Privacy Policy

Last Updated: September 9, 2026

Arepa Spanish ("we," "us," or "our"), operated by Alexandria's Design LLC, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Platform at arepaspanish.com.

1. Information We Collect

1.1 Information You Provide

  • Account Information: When you create an account, our authentication provider, Clerk, processes information such as your name, email address, authentication credentials, and account identifier.
  • Payment and Subscription Information: Stripe collects and processes your payment details. We receive transaction and subscription information needed to provide access, such as payment status, purchased plan, dates, and Stripe customer or subscription identifiers. We do not store your full payment card number on our servers.
  • Support Communications: If you contact us, we may retain your email address, the content of your message, and information needed to answer or document your request.
  • Private Coaching Requests: If you request private coaching, we collect the information you enter in the form, including your name, email address, country or time zone, approximate Spanish level, goal, preferred start timing and intensity, weekly availability, participant type, and optional message. We also record the date and version of the required acknowledgment, any separate marketing choice, and limited referral or campaign information included in the page URL.
  • Optional AI Feature Content: If you choose to use the AI tutor, personalized examples, or pronunciation feedback, we process the text you submit or select, relevant lesson context, and the response generated for you. Please do not include sensitive personal information in free-text prompts.

1.2 Learning and Technical Information

  • Learning Progress: For signed-in users, we store lesson identifiers, section completion states, progress percentages, quiz and final-exam results, pass/fail status, and activity timestamps in our Neon-hosted database. This information is linked to your Clerk account identifier so your progress can be restored across sessions and devices.
  • Browser Storage: We also save a local copy of certain progress information, exam badges, and your theme preference in your browser's localStorage for faster loading and as a temporary fallback if server synchronization is unavailable.
  • Usage and Performance Data: Vercel may process hosting logs, request metadata, page views, referrers, filtered query parameters, approximate location derived from an IP address, device and browser information, timestamps, and performance measurements. Our Web Analytics reports are aggregated and are not connected to your Arepa Spanish learning profile.
  • Security and Rate-Limit Data: We use account identifiers for AI requests and a hashed combination of IP address and browser information for coaching requests, together with short-lived request timestamps, to prevent abuse and excessive requests. Upstash processes these rate-limit records when configured.

1.3 Pronunciation Practice

Pronunciation Practice uses the speech-recognition feature provided by your browser or device. If you choose to enable the microphone, that provider may process your speech according to its own terms. Arepa Spanish sends the resulting text transcript—not the raw microphone recording—to an AI service together with the target phrase and pronunciation guide to generate feedback. We do not intentionally store raw microphone recordings in our application database.

2. Service Providers

We use service providers to operate the Platform. They process information for the services they provide to us and under their own privacy terms.

2.1 Clerk — Authentication

Clerk handles account creation, sign-in, session management, and account metadata. Clerk Privacy Policy

2.2 Stripe — Payments

Stripe processes purchases, subscriptions, invoices, refunds, and payment methods. Stripe Privacy Policy

2.3 Neon — Learning and Coaching Database

Neon hosts the database used to store account-linked learning progress, quiz results, final-exam results, and private coaching requests. Neon Privacy Notice

2.4 Vercel — Hosting, Analytics, Performance, and AI Routing

Vercel hosts the Platform and provides Web Analytics, performance monitoring, server logs, and an AI Gateway that may route optional AI requests if the direct provider is unavailable. Vercel Web Analytics is configured without third-party tracking cookies and reports aggregated traffic information. Vercel Privacy Notice

2.5 OpenAI and OpenRouter — Optional AI Features

AI feature requests are normally sent to the OpenAI API. If that service is unavailable, a request may be routed through Vercel AI Gateway or OpenRouter to an available model provider. Depending on the feature, the request can include your tutor message, selected or written learning context, recognized speech transcript, vocabulary, and lesson context. We do not use these exchanges to build an advertising profile.

OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in, and that standard abuse-monitoring logs may be retained for up to 30 days. OpenRouter and the model providers available through it may apply different retention and training practices. Review their current policies and avoid submitting confidential or sensitive information. OpenAI API Data Controls and OpenRouter Privacy Policy

2.6 Upstash — Abuse Prevention

Upstash provides short-lived rate-limit storage used to protect AI and coaching request endpoints from abuse. Upstash Privacy Policy

2.7 Resend and Google Gmail — Coaching Communications

We use Resend to send our team a notification when you submit a private coaching request. The notification includes your name, email address, coaching request details, and a request reference. Your email address is used as the reply-to address so our team can respond. Notifications arrive in our Google Gmail inbox, where we review requests and communicate with you. These operational messages do not subscribe you to marketing. We store the notification identifier and acceptance time to track processing and prevent duplicate notices. Resend Privacy Policy · Google Privacy Policy

3. How We Use Information

We use information to:

  • Create and secure your account.
  • Deliver lessons and restore your saved progress across sessions and devices.
  • Preserve learning history if a subscription is canceled or expires.
  • Process purchases, subscriptions, cancellations, and refunds.
  • Evaluate and respond to private coaching requests, plan consultations, and document the outcome.
  • Provide optional AI tutoring, personalization, and pronunciation feedback when you request it.
  • Measure aggregated traffic, reliability, and performance so we can improve the Platform.
  • Respond to support, privacy, and account requests.
  • Send transactional communications such as receipts, security notices, and subscription changes.
  • Detect fraud, enforce usage limits, protect the Platform, and comply with legal obligations.

We do not sell personal information. If you affirmatively opt in to email marketing, we may send Spanish learning tips, course updates, progress-based reminders, and special offers. Marketing consent is optional and is not required to create an account or use the Platform. You can withdraw that consent at any time through the unsubscribe link in each marketing message. Transactional account and payment messages are separate from marketing and may still be sent when needed to provide the service.

4. Browser Storage

We use localStorage to save:

  • A local progress cache and quiz state.
  • Final-exam badge information.
  • Your light or dark theme preference.

You can clear this browser data through your browser settings. Clearing it does not delete the server copy of learning progress linked to your signed-in account. Likewise, clearing browser data on one device does not submit an account-deletion request or remove records that must be retained for legal or accounting purposes.

5. Cookies and Analytics

We use a limited number of technologies for essential operation and aggregated measurement:

  • Authentication Cookies: Clerk uses cookies to maintain your signed-in session. Blocking them can prevent protected course features from working.
  • Infrastructure Technologies: Vercel may use technical mechanisms needed for hosting, security, and reliable delivery.
  • Vercel Web Analytics: Vercel records aggregated page-view and device information without third-party cookies and does not associate the analytics record with an individual Arepa Spanish account.

As of the date above, we do not use advertising cookies, Meta Pixel, Google Ads conversion tags, or cross-site behavioral advertising. Before introducing advertising or marketing tracking, we will update this notice and implement any consent or choice controls required for the intended use and audience.

6. Data Retention and Deletion

  • Account and Learning Data: We retain this information while your account is active so we can provide the course and restore your progress. Canceling, refunding, or allowing a subscription to expire changes content access but does not by itself delete your account or learning history.
  • Browser Data: Local data remains on the device until you or the browser clears it.
  • AI Requests: We do not save tutor conversations, custom learning context, or pronunciation transcripts in our application database in the current implementation. AI and infrastructure providers may retain request content or metadata under their policies and configured data controls.
  • Payment and Legal Records: Stripe and Alexandria's Design LLC may retain transaction, refund, fraud-prevention, tax, and accounting records for the periods required by law or legitimate business obligations.
  • Support Records: We retain support and privacy communications as long as reasonably needed to answer the request, document its resolution, resolve disputes, and meet legal obligations.
  • Private Coaching Requests: We keep coaching request information only while it is needed to respond to your request or manage relevant follow-up, for up to 12 months after the last interaction related to your request. We delete it sooner when it is no longer needed. If you become a student, necessary service, contract and payment records are handled separately under their applicable retention periods. You can request deletion by emailing learnarepaspanish@gmail.com. We review deletion requests manually; records that must be retained for a documented legal obligation or dispute are handled separately. Provider logs and backup copies are subject to the providers' retention and deletion processes.

Account and server-data deletion requests are currently handled manually. Email learnarepaspanish@gmail.com from the address associated with your account. After verifying the request, we will delete or de-identify account and learning data within 30 days, except for records we must retain for legal, security, fraud-prevention, tax, accounting, or dispute-resolution purposes.

7. Your Privacy Rights

Depending on where you live, you may have the right to:

  • Access: Request information about or a copy of personal data we hold about you.
  • Correction: Request correction of inaccurate or incomplete information.
  • Deletion: Request deletion, subject to lawful retention exceptions.
  • Portability: Request a machine-readable copy where applicable.
  • Restriction or Objection: Ask us to restrict or object to certain processing.
  • Withdraw Consent: Withdraw consent for future processing where consent is the legal basis.

To submit a request, contact learnarepaspanish@gmail.com. We may need to verify your identity and will respond within the timeframe required by applicable law.

8. California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

8.1 Categories of Personal Information

Depending on how you use the Platform, we may process:

  • Identifiers: Name, email address, account ID, and online identifiers.
  • Commercial Information: Purchased plan, payment status, subscription, cancellation, and refund records.
  • Internet or Network Activity: Pages visited, referral information, device data, logs, and performance measurements.
  • Learning Activity: Lesson progress, section states, quiz scores, final-exam results, and activity timestamps.
  • Communications and User Content: Support messages, coaching request details, and content voluntarily submitted to optional AI features.
  • Approximate Location: General location inferred from an IP address for aggregated analytics or security.

We do not ask you to provide sensitive personal information through lessons or AI features. Please do not place health, financial, government-identification, precise-location, or other sensitive information in free-text fields, including the private coaching request form.

8.2 California Choices

  • Right to Know and Access: Request the categories or specific pieces of information we process.
  • Right to Delete: Request deletion, subject to legal exceptions.
  • Right to Correct: Request correction of inaccurate information.
  • Right to Portability: Request a portable copy where applicable.
  • Right to Opt Out of Sale or Sharing: We do not sell personal information or share it for cross-context behavioral advertising.
  • Right to Non-Discrimination: We will not discriminate against you for exercising applicable privacy rights.

8.3 Submitting a California Request

Email learnarepaspanish@gmail.com with the subject "California Privacy Request" and use the address associated with your account. We will respond within 45 calendar days, subject to permitted verification and extension procedures. An authorized agent may submit a request with appropriate proof of authority.

9. EEA, United Kingdom, and Other International Users

9.1 Legal Bases

Where applicable, we rely on:

  • Performance of a contract or steps requested before a contract: To create your account, provide courses, evaluate a coaching request, preserve progress, and process purchases.
  • Legitimate interests: To secure, operate, measure, and improve the Platform, manage coaching capacity, and prevent duplicate or abusive requests without overriding your rights.
  • Consent: For optional processing where consent is required, including marketing or advertising technologies.
  • Legal obligation: For tax, accounting, lawful requests, and other required processing.

9.2 International Transfers

Alexandria's Design LLC is based in the United States, and our providers may process information in the United States and other countries. Where required, transfers are handled using recognized legal mechanisms, which may include adequacy decisions, contractual safeguards, or provider data-processing terms.

9.3 Additional Rights

EEA and UK residents may also have the right to restrict processing, object to certain processing, withdraw consent, and lodge a complaint with their local data protection authority. Contact learnarepaspanish@gmail.com if you would like us to address a concern.

10. Children's Privacy

The Platform is intended for users aged 13 and older. Users between 13 and 17 must have a parent or legal guardian review these policies and authorize their use of the Platform where required. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it as appropriate.

11. Data Security

We use reasonable administrative and technical safeguards designed to protect information. No method of online transmission or electronic storage is completely secure, so we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy as our practices or legal obligations change. We will revise the "Last Updated" date and, where required, provide additional notice or request consent before applying a materially different use to information already collected.

13. Contact Us

For privacy questions or requests: