Privacy Policy
Version 1.6 — Last updated: 19 October 2026 (non-material change: two processors added, Meta for the faculty WhatsApp channel and your browser's push notification services, both optional)
This Policy explains what personal data we process in Socratista, for what purposes, on what legal basis, with whom we share it and what rights you have. It complies with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Data Protection and the guarantee of digital rights (LOPDGDD).
1. Data controller
- Controller: Heusch Ventures, S.L.U. (Tax ID B44782001)
- Privacy contact: privacidad@socratista.com
- Data Protection Officer: not appointed, as the circumstances of art. 37 GDPR and art. 34 LOPDGDD do not apply. The channel above handles all requests.
When you access through an Institution (school, university, accelerator) that has licensed Socratista for its programme, the Institution is the controller of your data as a student of that programme and Socratista acts as a processor on behalf of the Institution, in accordance with the Data Processing Agreement. For Socratista's own processing described in section 3.5 (improving the Platform and training with anonymised data), Socratista is the controller.
2. What data we process
| Category | Examples | Source |
|---|---|---|
| Identification and contact | First name, last name, email, company/institution, role, LinkedIn | You, the Institution that enrols you (which may pass us your enrolment details before your first login), or the social login provider (Google, LinkedIn, Microsoft) |
| Optional details on your profile | Date of birth, gender, city and contact phone or WhatsApp. We never ask you for these when you create your account or in the profile questionnaire: you fill them in if you want to, or your Institution passes them to us with your enrolment details. They help your programme team know you and feed aggregate statistics about the cohort (average age, gender distribution, nationalities) that never identify you. You can leave them blank or delete them whenever you like from your profile, with no consequences | You or the Institution |
| Additional emails | Alternative email addresses linked to your account. The address you sign in with creates your account; any other stays pending until you click the link we send you. You can correct or remove them from your profile | You |
| Face photo | A selfie or a current photo of your face (cropped to the face) so that professors, mentors, classmates and the programme team can identify you within the Platform. It is stored privately and only seen by people who share an institution with you. We do not use it for biometric identification and we do not pass it on to third parties. You can change or delete it at any time from your profile; the programme team may reject it and ask for another if it does not follow the rules (face only, one person, sharp) | You |
| Profile and project | Description of your project, sector, stage, goals, uploaded documents and decks | You |
| Activity on the Platform | Programmes taken, progress, answers to exercises, messages, questions to the AI, ratings | Use of the Platform |
| Recordings and transcripts | Audio, video, shared screen and transcripts of mentoring sessions and classes; sheets and summaries derived from them | Sessions on the Platform or external tools (Zoom, Meet, Granola) |
| Voice and image | Your voice and your image in recordings | Sessions |
| Mentor/Professor data | The above plus biography, experience, availability, contributed content, billing data where there is remuneration | You |
| Payment (when activated) | Last card digits, payment history. Socratista does not store full card numbers; Stripe handles them | Stripe |
| Technical | IP, device, browser, session identifiers, access logs, cookies | Browser/app |
Data we do not want. We do not ask you for, nor do you need to share, special-category data (health, ideology, religion, sexual orientation, etc.). If you mention it in a session, it will remain in the recording; avoid doing so if you do not want it processed. We do not process your voice or image to identify you biometrically.
When an Institution enrols you
When you reach the Platform through an Institution (your school, university or the organiser of your programme), it may pass us your enrolment details before your first login: name and surname, email, company and role, country and city, phone, date of birth, gender and the description of the project you applied with. The first time you sign in you will see those details already filled in on your profile so that you can confirm or correct them, and you can delete the optional ones whenever you like. We inform you of this under Article 14 GDPR.
3. Purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) |
|---|---|
| 3.1. Creating and managing your account, providing you the services, programmes and sessions, communicating with you about the service | Performance of the contract (Terms and Conditions) |
| 3.2. Recording and transcribing mentoring sessions and classes so you can review them, preparing session sheets, supervising programme quality | Performance of the contract and consent (accepted at sign-up and recalled at each session). You can object to the recording of a specific session before it starts |
| 3.3. Managing payments, invoicing and tax obligations | Performance of the contract and legal obligation |
| 3.4. Security, fraud and abuse prevention, access logs | Legitimate interest in protecting the Platform and its Users |
| 3.5. Improving the Platform, the content and the Socratista Methodology through aggregated and anonymised analysis of questions, doubts, usage and sessions | Legitimate interest (it does not allow you to be identified once anonymised) |
| 3.6. Training, tuning and evaluating our own AI models, exclusively with previously anonymised transcripts and content. Socratista does not train models with data that identifies you | Legitimate interest (once anonymised, the data cannot identify you) |
| 3.7. Showing sheets or summaries of your session or project to other Users of your programme | Performance of the contract. Outside your programme only anonymised versions are used, which cannot identify you or your project (legitimate interest) |
| 3.8. Sending you communications about new Socratista programmes, content or events | Legitimate interest if you are already a user (art. 21.2 LSSI) for similar services; consent in all other cases. You can unsubscribe in every email |
| 3.9. Handling your rights requests and complaints | Legal obligation |
Automated decision-making. Socratista does not take decisions with legal or similarly significant effects based solely on automated processing. AI recommendations (next steps, suggested content, indicative evaluations) are support for you, your mentor or your institution, who keep the final say.
4. Who we share your data with
4.1. Other Users. The Mentors/Professors of your sessions see your profile, project and the recordings of their sessions. Participants in a group class see what you present in it. Your Institution, if you access through one, sees your progress and the recordings of its programme.
4.2. Processors (providers). They act under our instructions and under a contract compliant with art. 28 GDPR:
| Provider | Service | Location / transfer safeguard |
|---|---|---|
| Supabase | Database and authentication | Frankfurt, Germany (EU region eu-central-1); Supabase Inc. (USA) under Standard Contractual Clauses (SCC) |
| Vercel | Application hosting | USA — EU-US Data Privacy Framework (DPF) / SCC |
| Resend | Transactional email delivery | USA — SCC |
| Twilio | Delivery of the SMS with the mobile verification code (only professors, mentors and directors who choose to verify it) | Twilio Inc. (USA) — DPF / SCC. The number and the SMS text are processed and stored in its Ireland (EU) region; Socratista keeps only the country prefix and the last 4 digits of each send |
| Meta (WhatsApp Business Platform) | WhatsApp support and notice channel for faculty only, for those who expressly accept it and write first to our number: we receive your number, your WhatsApp profile name and the text of your messages; no student data is ever handled through this channel; conversations are kept 90 days in Socratista; withdraw by writing STOP or from your profile | Meta Platforms Ireland Ltd. (Ireland) and Meta Platforms, Inc. (USA) — DPF / SCC, under the WhatsApp Business Platform terms |
| Push notification services (Google, Apple, Mozilla, Microsoft, depending on your browser or system) | Delivery of the push notices you turn on in your profile: we store your device's subscription address encrypted; the notice carries a short title and a link to the Platform, never student data | EU / USA depending on the provider — DPF / SCC |
| Stripe | Payments (when activated) | Stripe Payments Europe (Ireland); Stripe Inc. under DPF |
| Anthropic | Language models (Claude) via API | USA — DPF / SCC. Anthropic does not train its models with data sent to the API |
| Google (Gemini, Firebase, Drive, Analytics) | AI models, infrastructure, storage and analytics | Google Ireland / Google LLC (USA) — DPF. The Gemini API under a data agreement does not train with your data |
| OpenAI | Language models as the AI assistant backup provider (failover if the primary provider is down) and voice transcription | USA — DPF / SCC. No retention or training on API data; receives the same anonymized content as the primary provider |
| ElevenLabs | Audio synthesis | USA — DPF / SCC. Configured with no retention for training |
| Zoom, Google Meet, Granola, Calendly | Video conferencing, recording, transcription and session scheduling | USA — DPF / SCC |
We may update this list; the current version will always be in this Policy.
4.3. International transfers. Several providers are located in the United States. Transfers rely on the Adequacy Decision for the EU-US Data Privacy Framework (for certified providers) or on the European Commission's Standard Contractual Clauses, with supplementary measures (encryption in transit and at rest). You can request a copy of the safeguards at privacidad@socratista.com.
4.4. Other recipients. Public authorities, judges and courts where there is a legal obligation; professional advisers under confidentiality; and, in the event of a merger or acquisition, the acquirer, with prior notice.
We do not sell your data nor share it with third parties for their own advertising.
5. How long we keep your data
| Data | Period |
|---|---|
| Account and profile | While the account is active. After cancellation, blocked for 3 years (limitation period for liabilities) and then deleted |
| Face photo | While the account is active or until you delete or replace it from your profile; deleted together with the account (not kept blocked) |
| Audio/video recordings of sessions | 12 months from the session, or earlier if you cancel your account and request it |
| Identifiable transcripts and sheets | While the account is active; anonymised or deleted upon cancellation |
| Anonymised transcripts and derived materials | No time limit (they are no longer personal data) |
| Trained AI models | No limit. Withdrawing consent prevents future uses of your data but does not affect models already trained, from which your data cannot be extracted |
| Billing data | 6 years (Commercial Code) / 4 years (tax regulations) |
| Technical and security logs | 12 months |
| Consents and acceptance of terms | While the account is active + 3 years, as proof of compliance |
6. Your rights
You can exercise at any time, free of charge, the rights of access, rectification, erasure, objection, restriction of processing, portability and to withdraw consent (without retroactive effect), by writing to privacidad@socratista.com from your account email, or attaching an identity document if you write from another address. We will reply within one month at most.
You can also:
- Manage your optional consents (communications) from your profile, in one click.
- Object to the recording of a specific session before it starts.
- Request the early deletion of a recording in which you appear.
- File a complaint with the Spanish Data Protection Agency (www.aepd.es) if you consider we have not honoured your rights.
If you access through an Institution, you can exercise your rights before it or before us; we will coordinate to assist you.
7. Security
We apply appropriate technical and organisational measures: encryption in transit (TLS) and at rest, role-based access control, secure authentication, activity logs, backups, minimisation of the data sent to AI providers and processing agreements with all of them. No system is infallible; if a breach occurs that poses a risk to your rights, we will notify you in accordance with art. 34 GDPR.
8. Minors
Socratista is aimed exclusively at people over 18. We do not knowingly process minors' data. If we detect a minor's account, we will delete it.
9. Changes to this Policy
We will notify you of relevant changes by email or on the Platform. If a change involves a new purpose requiring consent, we will ask you for it expressly.
10. Questions
Write to us at privacidad@socratista.com.