Privacy policy

Who we are

Aula is a teaching website and lesson platform operated by sferarc. In this policy, "we" means sferarc. Each school or independent teacher that uses Aula ("the school") runs its own site and decides what it keeps about its students and families.

Our two roles

For teacher and school accounts, and for running and securing the service, we decide how information is used and are its controller.

For the information a school keeps about its students, guardians and children, the school is the controller and we process it on the school's behalf and only on its instructions. Write to the school first about that information; we help the school answer.

What we collect

Accounts: name, email address, password (stored only as a hash), language, time zone and notification choices. If you sign in with Google or Apple, we receive your name and email address from them.

Teaching: lesson types, bookings, classes and enrolments, attendance, lesson notes, homework, vocabulary, progress, reviews, messages and announcements.

Fees and payments: the amounts, dates and methods a school records, and the fees it charges. Bank account details for a direct debit mandate are stored encrypted.

Files: profile photos, logos, intro videos, lesson materials and homework uploads.

Connected calendars: if a teacher connects Google Calendar or Microsoft Outlook, we keep that account's email address and its list of calendars, and read the start and end times of its events, from a day back to 180 days ahead, as busy time.

Children and families

A child uses Aula through the account of a parent or legal guardian, who agrees on the child's behalf and can remove the child or download and delete their data.

Health information about a child, such as allergies, is kept only with the guardian's explicit consent. Only the school's owners and admins, and the teachers of the child's current classes, can open it; the class register shows a marker, not the details.

For the adults authorised to pick a child up, the school keeps their name, their relationship to the child, the last characters of an identity document and, optionally, a photo. When a child is collected from a class, the school records who collected them and when. Each consent a guardian gives or withdraws is kept with its version and date.

School staff

For staff who work with children, a school can record the date of the certificate the law requires about sexual offences, so it knows when it is due again. Only the school's owners and admins see and manage these dates.

Lesson rooms and recordings

Online lessons run through a real time video provider. A lesson is recorded only when both the teacher and the student agree. Recordings and their transcripts are deleted after the period the school chooses: 7, 30 or 90 days.

AI features

When a school turns on AI features, the text a request needs is sent to an AI model provider to produce the result. In the teacher's tools, for example a summary of lesson notes or a homework draft, the teacher reviews every draft before it is shared.

In speaking practice, a student talks with an AI that plays a role the teacher set. The student's own messages go to the AI model provider, and its replies and the feedback at the end reach the student directly, without a teacher reviewing them first. The student's teacher can read these conversations. Where the site offers speaking aloud, the browser's own speech recognition turns the voice into text and may send it to the browser's maker; Aula never receives the audio.

Who we share it with

We use service providers to host the service and its database, store files, send email, run video lessons, process card payments and, when a school uses them, run AI features. Each receives only what it needs for that task.

When a teacher connects a Google or Microsoft calendar, Aula writes the teacher's confirmed lessons into it as private events named after the lesson and its students, so those names reach Google or Microsoft in the teacher's own account.

We do not sell personal information and we show no advertising.

When online payments to teachers are available, EU rules (DAC7) may require us to report information about teachers who receive payments to the tax authorities.

How long we keep it

We keep information while the account or the school's site is in use. A student can download their data and delete their account from the Account page on the school's site; a teacher or school can ask us to delete theirs. Deletion removes the data except what the law requires us to keep. Speaking practice conversations are deleted after 180 days. Email delivery records are kept for up to 180 days.

Cookies

Aula uses only the cookies it needs to work, such as one that keeps you signed in, one that remembers your language and a short lived one that protects a teacher's calendar connection while it is made. Your theme choice stays in your browser. There are no advertising or analytics cookies.

Your rights

You can ask for access to your information, and for its correction, deletion, restriction or transfer, and you can object to its use. You can withdraw a consent at any time. You can also complain to your data protection authority; in Spain, the Agencia Española de Protección de Datos.

Contact

Write to hola@sferarc.com about this policy or your information.