Privacy Policy

1. Who we are

Elyora is a platform where instructors publish video courses and students study them with an AI tutor. “We” means Elyora, which decides how the data described here is processed. “Your workspace” means the account an instructor or a school administers, together with the courses and material inside it.

2. What we collect

Only what the service needs in order to work:

• Account: your name, email address, a hash of your password or the Google account you signed in with, and your language and theme preferences.
• Workspace content: courses, modules, lessons, prices, branding, videos, documents, links and text you upload — along with the transcripts and search indexes we build from them.
• Study activity: which lessons a student opened, how far they watched, what they asked the tutor and what it answered.
• Payments: what a purchase was for, its amount and its status. Card numbers never reach us; Stripe handles them.
• Technical: IP address, browser, and timestamps in the server logs that keep the service running and secure.

3. Why we use it

• To run the service: serve your courses, play your videos, and keep each workspace separate from the others.
• To answer questions: the tutor searches your material and cites it.
• To show an instructor how their own students are doing — never another instructor's.
• To bill: plans, purchases and payouts.
• To write to you: invitations, password resets, receipts and service notices.
• To keep the service safe, and to meet tax and accounting obligations.

4. AI and transcription

Tutor answers, lesson summaries, the agent and the search index are produced by sending the relevant passages of your material, and the question asked, to OpenAI's API. Subtitles and transcripts of your videos are produced by Mux when the video is uploaded.

We do not sell your content, and we do not hand it to anyone to train AI models on. The tutor searches only inside the workspace of the course the student is studying.

5. Google user data

Signing in with Google gives us your name, email address and profile picture, and nothing more.

Connecting Google Drive is separate, optional, and available only to an instructor or administrator. It asks for read-only Drive access, and we use it for exactly two things: showing you a list of your files so you can choose, and downloading the ones you chose. A file you import becomes material in your workspace, exactly as if you had uploaded it from your computer.

We do not copy your Drive, do not index files you did not import, never write to your Drive, and never use Drive content for advertising or to train AI models.

We store the tokens Google issues so the connection survives a reload. You can revoke them whenever you like — “Disconnect” in the knowledge base, or Google's own permissions page at myaccount.google.com/permissions. Revoking ends our access immediately; files you already imported stay in your workspace until you delete them.

Elyora's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including its Limited Use requirements.

• drive.readonly — read-only access, used to list your files and download the ones you pick to import.
• userinfo.email — the address of the connected account, shown so you can see which Drive is linked.

6. Who else handles it

These providers process data on our instructions, for the purposes below and nothing else. We do not sell personal data and we do not share it with advertisers.

• Vercel — hosting and delivery of the application.
• Supabase — the database and the file storage that hold your workspace.
• Mux — video encoding, playback and automatic subtitles.
• OpenAI — embeddings, tutor answers, summaries and the agent.
• Stripe — checkout, subscriptions and instructor payouts.
• Google — sign-in, and Google Drive when you connect it.
• Our email provider — invitations, password resets and service notices.

7. Where it is processed

Elyora runs on infrastructure in Brazil and the United States, and the providers above may process data in other countries. Where data leaves Brazil or the European Economic Area it travels under the transfer safeguards those providers offer, such as standard contractual clauses.

8. How long we keep it

Workspace content stays for as long as the workspace does. Deleting a lesson or a file also deletes the transcript and the index entries built from it. Write to us and we will delete your workspace and everything in it within 30 days.

Two exceptions: records we must keep for tax and accounting law, and backups, which roll off on their own within 30 days.

9. Your rights

You can ask us to confirm what we hold, to correct it, to delete it, to hand it over in a portable form, or to stop a particular use. Write to the address at the end and we answer within 30 days. If you are in Brazil you may also complain to the ANPD; in the European Economic Area, to your local supervisory authority.

10. Security

Traffic is encrypted in transit, passwords are stored only as hashes, every query is scoped to one workspace, and access to production is limited to the people who need it. No system is perfectly secure; if a breach ever affects your data we will tell you and the authorities as the law requires.

11. Children

Elyora is not directed at children under 13, and we do not knowingly create accounts for them. A student below the age of majority where they live should use the service with a parent's or guardian's consent.

12. Cookies

Only the ones the product needs. There are no advertising or cross-site tracking cookies.

• Session: keeps you signed in.
• Language and theme: remembers the choices you made in the top bar.
• Workspace branding: lets a course paint its own colours before the first frame.

13. Changes to this policy

A new version is published on this page with a new date. If a change matters to you, we say so by email or inside the app before it takes effect.

14. Contact

Privacy questions and requests go to info@elyora.tech.