Privacy Policy

This policy explains what personal data Athenion collects, why, who receives it, how long we keep it, and how you can control it. The Spanish version is the legally binding one: if the two versions differ, the Spanish version prevails, because the operator is based in Peru.

1. Who is responsible

The controller of your data (the owner of the personal data bank) is:

• Name: Leonardo Jesus Ferreyra Canaval
• ID: RUC (Peruvian taxpayer number) 10728483844
• Address: Av. Colombia 930, Pueblo Libre, Lima, Perú
• Privacy contact: [email protected]
• Data bank registration (ANPD, Peru): in progress

Athenion is an AI tutor web app at https://athenionlearn.app, with a landing site at https://athenionlearn.com. The operator is an individual (persona natural) based in Peru.

2. Scope and age

This policy applies to the app, the landing site and support emails. You must be 18 or older to use Athenion. We do not knowingly collect data from minors. If we learn that a minor has signed up, we delete their data (see section 14).

Access is currently invite-only (beta). For now we offer individual accounts only. If institutional or school plans arrive later, they will have separate agreements.

3. What data we process

Account data. Email, name, sign-in provider ID, language and timezone.

Learning content. The topics you study, your roadmap or plan, concept notes (including what you write in your own words), chat messages with the AI tutor, answers to quizzes and checks, flashcard reviews, exercise attempts and the code you write in practice workspaces, and portfolio projects.

Measured learning profile. Aggregated statistics about which teaching interventions worked for you. We use it only to personalize how we teach you. This is a form of profiling. It does not produce decisions with legal or similarly significant effects on you (see section 6).

Usage and cost metering. How many AI tokens your account uses each month, to apply fair-use limits.

Technical logs. IP addresses and request metadata at the network edge and in server logs, kept for a short time.

Invite requests. When you ask for an invite on the landing page: email, language, an optional note, a hashed IP address and the time of the request.

Support emails. What you send us and our replies.

Payment data (future). When paid plans start, payments will be handled by a merchant of record (see section 8). We will not see your full card number.

Please do not type sensitive personal data (health, beliefs, biometrics, and the like) into chats or notes. Athenion does not need it.

4. Why we use your data, and on what basis

For users in Peru, the basis is your consent and the performance of the service you asked for, as set out in Ley 29733 and its regulation. For users in the EU/EEA, the bases are those of GDPR Article 6 (contract, legitimate interests, legal obligation, consent).

Where we rely on your consent, you can withdraw it at any time. That does not affect processing that already took place.

We do not run advertising. We do not sell your data.

5. Sign-in with Google or Microsoft

You can sign in with Google, Microsoft, or a 6-digit code sent to your email. Sign-in is handled by Supabase Auth.

From Google or Microsoft we receive only basic profile data: your email, your name and whether your email is verified (scopes openid, email and profile). We use it only to sign you in and identify your account.

Google user data: we do not sell it, we do not use it for advertising, we do not use it to train AI models, and we do not share it except with the processors needed to run the service (section 8).

Athenion's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. AI processing and profiling

Athenion is powered by AI models. To produce a lesson, a reply or feedback, we send the relevant text (lessons, chats, answers, notes) to our AI provider, Anthropic, through its API.

• AI output can be wrong. See our Terms of Service.
• We do not train AI models on your data. Under Anthropic's commercial terms, API inputs and outputs are not used to train its models by default.
• We use the learning profile only to adapt teaching. We make no decisions that produce legal or similarly significant effects on you based only on automated processing. If you disagree with how the tutor adapts, you can tell us at [email protected], and a human will review it.
• We keep AI call traces (self-hosted, using Phoenix) for debugging and quality. They are short-lived (section 9).

7. Cookies and local storage

We do not use advertising or tracking cookies, and we have no analytics trackers. We use only what is strictly necessary:

• session and sign-in tokens, kept in your browser storage;
• a language preference cookie;
• an editor-session cookie for practice workspaces;
• security cookies from Cloudflare.

Because these are strictly necessary, we do not show a cookie banner.

8. Who receives your data (processors)

Our payment provider will be named here before payments start. We also host the following ourselves, with no third party: the database, the practice workspaces, and AI call tracing (Phoenix).

Cloudflare Turnstile protects the invite form from bots. Its data handling is described in the Cloudflare Turnstile Privacy Addendum.

We share data with these providers only as needed to run the service, and under agreements that require them to protect it. We may also disclose data when a competent authority legally requires it.

9. International transfers

Our providers are located mainly in the United States, and our server is in the United States (US-East region). This means your data leaves Peru, and, for EU/EEA users, leaves the EU/EEA.

We rely on safeguards such as data processing agreements, standard contractual clauses and, for US providers, their certification under the EU-US Data Privacy Framework where available.

10. How long we keep data

• Account and learning data: while your account exists. After you delete your account, we delete it within 30 days. Backups roll off within 14 days after that.
• Server and AI-tracing logs: up to 30 days.
• Invite requests: until handled, and at most 12 months.
• Billing records: as long as tax law requires. Our payment provider holds them.
• Support emails: as long as needed to resolve your request, then deleted.

11. Security

We use TLS on all connections, limit access to the operator only, apply least privilege, and keep backups. No system is perfectly secure, but we work to protect your data.

If a security incident affects your data, we will notify the Autoridad Nacional de Protección de Datos Personales (ANPD) and affected users within 48 hours of becoming aware of it, as required by law.

12. Your rights

You have the right to:

• access your data;
• rectify inaccurate data;
• cancel/delete your data;
• object to processing;
• portability: you can export your notes as Markdown (an Obsidian vault) at any time from the app;
• withdraw consent at any time;
• be informed about automated processing and profiling.

EU/EEA users also have the right to restrict processing and to lodge a complaint with their supervisory authority.

How to exercise them: email [email protected] from the email address of your account. We may ask you to confirm your identity. You can also delete your account from the app.

Deadlines: we reply within the deadlines of Peruvian law: 8 working days for information requests, 20 working days for access requests, and 10 working days for rectification, cancellation and opposition requests.

Complaints: you may complain to the Autoridad Nacional de Protección de Datos Personales (ANPD) in Peru, through the Ministry of Justice, or, if you are in the EU/EEA, to your local supervisory authority. We would appreciate the chance to fix the problem first.

13. Data you must provide

To use Athenion we need your email and a way to sign in. Without them, we cannot create your account. Everything else (such as notes or your learning content) is created by your use of the service. Joining the invite list requires your email; the note is optional.

14. Minors

Athenion is for people 18 and older. If we learn that someone under 18 has signed up, we will delete their account and data. If you believe a minor is using Athenion, write to [email protected].

15. Changes to this policy

If we make a material change, we will notify you by email or in the app at least 15 days before it takes effect. For changes that affect price, we will notify you before your next charge. The date at the top shows the latest update.

16. Contact

Privacy and rights requests: [email protected] General support: [email protected] Operator: Leonardo Jesus Ferreyra Canaval, Av. Colombia 930, Pueblo Libre, Lima, Perú