Last updated: October 27, 2026
Legal Notice · Privacy Policy · Terms of Service · Cookie Policy
alinaflow is operated by Gabriel Labrada Cary, a sole trader (autónomo) established in Spain, and is therefore subject to the EU General Data Protection Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), regardless of where our customers are located. This policy explains what personal data we process, why, and the rights you have.
Controller: Gabriel Labrada Cary (trade name "alinaflow") - NIF Y9661599A - Passeig de la Reina Elisenda de Montcada, 13, 08034 Barcelona, Spain.
Contact for data protection: hello@alinaflow.com. We have not appointed a Data Protection Officer (DPO), as our processing does not meet the thresholds of Article 37 GDPR.
As Controller, we process the personal data of our own customers, prospects, and website visitors (account and billing details, support requests, marketing and analytics).
As Processor, we process the personal data that our customers (music, art and dance schools, tutoring centers and more) enter about their own students, families, and staff. In that case the customer is the Controller and decides why and how the data is used; we act only on their documented instructions under a Data Processing Agreement (Article 28 GDPR), which we make available to every customer.
Account & billing: name, email, workspace details, and payment information (processed by our payment providers - we do not store full card numbers).
Usage & analytics: pages visited, features used, device and approximate location data, collected via analytics cookies (see our Cookie Policy).
Communications: the content of messages you send us (email, chat, support).
alinaflow app and push notifications: when a family member or teacher uses the alinaflow app for iPhone and allows notifications, we keep a record of that install on behalf of their school: the push subscription id our notification provider assigns, whether notifications are allowed, and when the app was last used. Notifications are addressed with a pseudonymous id derived from the account, never with a name, email address or phone number. The notification software in the app also records basic device details (device type, operating system, language) and when a notification is delivered and opened. The text of a notification, such as a reminder that names a lesson and its time, passes through the providers listed in section 5 to reach the phone. The app does not use advertising identifiers, location or contacts, and does not track you across other apps or websites. An install record is deleted when you sign out of the app, when you delete your account, or after 180 days without use.
alinaflow app for ChatGPT: when someone on a school's team connects their alinaflow account to ChatGPT, ChatGPT can ask alinaflow about the school on their behalf, with the same role and permissions they have in the app. Each answer carries only what the question needs, such as names, classes and schedules, enrollment and attendance, balances and invoices. Email addresses and phone numbers are returned only when the user asks how to contact a family or a teacher. Health information, government and tax identification numbers, bank details, dates of birth, home addresses and internal account identifiers are never sent to ChatGPT. What ChatGPT receives is handled by OpenAI under its own terms with that user, and the connection can be removed at any time from ChatGPT.
Customer content (as Processor): the student, family, and staff records our customers enter - names, contact details, enrollment, attendance, and payment history. This may include data of minors, which the customer (as Controller) is responsible for collecting lawfully, including obtaining any parental consent required.
We do not sell your personal data. We share it only with service providers who help us run alinaflow, under contracts that require them to protect it:
alinaflow connects to Google Workspace APIs only when you explicitly authorise it, so the product can read and send email from your own mailbox, create Google Meet links for your classes, and export files you choose to your Google Drive.
alinaflow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Specifically:
Our platform is hosted on AWS infrastructure in the United States (US-East region), and some providers above are located outside the European Economic Area. Where personal data of EU/EEA individuals is transferred outside the EEA, the transfer is protected by an adequacy decision or by appropriate safeguards, in particular the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework to which our main providers (including AWS) are certified.
We keep account data for as long as your account is active. Customer content is deleted within 30 days of account closure or upon the customer's request, except where we must keep certain records (e.g. invoices) to comply with tax and accounting law. Analytics data is retained in aggregated or anonymized form.
Under the GDPR you have the right to access, rectification, erasure, objection, restriction, portability, and to withdraw consent at any time. To exercise them, email hello@alinaflow.com. If the data concerns a student or family member of one of our customers, we will refer your request to that customer (the Controller).
You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es, or with your local supervisory authority.
Families and teachers who sign in to a school's Portal, on the web or in the alinaflow app, can delete their login at any time, in either of two ways:
What is deleted straight away: your login and every session on every device, your notification choices, your app installs and push registrations, your Portal notifications, your profile photo, your sign-in codes, and your conversations with Alina, the AI assistant, if you used it. Your name and email address are removed from the login.
What stays with your school: the school is the Controller of the records it keeps about you and your family, such as students, enrollments, attendance, invoices and payments, so deleting your login does not erase them, and the school may be required by law to keep some of them, such as invoices. The school is told that you deleted your login. To have those records corrected or erased, contact your school, or write to us at hello@alinaflow.com and we will pass your request on. Copies held in our encrypted backups expire on their regular rotation.
United States: where our customers handle student education records, we support their compliance with applicable laws such as FERPA by acting only as a service provider and not using student data for our own purposes.
Brazil: we apply equivalent safeguards consistent with the Lei Geral de Proteção de Dados (LGPD) for personal data of individuals in Brazil.
All data is encrypted in transit and at rest. Each workspace is logically isolated, and we apply access controls, monitoring, and industry-standard security practices (Article 32 GDPR). In the event of a personal data breach affecting your rights, we will notify the AEPD and, where required, the affected individuals, without undue delay.
We use strictly necessary cookies plus analytics cookies. Analytics cookies (Google Analytics) are only set after you give consent through our cookie banner. See our Cookie Policy to review and change your choices.
We may update this policy from time to time. We will notify you of significant changes by email or a notice on the platform, and the "last updated" date above will reflect the latest version.
For any question about this policy or how we handle your data, contact hello@alinaflow.com.