1. Contact

Questions or requests: office@hemy-hebrew.com

2. Information We Collect

• Account Data: name, email, profile, image.
• Scheduling Data: bookings (date/time/duration/status), preferences, timezone.
• Payment Metadata: purchased credit / AI packs, balances (we do not store full card numbers).
• Google Calendar Data: only if you connect (see section 4).
• Whiteboard Session Data (ephemeral): real‑time strokes, shapes, text annotations, session ID and participant IDs; automatically deleted when the session ends unless you explicitly save a snapshot (see section 4A).
• Technical & Security Logs: timestamps, error diagnostics, auth events, access control decisions.
• Optional Support Communications: messages you send to support (email / WhatsApp).

3. Legal Bases (EEA/UK where applicable)

• Performance of a contract – providing lesson scheduling & credits.
• Legitimate interests – service improvement, fraud & abuse prevention, security monitoring.
• Consent – Google Calendar connection & related event creation.
• Legal obligations – accounting, tax & compliance retention.

4. Google Calendar Data Use

If you connect your Google account, we request the minimal scope https://www.googleapis.com/auth/calendar.events to create, update and delete only lesson events you schedule through Hemy Hebrew. We do not read unrelated events or use wide calendar scopes.

• Accessed: event IDs and Meet link we create.
• Stored: encrypted refresh token, our created event IDs and links.
• Not Stored: other event contents or attendee lists.
• Revocation: disconnect inside the app or via Google Account Permissions.

Limited Use Compliance: Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use. We do not use Google user data for advertising, profiling, sale, or unrelated purposes.

4A. Whiteboard Add‑On (Collaborative Board)

The optional whiteboard add‑on allows lesson participants to draw and add text annotations in real time. Use is limited to the teacher and the enrolled student(s) in that session.

• Ephemeral Data: strokes, shapes and text exist only in volatile real‑time storage during the active session.
• Optional Snapshot: a PNG (or similar) image plus session ID and timestamp is stored only if a participant explicitly presses a save/export action. If no snapshot is saved, content is deleted automatically when the session ends.
• No File Uploads: the whiteboard does not accept external file uploads or arbitrary media.
• Not Collected: audio, video, keystrokes outside the board, or unrelated browser data.
• Purpose: provide collaborative lesson functionality; not used for advertising or profiling.
• Deletion: on account deletion we remove (or irreversibly anonymize) any saved snapshots linked to that account.

If you wish a previously saved snapshot to be removed sooner, email office@hemy-hebrew.com with the approximate lesson date.

5. How We Use Information

• Operate lesson booking, credits / AI features, reminders & calendar sync.
• Create Google Calendar events (with Meet links) for booked lessons.
• Maintain security (fraud detection, abuse prevention, access auditing).
• Improve reliability, performance and user experience.

6. Sharing

We do not sell personal data. We share data only with service providers performing services on our behalf (e.g., Firebase / Google Cloud Platform, payment processing infrastructure) under terms requiring confidentiality and appropriate safeguards. We may disclose data when required by law or to protect safety, rights, or integrity of the service.

7. Data Retention

• Account & scheduling records – retained while the account is active.
• Google OAuth tokens – deleted immediately when you disconnect or delete your account.
• Backups / logs – rotated & purged normally within 90 days unless required for security investigations.
• Financial / transaction records – up to 7 years where legally required.

8. Security

• Transport encryption (HTTPS).
• Firestore security rules & role-based access logic.
• Principle of least privilege for service accounts.
• Audit logging of sensitive operations.

9. Your Rights & Controls

• Access / Correction – email us.
• Deletion – see Data Deletion Instructions.
• Revoke Google access – in-app disconnect or Google permissions page.
• Export – request a machine-readable export (JSON/CSV).
• Objection / Restriction (where applicable) – contact us.

10. Children

The service is not directed to children under 13. If we learn we collected data from a child under 13, we will delete it promptly.

11. International Transfers

Data may be processed in the European Union and/or United States on Google Cloud infrastructure with appropriate safeguards.

12. Changes

We may update this Policy. Material changes will be indicated by updating the "Last Updated" date. Continued use after changes constitutes acceptance.

13. Contact / Data Protection Queries

Email: office@hemy-hebrew.com