Privacy policy
Last updated: 14 October 2026
Courtesy translation. In case of any discrepancy, the Spanish version prevails.
1. Who is responsible
NowLesson (https://nowlesson.com) is a service provided by Luis Emilio Liriano Aróstegui, tax ID 60038864D, address Calle Alfonso XII 29, 41001 Seville (Spain). Contact for any privacy question: privacidad@nowlesson.com. NowLesson is the controller of account data (teachers and students). Each teacher decides which data about their own students they manage with NowLesson; for that data, NowLesson acts as a processor on the teacher's behalf.
2. What data we process
- Account data: name, email, time zone, language, role (teacher or student) and, for teachers, their introduction, the languages they teach and the address of their public page. - Lesson data: schedules, bookings, changes and cancellations, lesson balance, notes, homework, vocabulary and whiteboard content. - Payment data: amounts, statuses, method, reference and receipts of payments. Card or account details in a Stripe payment are handled directly by Stripe; NowLesson never sees or stores them. - Teachers’ direct payment details, only if they fill them in: IBAN and account holder, Bizum phone number, Zelle, Venmo username, Cash App $cashtag, UK sort code and account number, PayPal.me username and payment instructions. Only their students see them, so they can pay. - Teachers’ public profile, if they fill it in: photo, country, introduction, video, languages, levels, specialties, education and experience. It is visible to anyone on their public page and, if they opt in, in the directory. - Attendance in the NowLesson classroom: when each person joins and leaves a lesson’s video call and for how long. Neither audio nor video is recorded. - Support requests, if you write to us from the help button: your email, your name (if you give it), the message, the page you wrote from and what you searched for in the help, so we can reply. - Reviews: the rating and comment a student publishes about their teacher, shown with their first name. - Technical data: server logs (IP address, date and requested page) and the cookies strictly needed to keep you signed in. - Google data, only if you choose to use Google (see section 3).
3. Google user data: what we use and why
Sign in with Google (openid, email and profile scopes): we receive your name, email address and profile picture from Google only to create or identify your NowLesson account. Connect Google Calendar (teachers only, optional, from Settings): - calendar.events scope: NowLesson creates, updates and deletes the events of your NowLesson lessons in your calendar (with their Google Meet link), and reads your calendar events only when you use "Import from Google Calendar" to detect your weekly lessons and suggest invitations. - calendar.freebusy scope: NowLesson checks when you are busy so those times are not offered to your students. Only busy intervals are used, not the content of your events. How we protect this data: the Google access token is stored encrypted (AES-256-GCM) and never leaves the server. Google user data is not sold, not shared with third parties, not used for advertising or to train artificial intelligence models, and no person reads it unless you ask us to, it is needed for security, or the law requires it. You can disconnect Google Calendar at any time from Settings (NowLesson deletes the token) or remove access at https://myaccount.google.com/permissions. NowLesson's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
4. Why we use it and on what legal basis
- Providing the service (schedule, bookings, classroom, payments and email notices): performance of the contract you accept when you sign up. - Syncing Google Calendar: your consent, which you can withdraw at any time. - Showing the teacher’s profile on their public page and, if they ask, in the directory, and publishing reviews: performance of the contract (the teacher decides what to publish and whether to appear; the student decides whether to review and can delete their review). - Security, fraud prevention and technical improvement of the service: legitimate interest. - Meeting legal obligations (for example accounting or requests from authorities): legal obligation. We do not sell data, show ads or build profiles for commercial purposes.
5. Who we share it with
Only with the providers needed to run the service, who act as data processors: - Supabase (database, authentication and files), hosted in the European Union (Frankfurt). - OVHcloud (application server), in Germany. - Stripe (card or direct debit payments between students and teachers who use Stripe, and the NowLesson subscription). - Resend (sending emails). - Google (Sign in with Google, Google Calendar and Meet, only if you use them). - Cloudflare (DNS). We also share with each teacher the data of their own students that they need to teach them, and with each student their teacher’s data, including their direct payment details if they have filled them in. In direct payments (bank transfer, Bizum, PayPal), the money and the payment’s bank details go directly between student and teacher through their bank or payment service; NowLesson is not involved.
6. Where it is stored and international transfers
Data is hosted in the European Union. When a provider processes data outside the EU (for example Stripe or Google in the United States), it does so with GDPR safeguards: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
7. How long we keep it
While your account is active. If you delete your account, we anonymise your personal data and delete your boards, notes and connections (including the Google token). Lesson and payment history is kept without personal data for as long as accounting and tax obligations require. Server logs are rotated automatically and deleted after a short time.
8. Your rights
You can download all your data and delete your account from Settings at any time. You can also exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to privacidad@nowlesson.com. If you think we have not handled your request properly, you can complain to your data protection authority (in Spain, the AEPD: www.aepd.es).
9. Security
All connections are encrypted (HTTPS). Each user can only see their own data and that of the people they have a lesson relationship with (access control in the database). Keys and tokens are stored encrypted and only used by the server.
10. Cookies
We only use strictly necessary technical cookies: the session cookie, the language cookie and short-lived cookies that protect sign in with Google. We do not use analytics or advertising cookies.
11. Children
You must be at least 14 to create an account. If a student is under 14, the account must be created and managed by their parent or legal guardian.
12. Changes to this policy
If we change this policy in a meaningful way, we will tell you by email or in the app before the change applies.