TrulySpeak privacy
Privacy and Data Protection Policy
Last updated 30 August 2026. This notice explains how personal data is processed across the marketplace, accounts, applications, lessons, communications, payments and Staff functions.
1. Controller
The data controller for TrulySpeak is the current operator identified in the Legal Notice.
- Controller
- Gabriel David Vasquez Alcantara
- Address
- Carrizal, Edo. Miranda, Venezuela
- Privacy contact
- admin@trulyspeak.com
2. Data we process
Account and identity
Name, email, identifiers, roles, authentication, account status and session/security information.
Student profile
Photo, description, learning and spoken languages, goals, timezone and supported preferences.
Tutor and applicant
Profile, photo, languages, specialties, price, availability, introduction media, application, moderation, publication and genuinely collected verification information.
Lessons and bookings
Participant identifiers, references, times, timezone, duration, states, cancellations, reschedules, reports, attendance and supported lesson records.
Communications
Participants, messages, read or pinned state, notifications, support content and relevant metadata.
Financial
Ledger entries, amounts, holds, refunds, Tutor earnings and payouts, and provider references. TrulySpeak does not claim to store full payment-card data handled by PayPal.
Technical and Staff operations
IP address where processed, device/browser data, timestamps, logs, security events, audit records, role assignments, moderation and incidents.
3. Purposes and legal bases
| Purpose | Typical legal basis |
|---|---|
| Accounts, profiles, applications, availability, lessons, messages, payments and refunds | Contract or steps requested before contract; legal obligations where applicable |
| Public Tutor discovery and marketplace operation | Contract and legitimate interests |
| Accounting, tax, fraud, security, audit, support and disputes | Legal obligations and legitimate interests |
| Optional product analytics and campaign attribution | Consent |
| Public approved Tutor media | Contract and any additional lawful basis required for the specific publication |
Consent is not used as a blanket basis for ordinary account or contract processing.
4. Public profile information
Approved Tutor profile fields and introduction media are public. Private identity, KYC and payout data are excluded from the public projection. Student information is not public except through an intentionally bounded supported feature.
5. Recipients
Data is disclosed only as needed to the lesson counterpart, authorized capability-scoped Staff, infrastructure and storage services, configured payment providers such as PayPal, Google or Microsoft identity, email and communications services, Google Calendar/Meet, privacy-enhanced YouTube media, Cloudflare Turnstile, and professional or public authorities where legally required. Local mocks do not imply live transfer.
6. International transfers
Production processing uses providers located in EU and US. If processing transfers data outside the EEA, an applicable mechanism such as an adequacy decision or approved safeguards is used where required.
7. Retention
The product has finite, auditable schedules for applications and media, KYC metadata, messages, incidents, operational logs, audit, financial records and backups, with legal holds preventing premature removal. The current implemented schedule is: implemented finite hold-aware schedule (applications 730d, application media 365d, KYC 730d, messages 730d, incidents 2555d, logs 180d, audit and financial 3650d, backups 90d); account closure anonymizes identity; statutory periods pending professional confirmation. Account, profile, Session and closed-account data are retained only for their purpose and applicable legal, accounting, tax, security, dispute and limitation requirements.
8. Your rights
Subject to law, rights can include information, access, correction, erasure, restriction, portability, objection, direct-marketing objection, withdrawal of consent, and safeguards for qualifying solely automated decisions. Authenticated users should use the Privacy and data workspace for supported access, export, correction and closure actions. Identity verification may be required. External contact: admin@trulyspeak.com.
9. Complaints
You may contact TrulySpeak first and may complain to the competent supervisory authority, in particular in Spain where the controller is established or in your place of residence.
10. Automated decisions and profiling
The implemented product does not make a solely automated decision that is represented as producing legal or similarly significant effects. Tutor filtering, stable ordering, optional sorting, fraud signals and Staff review support do not replace authorized human decisions.
11. Security
Implemented safeguards include role and capability authorization, authentication and session controls, CSRF protection, audit/security logging, secure transport outside local development, immutable financial evidence and provider-boundary validation. No online service can guarantee absolute security.
12. Children
TrulySpeak’s initial release is adult-only. Account creation requires a declaration that the user is at least 18. No guardian-consent journey or service for children is implemented.
13. Changes
Material changes will be communicated as required by law and this page will show its updated date and version.
14. Contact
admin@trulyspeak.com