Privacy policy

Summary

• Data controller: Calufo y Pelete S.L. (NIF B19748037), Calle Inocencio de la Rosa 18, Tegueste, Santa Cruz de Tenerife, Spain. Contact: via the contact form.
• Websites: lingufolio.com and lingufolio.app.
• Data processed: identification and contact data, teacher billing and tax data, browsing and technical logs, pedagogical data about students entered by the teacher, student portal account data, and live class audio (processed only for transcription).
• Purposes: providing the SaaS service, billing and tax compliance, customer support, security and service improvement, AI-assisted teaching materials, and live audio capture via the browser extension.
• Roles: LinguFolio is the controller for teacher data and student-account data, and the processor for student data entered by the teacher on their behalf.
• Legal bases (GDPR art. 6): consent, performance of a contract, legal obligation and legitimate interest, depending on the specific purpose.
• Cookies: only strictly necessary technical cookies (language preference, form security and sign-in session); no analytics, advertising or third-party tracking, so no consent banner is required.
• Your rights (GDPR art. 15-22): access, rectification, erasure, restriction, objection, portability and withdrawal of consent, via the contact form. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).

Sign in with Google

LinguFolio lets you create an account and sign in through external identity providers, including Google (via OAuth 2.0 / OpenID Connect). Using this method is optional: you can also register with an email address and password.

• Google data we access: when you choose to sign in with Google, we access only the basic data of your Google account: your unique account identifier (Google ID), your email address and its verification status, your name and, where available, your profile picture and preferred language. We request only the openid, email and profile scopes. We do not access your Gmail, Google Drive, Google Calendar, contacts or any other data in your Google account.
• How we use it: we use this data solely to create and authenticate your LinguFolio account, to identify you securely at each sign-in and, where applicable, to link your Google identity to an existing account with the same verified email. We do not use this data for advertising or to train artificial-intelligence models.
• Who we share it with: data obtained from your Google account is not sold or disclosed to third parties for commercial or advertising purposes. It is processed only through our authentication and infrastructure provider (Supabase), acting as a data processor under a Data Processing Agreement (DPA) and hosted in a European Union region, for the sole purpose of managing your account and session.
• How we store and protect it: it is stored securely as described in the "Data security" section of the Spanish policy: encryption in transit (TLS 1.2 or higher) and at rest, access controls, and EU-region hosting.
• How long we keep it and how to delete it: we retain this data while your account remains active. You may at any time request access, rectification or erasure of this data — including unlinking your Google account — via the contact form, or by deleting your account.

LinguFolio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Audio and transcription

Raw class audio is transmitted only for transcription and deleted immediately afterwards. The literal transcription is not stored persistently and is not accessible; for process reliability, an encrypted and non-accessible copy of the transcription may exist transiently for up to 24 hours and is then deleted automatically. Only the structured pedagogical summary is retained.

Minors

LinguFolio applies reinforced safeguards to students' data by design and by default (data minimisation, no use for AI training, no advertising or commercial disclosure, restricted internal access, priority erasure, and no automated profiling). The teacher — or, where applicable, the educational institution — is responsible for holding and documenting a valid legal basis to enter minors' data into the platform.

International transfers

Where a provider is located outside the European Economic Area (EEA) or accesses data from outside it, transfers rely on a valid transfer basis and appropriate safeguards, such as the EU Standard Contractual Clauses (Commission Decision 2021/914).

Version v1 · updated 9 July 2026 · informational English summary; the Spanish version at /legal/privacidad is the binding text and is pending final legal review.