Privacy Policy
Effective date: 20 August 2026 · Version 1.0
1. Who we are
YAKKI EDU ("YAKKI", "we", "us") is an educational application for language learning by school-age children. At this stage the data operator is Baruch Chazon, acting as a private individual (Israel). For any data-related questions, contact us at [email protected].
2. Who this policy applies to
YAKKI operates on a teacher-mediated model: student accounts are created by the Teacher or School, who obtain parental consent. Our users are Teachers (adults), Students (children), and Parents.
3. What data we collect
- When a student is enrolled (entered by the Teacher): the parent's email, a nickname, and the child's age. The password is generated automatically and sent to the email provided.
- When a Parent activates the account: the child's age and the fact and date of consent (the legal basis for processing).
- During learning: answers and entered text, speech (audio for pronunciation assessment and recognition), results, scores, progress, collected words, and typical errors (the learning profile).
- Technical data: a random device identifier (not an advertising identifier, not ANDROID_ID or IMEI), device model and version; an IP address only when a contact form is submitted (to protect against abuse).
We do NOT collect: precise geolocation, phone number, advertising identifier, or contacts. We do not run advertising or third-party analytics, and we include no advertising SDKs.
4. How we use data
Exclusively for educational purposes: teaching, assessment, personalization, and the learning profile.
We do NOT show advertising, profile users for advertising, or sell data — and we do NOT use student data (text, speech, transcripts) to train AI models, neither we nor our subprocessors. Processing is carried out under contract with the use of data for model training switched off.
5. Children's data (special protection)
- All students are treated as minors with the highest level of protection. The consent threshold is 16 years (with an additional "under 13" rule for COPPA).
- Parental consent is obtained by the Teacher or School before a child is given access; for contexts without a school, consent is obtained directly from the Parent. The Parent is notified of the data collection (the email provided when the student is enrolled serves as the notification channel).
- Right to withdraw: a Parent may withdraw consent at any time; processing then stops and, on request, the data is deleted.
- Content safety: learning content is generated by AI with the provider's child-content filtering enabled (Microsoft Azure). Final pedagogical decisions are made by a human (the Teacher), not by AI.
6. Who we share data with (subprocessors)
We share data only with service providers acting under a data processing agreement (DPA) that obligates them not to retain data beyond what processing requires and not to train models on it. We do not share data with advertisers, data brokers, or third-party trackers.
| Subprocessor | What it receives | Purpose | Residency |
|---|---|---|---|
| Microsoft Azure OpenAI | Student answer text | Generating learning content; checking and assessing answers | EU (Sweden Central, Data Zone) |
| Microsoft Azure Speech | Student speech (audio) plus the reference text | Speech recognition (STT) and pronunciation assessment | EU (Sweden Central) |
| Google Cloud Text-to-Speech | System text to be voiced (tasks, words) — not the student's personal data | Speech synthesis for playback | Global (receives system content, not children's personal data) |
| Zoho Mail (SMTP) | Email addresses and message bodies (account details, notifications) | Delivering account details and notifications to the Parent | Zoho email infrastructure |
| Google Cloud (backend hosting) | All application data (storage) | Hosting the YAKKI service and database | Israel (Tel Aviv region, me-west1) |
Speech (voice): processed solely for speech recognition and pronunciation assessment; it is not used for biometric identification, and no voiceprint is created. Audio is not stored on our servers — it is passed to the provider and then deleted. Processing of children's speech takes place in the EU (Microsoft Azure, Sweden Central).
7. Where data is stored and processed
- Storage: application data (including student data) is stored on YAKKI's servers in Israel (Google Cloud, Tel Aviv region,
me-west1). Israel has been recognized by the European Commission as a country providing an adequate level of data protection (an adequacy decision), so transferring children's data from the EEA to Israel is lawful without additional mechanisms. - AI processing (content generation, speech recognition, and assessment): in the EU (Microsoft Azure, Sweden Central region) — children's data from the EEA does not leave the EU during AI processing.
- Speech synthesis (TTS) is performed by Google on the system text of tasks and words — the student's personal data is not sent there.
8. Retention periods
- AI verification events (request/response) — 7 days, then automatically deleted.
- Speech audio — not stored (processed and deleted).
- Learning results, profile, and errors — until the account is deleted; kept no longer than necessary for the educational purpose.
- Consent records — for the duration of the relationship and thereafter as needed to establish or defend legal claims.
- IP addresses from the contact form — within the retention period of our technical logs.
9. Your rights
You have the rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and the right not to be subject to a significant automated decision without human involvement. On a child's behalf these rights are exercised by the Parent or guardian (in a school, under the School's policy). Our response time is 30 days. Contact channel: [email protected].
10. Account deletion
Deletion is available from within the application (a Teacher deletes a student's account in the teacher area; a user can delete their own) and at a public address:
- https://api.yakki.app/en/delete-account.html (EN) / https://api.yakki.app/ru/delete-account.html (RU).
We delete the learning records, answers, results, profile, and email traces. Narrow lawful exceptions (security logs) are kept for their own short retention period.
11. Security
Data in transit is protected with TLS/HTTPS; passwords are stored as a cryptographic hash (bcrypt); account secrets on the device are encrypted; access is role-based (a Teacher sees only their own students). We apply reasonable technical and organizational measures. No system is perfectly secure, but we protect children's data in proportion to the risks.
12. No advertising or trackers
YAKKI EDU contains no advertising, no advertising identifiers, and no third-party advertising or analytics SDKs, and it does not perform behavioral targeting. We do not sell data.
13. Changes to this policy
For material changes (including a new subprocessor or an expansion of children's data processing) we give advance notice; any expansion of children's data processing requires renewed parental consent.
14. Contact
[email protected] — for privacy questions and for exercising data-subject rights and deletion.