SafeMentor Privacy Policy

1. Controller and Contact

The controller responsible for data processing is: Lighthouse Engineering Architecture S.L., Av Lluc 58 BJ, 07300 Inca, Spain. NIF: B56925043. Registered in the Registro Mercantil de Mallorca, Tomo 3037, Folio 66, Hoja PM-98738, Inscripción 1ª. Email: privacy@safementor.app. Data protection contact: Andreas Greif, Lighthouse Engineering Architecture S.L., Av Lluc 58 BJ, 07300 Inca, Spain. privacy@safementor.app.

2. Data Categories and Purposes of Collection

We only collect data that is strictly necessary to provide our services:

• • Registration data (parents):• Name and address (purpose: tax obligation, § 14 UStG – invoicing) • Phone number (purpose: SMS verification) • Email (purpose: contract handling and access to the Parent Dashboard) • Payment data (purpose: contract handling, processed directly by Stripe) • Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• • Child profile:Pseudonym and month of birth of the child. Purpose: age-appropriate adaptation of AI responses and verification of parental consent under Art. 8 GDPR.
• • Interaction data and "Project Memory":Chat contents (complete chat histories), questions asked, responses generated and project progress (e.g. Python code). They are stored encrypted in the EU (see 3b). Purpose: continuity in the learning process. Legal basis: Art. 6(1)(b) GDPR.
• • Alert data for the parent dashboard:Alert level (Yellow or Red), detected pattern (e.g. bullying), the child's role in the situation (victim, bystander or perpetrator), a factual, non-verbatim AI summary, an educational hint for parents and the time. The data is generated automatically from the assessment of a child's message and shown to the legal guardians in the parent dashboard. Verbatim quotes and message texts are not included. Purpose: protecting the child and enabling a conversation in the family. Legal basis: Art. 6(1)(f) GDPR; where special categories are affected (e.g. health, self-harm), additionally Art. 9(2)(a) GDPR. Retention: see section 6.
• • Automatically collected information:IP address, browser type, operating system and device usage data (website and app). In the AI service additionally a pseudonymous session ID, the length of a message (character count), the safety category and alert level of a request, and error types. The AI service does not write message texts to its logs. Purpose: operation, troubleshooting, security and statistical analysis to improve our services. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). The logs are held at Google Cloud (EU) and deleted after 30 days.

3. Special Feature: AI Processing and Intent Routing

SafeMentor checks every input from the child before a response is created. The following steps run automatically:

• • Identifier filter:Before a message is passed on, an automatic filter replaces email addresses, phone numbers, street addresses, postal codes, IBANs, web addresses and usernames with placeholders. The filter does not recognise personal names, school names or places without a street address. It reduces personal data in the text but does not remove it completely; we therefore do not call it anonymisation.
• • Safety checks:A keyword check for danger signals and a check for attempts to manipulate the AI ("prompt injection").
• • Classification:AI classifiers (two to four calls) check the message for self-harm, inadmissible content, violence, sexual endangerment (including grooming) and misuse as homework help. If a classifier's response is unusable or capacity is lacking, the message is not treated as harmless: the system takes the more cautious route or asks the child to send the message again.
• • Routing:Depending on the result, the outcome is a normal AI response, a fixed crisis text with a helpline number (not AI-generated), a refusal, or a prompt to resend.
• • Summary and hint for parents:For Yellow and Red alerts that go to parents, an AI model generates a short, factual summary in three lines (topic, context, affected person) and an educational hint. The basis is the child's current message, shortened to 300 characters after the identifier filter, and the classification (pattern, role, level). For Yellow, the hint uses the classification only. The model is instructed not to quote anything verbatim. Both steps run in parallel to the reply to the child without delaying it, and only when capacity is free; if there is none, the alert is sent without a summary. In protected cases neither summary nor hint is created (see 3m and 3a).
• • Homework:If the system detects that a child wants to have schoolwork done for them or hand it in, the response steers towards the child's own learning. This does not trigger an alert to parents.

Safety Monitoring and Parent Dashboard

• • Yellow (lower urgency):The legal guardians receive the topic area, the detected reason and a factual, non-verbatim AI summary, so that an educational conversation in the family is possible. No verbatim quotes, no text from the child.
• • Red (acute danger, e.g. self-endangerment, abuse, violence):The legal guardians are informed immediately, with a factual, non-verbatim AI summary.
• • Protected cases:If the information suggests that the danger comes from the child's household (e.g. from a family member), parents are deliberately not notified, so that a possible perpetrator is not warned. The child then receives a fixed text with a helpline number.
• • Unclear classification:If the automatic assessment is not clear-cut, the system as a precaution assumes the more serious case and points this out to the parents. Category and urgency may then differ from the actual situation; false alarms are possible.
• • No further steps by SafeMentor:SafeMentor does not inform any authorities. The legal guardians are responsible for taking action; the child receives the number of a helpline.
• • Access to chat histories:Parents have no access to their child's chat histories. They only see the summaries for Yellow and Red alerts.
• • Correction by parents:Parents can mark an alert as wrongly classified. With the parents' explicit consent before sending, we then receive the message concerned (not the whole conversation) as well as category, level, role, relationship, language, age and the correction. This is necessary to improve detection; only the founders see the content.

Legal bases: Art. 6(1)(b) GDPR for the core function, Art. 6(1)(f) GDPR for protection against danger. Where content touches special categories (e.g. health, self-harm), additionally the explicit consent of the legal guardians under Art. 9(2)(a) GDPR. Balancing of interests: • Our interest: protecting children from serious dangers and offering a product that detects such dangers • Parents' interest: exercising their duty of supervision • Child's interest: protection from serious dangers (violence, abuse, suicide) IMPORTANT: The Red system serves exclusively to protect against serious dangers, not to monitor trivial behaviour. Examples of Red: concrete suicide announcements, indications of abuse, serious threats of violence. Not Red: swear words, normal arguments, bad grades. Information to the child: The child is informed in an age-appropriate way that an AI is reading along and that parents are informed about critical topics.

Access by the Founders

We do not routinely read chat contents. Only the two founders (Heinrich Gronauer and Andreas Greif) have access to the database. Both are bound to confidentiality and access data only on the controller's instructions. Every access is recorded in an audit log. Chat data is encrypted at rest at Supabase (AES-256); there is no further encryption at application level, i.e. the authorised persons could technically view the contents. Access to chat contents only takes place if it is absolutely necessary for security, for support at your explicit request, or because of a legal obligation. If parents mark an alert as wrongly classified, only the message concerned is sent to us together with the marking. This is the only way we can meaningfully improve detection. Before sending, the dashboard points this out clearly, and transmission only takes place with your explicit consent (Art. 6(1)(a) GDPR). Only the two founders see the message; we use it solely to improve detection and our instructions (prompts), not to train AI models and not for models outside the EU, and delete it after 30 days.

3a. AI Models and Providers

A model may only be used for the safety classifiers after it has been tested against a test dataset. How requests are routed: Requests go to the EU endpoint of OpenRouter. It is configured so that (i) only the EU operation of Mistral AI is used, with no fallback to other providers or regions – if it is unavailable, the request fails there and goes to OVHcloud; (ii) only endpoints with "Zero Data Retention" (no storage of request contents) are permitted; (iii) no endpoints are used that collect request data. Once a response has begun, we no longer switch provider. The AI models are tested for child safety and are subject to strict GDPR requirements (data processing agreement under Art. 28 GDPR). Providers may change as technology develops; a current overview is available in our list of sub-processors. No AI models are trained with children's chats.

3b. Storage Architecture and Data Location

SafeMentor stores chat data centrally and encrypted in the EU. Nothing is stored locally on the child's device. STORAGE AT SUPABASE (Supabase Ireland Ltd., Frankfurt data centre, encrypted): • Complete chat histories: stored at Supabase encrypted at rest with AES-256 (no additional application-level encryption). Retention: 30 days, then automatic deletion. • Chat summaries and Project Memory: retention: 30 days. • Yellow and Red summaries for the Parent Dashboard: Yellow alerts 30 days, Red alerts 12 months, then automatic deletion. Parents see these summaries, not the chat histories. • Account data: registration information, payment status (no card data). AI SERVICE: • The AI service stores no message texts and no chat histories. It only holds a short-lived technical session state in working memory (current conversation path, whether a safety event occurred in the session), identified by a pseudonymous session ID. This state is deleted after one hour at the latest and on every restart. • Transmitted per request: With every request, the AI service receives from the app the current (filtered) message, the most recent messages of the conversation, a summary, and the child's age, country and language. This data is passed on to the AI provider only for that request. IMPORTANT: Parents can request the deletion of chat histories, Yellow alerts and the account in the Parent Dashboard. We process the request within one month. Red alerts are excluded: they remain stored for 12 months because we must be able to ensure the traceability of protective measures and to defend ourselves against possible legal claims (Art. 17(3)(e) GDPR). Without deletion, chat histories are deleted automatically after 30 days. You can also request deletion at any time by email to privacy@safementor.app.

4. Disclosure to Third Parties and Processing in the EU

In the app, the content of your child's messages is processed exclusively in the European Union. Some of our service providers are companies based in the USA (OpenRouter, Vercel, Twilio). Section 4b applies to them.

4a. Sub-processors

Although Vercel Inc. is headquartered in San Francisco (USA), data processing for SafeMentor takes place exclusively on servers in Frankfurt, Germany. Vercel has contractually committed to: • not transfer data outside the EU, • not grant US employees access to data on the EU servers, • inform SafeMentor without delay of requests from authorities. Chat contents are not stored at Vercel but encrypted at Supabase (see 3b). Twilio Inc. is also headquartered in the USA; however, SafeMentor uses Twilio's European infrastructure in the Ireland region (IE1) to authenticate parents. As a result, the primary processing and storage of authentication data (e.g. mobile numbers and verification codes) takes place within the EEA. Twilio has committed, through a Data Processing Addendum (DPA) and supplementary technical measures, to: • carry out storage and processing of personal data primarily on servers within the EU, • ensure an adequate level of data protection by applying the EU Standard Contractual Clauses and certification under the EU-US Data Privacy Framework, • limit access by US companies to the absolute minimum necessary for technical operation, • follow internal transparency policies in the event of requests from authorities and safeguard SafeMentor's interests. Payments for SafeMentor are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Stripe processes your payment data (e.g. card number, expiry date, name, billing address, email, payment amount). We do not receive your complete payment data; we only store whether and when a payment was made, as well as the last four digits or the type of payment method. Stripe processes data partly on our behalf and partly under its own responsibility, for example for fraud prevention and to meet legal obligations. Stripe's privacy policy applies to this (stripe.com/privacy). The legal basis is Art. 6(1)(b) GDPR (performance of a contract), and for fraud prevention Art. 6(1)(f) GDPR. No health or chat data of your child is transmitted to Stripe.

4b. Third-Country Transfers

Message contents for AI processing do not leave the EU: According to the provider's documentation, OpenRouter's EU endpoint processes requests and responses exclusively within the region and never silently falls back elsewhere. We additionally pin it to the EU operation of Mistral AI and allow no fallback provider outside the EU. When the service starts in production, a check ensures that only providers verified as EU-resident are configured; otherwise the service does not start. Limits: OpenRouter is a company based in the USA. Its documentation says nothing about where operational metadata (e.g. timestamp, model, token counts, billing data – never message contents) is processed. We therefore cannot rule out that this metadata is also processed in the USA. The basis for this is the EU Commission's Standard Contractual Clauses and certification under the EU-US Data Privacy Framework. The guarantees described above apply to Vercel and Twilio. Stripe may also transfer payment data to group companies in the USA. The basis is the EU-US Data Privacy Framework, where Stripe is certified, and the EU Commission's Standard Contractual Clauses. TECHNICAL DETAILS ON THE AI PROVIDERS: • OpenRouter: Requests go only to endpoints with Zero Data Retention and no data collection. According to its own statement, OpenRouter stores request contents only if prompt logging is enabled; we do not enable it. • Mistral AI SAS (France): operation of the model in the EU. Use for training: excluded under the DPA. • OVH SAS (fallback only): data centres in France; certifications ISO 27001, SOC 2 Type II; no use of customer data for model training; requests are not stored after processing. • Technical caching: Providers may briefly cache unchanging parts of our instructions technically to speed up processing. Children's messages are not stored permanently.

4c. Data Processing Agreements (DPA)

All sub-processors were carefully selected in accordance with Art. 28 GDPR and have concluded legally compliant data processing agreements with SafeMentor. These include in particular: • Binding to the controller's instructions • Confidentiality obligation of all staff • Technical and organisational measures (TOMs) • Support with data subject rights • Obligation to report data breaches without delay • Deletion obligations after the end of the contract

4d. Current List and Change Notices

You can always find an up-to-date list of all sub-processors with contact details at: /en/subprocessors. In the event of changes (e.g. a new provider), we will inform you in good time, at least 30 days in advance, by email. You then have the right to object to the engagement.

4e. No Sale of Data

We NEVER sell data to third parties, whether for advertising, marketing or any other purpose. Your data and your children's data are processed exclusively to provide our services.

5. Cookie Policy

We only use strictly necessary cookies and similar technologies to provide and protect the website. Depending on the context, technical identifiers can be personal data; the relevant processing is described in this policy. STRICTLY NECESSARY COOKIES (no consent required where the legal exemption applies): • NEXT_LOCALE: remembers the selected language (duration: 12 months; provider: SafeMentor / next-intl) Optional analytics, advertising, marketing and third-party cookies are currently not used. Blocking necessary cookies may cause the website not to work properly. This directory must be reviewed whenever a new cookie, similar technology or external provider is introduced.

6. Retention Periods

Personal data is stored only for as long as necessary for the purposes or as required by statutory retention periods.

IMPORTANT: Red alerts are deleted after 12 months and Yellow alerts after 30 days, even if the dangerous situation continues. The longer period for Red alerts serves child protection: in cases of acute danger to oneself or others, protective measures must remain traceable, and we must be able to show when a risk was detected and which measures were taken, for example in response to enquiries from parents, authorities or agencies. The alert contains only the summary, no chat histories. Unlike chat histories and Yellow alerts, Red alerts cannot be deleted early, not even on request. If concerns persist, we recommend professional support (e.g. family counselling) rather than permanent technical monitoring. Account deletion: After termination, all personal data is deleted within 30 days, with the exception of tax-relevant documents and Red alerts (up to 12 months).

7. Your Rights (Data Subject Rights)

Under the GDPR, you (and your child) have the right of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to lodge a complaint with a supervisory authority. Requests must include proof of identity. Deadlines: We respond to your requests without undue delay and at the latest within one month (Art. 12(3) GDPR). If a request is particularly complex, we may extend this period by up to two further months; we will inform you of this within the first month.

8. Data Security

We use state-of-the-art TLS/SSL encryption. Chat data is stored in the database at Supabase encrypted with AES-256. Access to the Parent Dashboard is protected by multi-factor authentication. In the event of security incidents, we inform the supervisory authority and, where necessary, the data subjects in accordance with legal requirements.

9. Automated Decision-Making and Profiling

SafeMentor uses AI-based automated processing in the following areas:

• • Intent classification:• Purpose: assigning the request to safety levels and the corresponding AI responses. • Logic: AI model with corresponding instructions. • Legal effect: no adverse effect on the child.
• • Yellow/Red detection:• Purpose: protection from dangers (violence, abuse, suicide). • Logic: rule-based system + AI classifier (double check in critical cases). • Legal effect: immediate notification of parents.
• • Homework detection:• Purpose: steering towards the child's own learning. • Logic: AI model with corresponding instructions. • Legal effect: no adverse effect on the child, no alert.
• • Unclear classification:In case of unclear classification, the system assumes the more serious case and informs the parents.
• • Protected cases:If a danger within the household is suspected, parents are not notified; the assessment is based on the AI classification.

IMPORTANT: Whether and which notices go to parents is decided automatically by the system. In a protected case (danger within the household), parents are deliberately not informed; this assessment may be wrong. Parents can mark any alert as wrong. We do not regard this as a decision with legal or similarly significant effect within the meaning of Art. 22 GDPR.

10. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the General Data Protection Regulation (GDPR). Note on competence: As the controller, we are subject to the supervision of the supervisory authority responsible for our registered office or the authority competent for the main place of our data processing. You can also contact the data protection authority of the EU Member State in which you live, work or in which the alleged infringement took place. Our main establishment is in Spain. The competent supervisory authority is the Agencia Española de Protección de Datos (AEPD), www.aepd.es. A list of supervisory authorities with contact details can be found at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

11. Voluntary Provision of Data

The provision of your personal data is not required by law. The information marked as mandatory fields is required to conclude the contract and use SafeMentor (Art. 6(1)(b) GDPR). Without it, no contract can be concluded. All other information and consents are voluntary. Consequences of not providing data: Not providing your personal data merely means that you cannot use our services. You suffer no further disadvantages. Mandatory fields and voluntary information: During registration and use, we mark mandatory fields whose entry is required to conclude the contract and provide our services (e.g. the parents' email address, the child's month of birth). All other information is voluntary and can be omitted without affecting how you can use the services.

12. Withdrawal of Your Consent

Where the processing of your personal data is based on consent (Art. 6(1)(a) or Art. 9(2)(a) GDPR), you have the right to withdraw this consent at any time with effect for the future. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected. Effects of withdrawal: Withdrawal may mean that certain SafeMentor functions that rely on this consent (e.g. the use of certain AI models or more detailed analyses) can no longer be used or only to a limited extent. The core functions of the platform generally remain available as long as other legal bases (e.g. performance of a contract, Art. 6(1)(b) GDPR) support the processing. How to withdraw: You can withdraw your consent informally with effect for the future. Please send your withdrawal by email to privacy@safementor.app or by post to Lighthouse Engineering Architecture S.L., Av Lluc 58 BJ, 07300 Inca, Spain. For secure identification, please state in your withdrawal the email address with which you are registered at SafeMentor.

13. Data Protection Impact Assessment (DPIA)

A data protection impact assessment under Art. 35 GDPR is in place before the start of the pilot (draft of 26.09.2026, updated on 13.10.2026) and will be reviewed after the pilot and in the event of material changes. Reason: systematic monitoring (Red/Yellow detection), processing of sensitive data of children (under 16) and automated classification (intent routing, safety classification).

• • Technical safeguards:Data-minimising architecture (no storage of message texts in the AI service); encryption of chat data (AES-256) at Supabase in the EU (Supabase standard, no additional application-level encryption); filter for certain identifiers before transmission to AI providers (not full anonymisation); exclusively EU endpoints for AI processing, enforced in production by a start-up check; Zero Data Retention; logs without message text; automatic deletion after 30 days (chat histories, Yellow) or 12 months (Red). Parent alerts (Yellow and Red) contain only a non-verbatim summary; the wording of the child's message is not shown in the parent dashboard.
• • Organisational safeguards:Access only for the two founders with multi-factor authentication and access logging (supa_audit).