Privacy Policy

Mezra ("we," "us," "our"), operated by Rashida Newbill, a sole trader (autónoma) based in Barcelona, Spain, respects your privacy. This policy explains what data we collect, why, and how it's handled, in accordance with the EU General Data Protection Regulation (GDPR) and Spain's LOPDGDD. We are the data controller for the personal data described below.

1. Data We Collect

• Account information: name, email, password (encrypted)
• Purchase history and product access records
• Course progress and activity data
• AI Tutor conversation content (text and voice), for the purpose of providing feedback and improving the service
• Booking information, if you book a live 1:1 or group session
• Payment information: handled directly by Paddle and Stripe — Mezra does not store your card details

2. How We Use Your Data

• To provide access to purchased products and track your course progress
• To operate the AI Tutor and generate personalized feedback
• To communicate with you about your account, purchases, or support requests
• To improve our courses and platform

3. Third-Party Processors

We use the following processors to operate Mezra:

• Paddle.com — payment processing and Merchant of Record for digital product sales
• Stripe — payment processing for 1:1 and group session bookings
• Supabase — secure database and authentication hosting
• Anthropic (Claude API) — powers AI Tutor conversational features; conversation content may be processed by Anthropic's API to generate responses
• ElevenLabs — processes AI Tutor voice audio for speech-to-text and text-to-speech
• Cal.com — manages scheduling for live 1:1 and group sessions
• Vercel — hosts the website and its underlying infrastructure

4. Children's Data

Some Mezra products are designed for children under 18 (e.g., Mezra Cub, ages 5+). Accounts for users under 18 must be created and managed by a parent or legal guardian, who provides consent for data collection on the child's behalf. We collect only the data necessary to provide the educational service and do not use children's data for advertising. Free story content does not require creating an account. If we learn a child has provided personal information without appropriate parental consent, we will delete it — parents can contact us at hello@mezra.org to review, correct, or delete their child's information at any time.

5. Data Retention

We retain account and course data for as long as your account is active, plus a reasonable period afterward for legal and accounting purposes. You can request deletion of your data at any time (see Section 7).

6. Data Security

We use industry-standard security practices, including encrypted storage and access controls (via Supabase), to protect your data.

7. Your Rights

Under GDPR, you have the right to access, correct, delete, or export your personal data, and to withdraw consent at any time. To exercise these rights, contact hello@mezra.org. You also have the right to lodge a complaint with the Spanish data protection authority (AEPD) or your local supervisory authority.

8. International Data Transfers

Some of our processors (e.g., Anthropic, ElevenLabs) may process data outside the EU. Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Cookies

We use only the minimal cookies/local storage necessary to keep you signed in and remember your language preference. We do not currently use third-party advertising or tracking cookies.

10. Contact

Questions about this policy or your data: hello@mezra.org