Sabboura is a school tutor used mostly by secondary school students, and therefore by minors. We collect as little data as possible, we do not sell it, we do not show advertising, and we host it in the European Union. This policy explains what data we process, why, for how long, and how to exercise your rights.
1. Who is responsible for your data
The data controller is InnoviaBurst, SUARL (single-member limited liability company) (tax identification number 1985775A), national business register number: (registration in progress), with its registered office at Rue Habib Thameur, Résidence Haj Dahman, Étage 1, Jendouba Sud, 8100 Jendouba, Tunisia (“Sabboura”, “we”).
Contact for any question about your data: privacy@innoviaburst.com.
The processing is declared to the National Authority for the Protection of Personal Data (INPDP) in accordance with Organic Law No. 2004-63 of 27 July 2004; reference: (registration in progress).
2. Students under 18 and parental consent
A student under 18 may only use Sabboura after their parent or legal guardian has given consent. The parent creates the family account, invites the student, and gives consent before the first session; they may withdraw this consent at any time, which immediately freezes the student’s account.
We use the age of 18 because Tunisian law protects a child’s data up to that age; this is more protective than the threshold of 16 in the European regulation (GDPR, Article 8), which we therefore also meet for families living in the European Union.
We do not ask a student under 16 for an e-mail address: the parent’s account is enough.
3. The data we process
- Parent: first name, e-mail address, language, the household and the students linked to it, the prepaid cards bought, the sessions left and the payment status (never the bank card number: it stays with the payment provider).
- Student: first name, year and section (for example bac sciences), language; an e-mail address only if they are 16 or older and wish to give one.
- Sessions: the questions written or spoken aloud and their transcription, the tutor’s answers, what was drawn on the board, the length of the sessions, the chapters worked on, the summaries and the estimated level of mastery.
- Voice: the audio of the question is transcribed live, then discarded: we do not record the student’s voice, only the transcribed text is kept.
- Photos of exercises sent by the student.
- Technical data: an activity log (sign-ins, sessions, payments, consents) with the IP address truncated (the first three numbers of an IPv4 address), the full address only for security events (failed sign-ins, refused questions, payments); the web server logs with the IP address truncated to its first two numbers; error reports with no IP address, e-mail address or session content. [For the “one device per account” rule: what identifies the device and how long it is kept, to be confirmed by the owner.]
We do not collect a postal address, a telephone number, a photo of the student or their location. Please do not write any of these in questions: the tutor never asks for them.
4. Why, and on what basis
- Providing the tutoring (understanding the question, answering by speaking and drawing, keeping track of the session): performance of the contract with the parent, and the parent’s consent for a student under 18.
- Progress reports for the parent (time spent, chapters, summaries): performance of the contract.
- Invoicing and accounting: legal obligation.
- Security, prevention of abuse, correction of errors: legitimate interest, with data kept to a minimum.
- Improving the explanations: only from de-identified session extracts (no name, voice or photo), and the parent may object to this at any time.
No advertising, no commercial profiling, no sale or rental of data.
5. Who has access to it
The Sabboura team, within the limits of what each task requires. And processors that provide us with a service, bound by contract and unable to use the data for their own purposes:
- Hetzner Online (Germany): hosting of the servers, the database and the encrypted backups.
- Anthropic (United States): the AI model that writes the explanations (text of the questions and context of the session). The data is not used to train its models.
- Deepgram (United States): transcription of voice into text, outside its model improvement programme: the audio is never used to train its models.
- Microsoft Azure (France region): the tutor’s voice (synthesised from its answers).
- Scaleway (France, Paris): sending e-mails (the sign-in link and code, invitations, the weekly report); it receives the address and the message.
- fal.ai (United States): some illustrations, from a description containing no personal data.
- [Payment method to be confirmed]: payments; the provider collects the payer’s details itself.
- Sentry (European Union region): error reports, with no IP address, e-mail address or session content.
6. Transfers outside Tunisia
The data is stored in the European Union (Germany). Some of it is processed in the United States by the processors listed above, for the time needed to provide the service. These transfers take place under Organic Law No. 2004-63 and the INPDP’s authorisation (reference: (registration in progress)), and, for families in the European Union, under the European Commission’s standard contractual clauses or the EU–US Data Privacy Framework.
7. How long
- Student’s voice: not kept. Tutor’s audio: 24 hours (cache).
- Account, sessions, transcriptions, summaries, reported boards: as long as the account exists; erased 30 days after the account is deleted (until then, the deletion can be cancelled on request).
- Activity log: 30 days; security events (with the full IP address): 90 days.
- Refused questions (their type only, never their text): 12 months. Reported boards that have been handled without being used for evaluation: 12 months afterwards.
- Unconfirmed address on the waiting list: 7 days. Invitations: 90 days after they expire. Unfinished registration: 1 day after the link expires.
- Log of the team’s actions (who did what in the administration area): 12 months.
- Encrypted backups: 30 days, then erased.
- Server logs and error reports: 90 days at most.
- Invoices and proof of payment: the period required by accounting law (10 years).
8. Your rights
The parent (and the student) may request access to their data, its correction or its deletion, object to processing, withdraw their consent, and, for families in the European Union, request restriction and portability.
On the progress page, the parent can download, as a single file, all the data of each child and of their own account, and can delete the family account; the data is erased within the periods above.
For anything else, write to privacy@innoviaburst.com from the parent account’s address. We reply within one month at most.
You may also contact the INPDP (Tunisia) or, in the European Union, the data protection authority of your country (in France: the CNIL).
9. Security
Encrypted connections (HTTPS), a database on a private network not exposed to the Internet, encrypted backups whose key is kept offline, limited and logged access, IP addresses truncated in the logs. In the event of a data breach that presents a risk, we inform the parents concerned and the authorities within the time limits set by law.
11. Changes
We inform parents by e-mail before any significant change. If it affects the student’s data, we ask for the parent’s consent again.
This policy exists in Arabic, French and English; in the event of any difference, the Arabic version prevails.