Back to Tripeiro

Privacy Policy

Tripeiro — European Portuguese Tutor · Effective February 7, 2026

The important part first

  • We never store conversation content on our servers. Your messages and the AI-generated responses are not recorded, logged, or saved in any Tripeiro database or application log. Under our contracts with our AI service providers, Amazon Web Services (which hosts the Anthropic Claude model) does not retain input or output data after processing your request. OpenAI, which we may use as a fallback, may retain data for up to 30 days for abuse monitoring, after which it is deleted.
  • Your Tripeiro conversations are not used to train AI. We access AI services through contracts whose terms prohibit the AI developer from using customer inputs and AI responses to train AI models, or to adjust the performance of existing or future AI models.
  • We do not use your Tripeiro conversations to train or adjust the performance of our own existing or future AI models.
  • We use no cookies. None.

Data Controller

The data controller for Tripeiro is:

Bells Up AI, Inc.
1209 Orange Street, Wilmington, Delaware 19801, United States
Email: privacy@bellsup.ai

We have not appointed a Data Protection Officer, as we do not meet the threshold for mandatory appointment under GDPR Art. 37. You may contact us at the email above with any data protection questions.

Our EU representative under GDPR Art. 27 is:

Rachel See
Matosinhos, Portugal
Email: privacy@bellsup.ai

What We Process and Why

Providing the Tutoring Service

When you send a message, we transmit the conversation to an AI model to generate a response. We use Anthropic's Claude model via Amazon Web Services as our primary provider, and OpenAI's GPT-4o as a fallback when the primary service is unavailable. This processing is necessary to perform the service you request when you use Tripeiro.

We do not store your message content or AI responses on our servers. However, transmitting your messages to AI providers is processing under GDPR, even though we do not retain the content.

Because Tripeiro is a language tutor, conversations naturally focus on vocabulary, grammar, and cultural topics, and not personal matters. Even so, personal data can appear in any free-text input and response. Please do not include sensitive personal information in your messages, such as health information, political opinions, religious beliefs, sexual orientation, financial details, government identification numbers, or personal information about other people. We have no way to identify or filter such content, and once transmitted to an AI provider, it is subject to that provider's processing and retention terms.

Lawful basis: Art. 6(1)(b) GDPR — processing necessary for the performance of a contract (these Terms of Service).

Rate Limiting, Abuse Detection, and Security

We collect and store your IP address. We use it to enforce rate limits, detect abuse, and maintain the security and availability of the service. We also log request metadata associated with your IP address: timestamps, which AI model was used, response latency, and token counts (a measure of input and output length — not the actual text). We never log the text of your message or the AI response.

Lawful basis: Art. 6(1)(f) GDPR — legitimate interest in operating a secure, abuse-free service. We have assessed that this interest is not overridden by your rights given the minimal data involved, the 90-day retention limit, and the necessity of these measures to keep a free service available.

Aggregate Analytics

We use the request metadata described above to understand aggregate usage patterns (e.g., daily request volume, peak usage times, model performance). This helps us maintain and improve the service.

Lawful basis: Art. 6(1)(f) GDPR — legitimate interest in understanding and improving service performance. We have assessed that this interest is not overridden by your rights because analytics are derived from metadata we already collect for security purposes, are used only in aggregate, and do not involve profiling or tracking of individual behavior.

Feedback

If you voluntarily submit feedback through the in-app feedback button, we collect the category you select, your freeform message, and your email address if you choose to provide it. Feedback is forwarded to our team via a third-party messaging service for review.

Lawful basis: Art. 6(1)(b) GDPR — processing at your request.

Categories of Recipients

Your data may be shared with the following categories of recipients:

  • Amazon Web Services (processor): Hosts our infrastructure in the EU (eu-south-2, Spain) and hosts the primary AI model (Anthropic Claude). AWS processes data under a Data Processing Addendum.
  • OpenAI (processor): Provides the fallback AI model (GPT-4o). We may use this model when the primary service is unavailable. OpenAI processes data in the United States under a Data Processing Addendum. See "International Data Transfers" below.
  • Third-party messaging service (processor): Receives forwarded feedback submissions for our team's review.

Our staff, located in the United States and Portugal, access the server for administration and maintenance.

International Data Transfers

Tripeiro's server infrastructure runs in the EU (AWS eu-south-2, Spain). Analytics data and request metadata are stored on the EU-based server.

Data may be transferred outside the EU in the following situations:

  • OpenAI fallback: If the primary AI model is unavailable, message content may be processed by OpenAI in the United States. OpenAI is certified under the EU-US Data Privacy Framework, which provides an adequacy basis for this transfer under GDPR Art. 45.
  • Staff access: Our staff in the United States may access the EU-based server for administration and maintenance.

Data Retention

Data Retention
Conversation content Not stored on our servers. OpenAI's applicable commercial terms allow them to retain data they receive from us for up to 30 days.
IP addresses and request metadata 90 days, then automatically purged.
Server and infrastructure logs Rotated per system defaults; do not contain message content.
Feedback submissions Retained by our team as long as useful for service improvement.

Your Rights Under GDPR

If you are in the European Economic Area, you have the following rights regarding your personal data:

  • Access, rectification, erasure, restriction, portability, and objection — including the right to object to processing based on legitimate interest.
  • Withdraw consent — where processing is based on consent. We do not currently rely on consent as a lawful basis for any processing. If this changes, we will update this policy.
  • Lodge a complaint with your local supervisory authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD).

To exercise any of these rights, contact us at privacy@bellsup.ai.

Providing your IP address is a technical necessity of using the service; we cannot provide the service to you without processing it. You are not required to provide any other personal data.

We use automated rate limiting and abuse detection that may result in temporary blocking of access. These measures are applied uniformly for security purposes and do not produce legal effects or similarly significant effects. If you believe you have been incorrectly blocked, contact us at the email above.

Children

Tripeiro is not directed at children under 13. We do not knowingly collect personal data from children under 13. In Portugal, the age of digital consent under GDPR is 13.

Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), access controls, security headers, and input/output sanitization. We do not store conversation content, which eliminates the primary data protection risk.

Changes to This Policy

If we make material changes, we will update the "Last Updated" date at the top.

Contact

Bells Up AI, Inc.
1209 Orange Street, Wilmington, Delaware 19801, United States
Email: privacy@bellsup.ai