Privacy policy

Data controller

AI Bootcamp, SAS, 13 chemin du Moulin de Trissepaille, 34570 Saussan, France, SIREN 994 754 802. Contact: contact@hevraya.com.

Data we process

Account

email address, encrypted password or Google identifier, language, creation and sign-in dates.

Study profile

first name, background, learning style, preferred texts, session length and time, the middah you are working on, display theme.

Voice and transcripts

the audio of your sessions, processed for speech recognition and the conversation with Ari, and the transcripts of your sessions, which are kept.

Study memory

session summaries, your insights (vorts), open questions, moments and a portrait of how you learn, built only from your own words.

Subscription and payment

plan, status, billing history and usage costs. Your card details are processed by Stripe; we never receive them.

Technical data

security logs, IP address, device type. And, if we measure traffic to the site, aggregated audience measurement, without cookies or any persistent identifier.

Purposes and legal bases

Providing the service (account, sessions, Ari's memory, "Your path")

performance of the contract (Article 6(1)(b) of the GDPR).

Recording and processing your voice

your consent (Article 6(1)(a)), given at sign-up (by continuing after the notice that links to this policy) and withdrawable at any time in your settings. Voice is the service itself: withdrawing this consent ends voice sessions. Your account stays open, and you can still export or delete your data.

Billing and accounting duties

legal obligation (Article 6(1)(c)).

Security, abuse prevention, cost control and service improvement

legitimate interest (Article 6(1)(f)).

Service emails (sign-in, billing)

performance of the contract.

Required data

• Account data (email address or Google identifier) is needed to conclude and perform the contract. Without it, we cannot create your account.
• Processing your voice relies on your consent, which you are free to refuse or withdraw. Because voice is the service itself, without this consent voice sessions, that is, the service, cannot be provided to you.
• Study profile: only the first name is required, and the form of address (masculine or feminine) if you study in Hebrew. The language, level, learning style and session length are prefilled and can be changed. Everything else is optional: what you are looking for, preferred texts, when you study, the free introduction and the middah you work on.

This information is given to you under Article 13 of the GDPR.

Profiling and automated decisions

The portrait of how you learn ("Your path") is built automatically from your sessions: this is profiling within the meaning of the GDPR. It is used only to adapt your study with Ari and produces no legal effect concerning you, nor any similar effect that would significantly affect you.

We take no decision based solely on automated processing within the meaning of Article 22 of the GDPR.

Processors and recipients

Your data is never sold. It is shared only with the providers the service needs:

Supabase (database, authentication)

hosted in Singapore.

Vercel (hosting of the website and the app)

a company established in the United States; the app's functions run in Singapore, next to the database.

ElevenLabs (voice: speech recognition, synthesis, running the conversation)

audio and transcripts; United States.

OpenRouter and the model hosts it calls (Ari's reasoning)

transcripts and session context, routed only to hosts in the United States or the European Union, never to DeepSeek's own API.

Anthropic (Claude: summaries, portrait, suggestions, translations)

United States.

Stripe (payment, invoices, VAT)

European Union (Ireland) and United States.

Resend (service emails)

United States.

Sefaria (texts)

we only request texts from it; none of your account data is sent to it.

Transfers outside the European Union

Some providers are established in, or host data in, countries outside the European Union (United States, Singapore). In particular, Supabase hosts the database and Vercel runs the app's functions in Singapore. These transfers are covered by the European Commission's Standard Contractual Clauses and, where the provider is certified, by the EU-US Data Privacy Framework. You can get a copy of these safeguards by writing to us.

How long we keep data

Account, profile, study memory, transcripts

as long as your account is active. They are erased when you delete your account, including at ElevenLabs, which we then ask to erase your conversations.

Inactive accounts

deleted, with all their data, after 3 years without a sign-in. We warn you by email 30 days before; signing in is enough to keep your account.

Invoices and accounting records

10 years (Article L123-22 of the French Commercial Code).

Security logs

6 months.

Backups

7 days.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection. You can withdraw your consent at any time and set instructions for what happens to your data after your death.

• From your settings: edit your profile, correct or erase what Ari remembers, export your data, delete your account.
• By email: contact@hevraya.com.

We reply within one month.

Complaints

If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr.

Security

Encrypted connections (HTTPS), each account's data isolated at the database level (row level security), secrets kept in a vault and never in the code.

Changes

We will tell you about any significant change to this policy.

Contact

For any question about your data: contact@hevraya.com.