Mentor/Professor data | The above plus biography, experience, availability, contributed content, billing data where there is remuneration | You |
| Payment (when activated) | Last card digits, payment history. Socratista does not store full card numbers; Stripe handles them | Stripe |
| Technical | IP, device, browser, session identifiers, access logs, cookies | Browser/app |
Data we do not want. We do not ask you for, nor do you need to share, special-category data (health, ideology, religion, sexual orientation, etc.). If you mention it in a session, it will remain in the recording; avoid doing so if you do not want it processed. We do not process your voice or image to identify you biometrically.
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| 3.1. Creating and managing your account, providing you the services, programmes and sessions, communicating with you about the service | Performance of the contract (Terms and Conditions) |
| 3.2. Recording and transcribing mentoring sessions and classes so you can review them, preparing session sheets, supervising programme quality | Performance of the contract and consent (accepted at sign-up and recalled at each session). You can object to the recording of a specific session before it starts |
| 3.3. Managing payments, invoicing and tax obligations | Performance of the contract and legal obligation |
| 3.4. Security, fraud and abuse prevention, access logs | Legitimate interest in protecting the Platform and its Users |
| 3.5. Improving the Platform, the content and the Socratista Methodology through aggregated and anonymised analysis of questions, doubts, usage and sessions | Legitimate interest (it does not allow you to be identified once anonymised) |
| 3.6. Training, tuning and evaluating our own AI models, exclusively with previously anonymised transcripts and content. Socratista does not train models with data that identifies you | Legitimate interest (once anonymised, the data cannot identify you) |
| 3.7. Showing sheets or summaries of your session or project to other Users of your programme | Performance of the contract. Outside your programme only anonymised versions are used, which cannot identify you or your project (legitimate interest) |
| 3.8. Sending you communications about new Socratista programmes, content or events | Legitimate interest if you are already a user (art. 21.2 LSSI) for similar services; consent in all other cases. You can unsubscribe in every email |
| 3.9. Handling your rights requests and complaints | Legal obligation |
Automated decision-making. Socratista does not take decisions with legal or similarly significant effects based solely on automated processing. AI recommendations (next steps, suggested content, indicative evaluations) are support for you, your mentor or your institution, who keep the final say.
4.1. Other Users. The Mentors/Professors of your sessions see your profile, project and the recordings of their sessions. Participants in a group class see what you present in it. Your Institution, if you access through one, sees your progress and the recordings of its programme.
4.2. Processors (providers). They act under our instructions and under a contract compliant with art. 28 GDPR:
| Provider | Service | Location / transfer safeguard |
|---|---|---|
| Supabase | Database and authentication | Frankfurt, Germany (EU region eu-central-1); Supabase Inc. (USA) under Standard Contractual Clauses (SCC) |
| Vercel | Application hosting | USA — EU-US Data Privacy Framework (DPF) / SCC |
| Resend | Transactional email delivery | USA — SCC |
| Stripe | Payments (when activated) | Stripe Payments Europe (Ireland); Stripe Inc. under DPF |
| Anthropic | Language models (Claude) via API | USA — DPF / SCC. Anthropic does not train its models with data sent to the API |
| Google (Gemini, Firebase, Drive, Analytics) | AI models, infrastructure, storage and analytics | Google Ireland / Google LLC (USA) — DPF. The Gemini API under a data agreement does not train with your data |
| OpenAI | Language models as the AI assistant backup provider (failover if the primary provider is down) and voice transcription | USA — DPF / SCC. No retention or training on API data; receives the same anonymized content as the primary provider |
| ElevenLabs | Audio synthesis | USA — DPF / SCC. Configured with no retention for training |
| Zoom, Google Meet, Granola, Calendly | Video conferencing, recording, transcription and session scheduling | USA — DPF / SCC |
We may update this list; the current version will always be in this Policy.
4.3. International transfers. Several providers are located in the United States. Transfers rely on the Adequacy Decision for the EU-US Data Privacy Framework (for certified providers) or on the European Commission's Standard Contractual Clauses, with supplementary measures (encryption in transit and at rest). You can request a copy of the safeguards at privacidad@socratista.com.
4.4. Other recipients. Public authorities, judges and courts where there is a legal obligation; professional advisers under confidentiality; and, in the event of a merger or acquisition, the acquirer, with prior notice.
We do not sell your data nor share it with third parties for their own advertising.
| Data | Period |
|---|---|
| Account and profile | While the account is active. After cancellation, blocked for 3 years (limitation period for liabilities) and then deleted |
| Audio/video recordings of sessions | 12 months from the session, or earlier if you cancel your account and request it |
| Identifiable transcripts and sheets | While the account is active; anonymised or deleted upon cancellation |
| Anonymised transcripts and derived materials | No time limit (they are no longer personal data) |
| Trained AI models | No limit. Withdrawing consent prevents future uses of your data but does not affect models already trained, from which your data cannot be extracted |
| Billing data | 6 years (Commercial Code) / 4 years (tax regulations) |
| Technical and security logs | 12 months |
| Consents and acceptance of terms | While the account is active + 3 years, as proof of compliance |
You can exercise at any time, free of charge, the rights of access, rectification, erasure, objection, restriction of processing, portability and to withdraw consent (without retroactive effect), by writing to privacidad@socratista.com from your account email, or attaching an identity document if you write from another address. We will reply within one month at most.
You can also:
If you access through an Institution, you can exercise your rights before it or before us; we will coordinate to assist you.
We apply appropriate technical and organisational measures: encryption in transit (TLS) and at rest, role-based access control, secure authentication, activity logs, backups, minimisation of the data sent to AI providers and processing agreements with all of them. No system is infallible; if a breach occurs that poses a risk to your rights, we will notify you in accordance with art. 34 GDPR.
Socratista is aimed exclusively at people over 18. We do not knowingly process minors' data. If we detect a minor's account, we will delete it.
We will notify you of relevant changes by email or on the Platform. If a change involves a new purpose requiring consent, we will ask you for it expressly.
Write to us at privacidad@socratista.com.