habla tabla
Privacy Policy
Last updated October 27, 2026
This explains what data we collect when you use Habla Tabla (hablatabla.com, the 3D world in the browser and the dashboard), why we collect it, how long we keep it and the choices you have. It accompanies our Terms of Service.
In short: learners don't need accounts, children in School get made-up names by default, voice and video are never recorded, chat isn't stored, there are no analytics where students play, and we don't show ads, sell data or build profiles of anyone.
Who we are
Habla Tabla is operated by KONSTANTLY, LLC, a Virginia limited liability company ("we", "us"). We are the data controller for hosts' account data. This policy covers Habla Tabla only; our other products have their own privacy policies. Our contact details are at the end of this page.
When a school, district, company or other organization uses Habla Tabla with its students or staff, we process their information on the organization's behalf and under its instructions, as its processor or service provider, and, for student records, as a "school official" with a legitimate educational interest under FERPA. The organization decides how Habla Tabla is used and is responsible for any notices and consents its learners need. Questions about how a school or employer uses Habla Tabla should go to that organization; we will help them answer.
Two kinds of people
Hosts (teachers, trainers, administrators) have accounts and run spaces from the dashboard. Learners (students, employees, participants) join a space with its link or code and have no account, no email and no password with us.
What we keep
| What | Details | Kept until |
|---|---|---|
| Host accounts | Email, name, a hashed password (or, if you sign in with Google, your Google account identifier instead), when you agreed to our Terms and which version, whether you've confirmed your email, the school or company you're in and your role | You delete the account |
| Sign-in sessions and links we send | Scrambled (hashed) tokens only: sessions, invite links, links confirming an email and password reset links | 30 days for sessions, 7 days for invites and email confirmations, an hour for password resets, or sooner when used, signed out or withdrawn |
| Spaces | Name, join code, lessons and quiz questions, pictures and logos you add, the islands' look and names, things built and whiteboard drawings, the schedule, and which features the space allows | The space is deleted |
| Class lists | The first names or numbers a teacher adds to a class's list, so each student can pick their own when they join | The teacher changes the list, or the space is deleted |
| Learner records | A random id made in the learner's browser (or, when the teacher keeps a class list, their entry on it), the name they used in the space, lessons finished, quiz scores, photo hunt finds, and when they last came | A host forgets them, the space is deleted, or 365 days after they were last seen |
| Reports | Who reported whom (the names used in the space), the reason, a few words of detail, and the reported person's last few chat messages | A host deletes the report, the space is deleted, or 180 days after it was made |
| Reports on the public demo | The same, for someone reported on a public demo island, so we can deal with it | 24 hours, in memory only (never in our database) |
| Messages to us | What you send with the contact form on our website: your name, email, school or company if you give one, the topic and your message | 365 days after you send it, or sooner if you ask |
| AI usage | How many AI drafts an organization, and each host, made each day | The organization or account is deleted |
| Error reports | When something breaks in a browser: the error message, where in our code, the page path and the browser name. Never names, chat or content | Our server logs, which are overwritten as they fill |
In School, learners get generated names ("Brave Fox") and typed names are refused, so we hold no real names of children unless a teacher types one into a lesson or the school's owner turns on own names for a space. Things built and drawn are tagged with a code made from the space and the learner's random id, not a name.
What passes through and isn't kept
- Chat goes to the people in the space and isn't stored, except the reported person's last few messages attached to a report. In School spaces, students use set phrases and only teachers type, unless the school turns on free typing.
- Voice, webcam video and shared screens go directly between the browsers of people near each other, encrypted, and never through our servers or into storage. When a network blocks direct connections, they may pass through a relay that cannot decrypt them. They're off in School unless the school's owner turns them on.
- Where people are and how their characters look is live and gone when the room closes.
- Photos taken with the in-game camera stay in the browser that took them.
- IP addresses are held in our server's memory to stop floods of requests and limit how many connections one network makes: for at most two hours, or a day for someone reported on, or sent away from, a public demo island. We don't write them to our database. Our network provider, Cloudflare, also sees them (see below).
- What visitors build and draw on the public demo islands goes when they leave.
- Questions to Luna, the AI host on the Team demo island (an experiment), go to the AI provider we use to answer them (see below) with her last few answers, and aren't stored: we only count how many there were each day. Email addresses and phone numbers are taken out first. Luna is never on School islands. She speaks her talk and her answers: their words, and only hers, go to Google's Gemini to be turned into speech, and the audio is kept on our server to play again.
Cookies and browser storage
Hosts get one cookie that keeps them signed in, and, only while signing in with Google, a second one that lasts ten minutes and checks the sign-in really came from them. The game remembers settings, the chosen character and name, finished stations and photo hunt progress in the browser's own storage, and in-game photos in the browser's database. On our website's pages and the dashboard (never on the islands, where students play) we use Google Analytics, which sets its own cookies (named _ga) to count visits; in Europe and the UK only if you say yes, and not at all when your browser sends Global Privacy Control or Do Not Track. "Cookie settings" at the foot of every page of our website changes your answer. On the public demo islands we keep a few daily totals on our own server (how many visits open an island, get in, stay five minutes and go on to make a space), with no cookies and nothing that identifies anyone; nothing like it is counted in class or team spaces. There are no advertising cookies. Anyone can clear what Habla Tabla stored by clearing the site's data in their browser.
How we use it
- To run the Service: sign hosts in, show spaces, save progress and builds, and let people meet and talk.
- To keep it safe: rate limits, abuse prevention, reports to hosts, and finding and fixing errors.
- To reply when you write to us.
We don't sell personal data, share it for advertising, show ads, build profiles of learners, or use anyone's content or data to train AI models. Students' information is used only to provide Habla Tabla to their school.
Children and students
Habla Tabla School is designed for students in grades 4 to 8, used under a teacher's supervision. We collect from children only what the Service needs for teaching, as described above, and only with their school's authorization: under COPPA, a school may consent on parents' behalf for use in the school context, for the school's benefit and no other commercial purpose. We don't ask children for email addresses, phone numbers, photos of themselves or locations.
Schools can review and delete their students' records at any time from the dashboard (one student, a whole class, or a space), or by writing to us. Parents and guardians who want to review or delete their child's records, or stop further collection, should ask the child's school; they can also write to us, and we will work with the school to respond. We delete students' records when a school asks or when it stops using the Service.
Our public demo islands need no account. Children should use them with a parent, guardian or teacher. A demo island may be one of our own spaces, so the name and progress used there are kept like any space's learner records (see the table above).
Host accounts are for adults. If we learn a host account belongs to someone under 18, we close it.
Our legal bases
Where the GDPR or UK GDPR applies, we rely on: performing our contract with hosts (their accounts and spaces); our legitimate interests in keeping Habla Tabla secure, preventing abuse and fixing errors, which you can object to; the organization's instructions, for learners' information we process on its behalf; and legal obligations. We don't make decisions about anyone with legal or similarly significant effects based solely on automated processing.
Who we share it with
- Amazon Web Services hosts our servers, the database and its backups, in the United States.
- Cloudflare sits in front of our servers: it protects them from attacks and delivers our pages. Every visit passes through it, so it sees visitors' IP addresses and the traffic between them and us.
- Google, when a host chooses to sign in with Google: we receive the account identifier, name, email address and whether the email is verified. Browsers using voice, video or screen sharing also ask Google's connection servers (STUN) for their public network address, so those servers see players' IP addresses.
- Google Analytics, on our website's pages and the dashboard only (never on the islands): which pages are visited, from where (the referring site and an approximate location from the IP address), on what device and browser, and whether someone signed up or wrote to us. We use it only to understand and improve the site, with Google's advertising features off.
- Resend delivers the emails we send to hosts: a welcome, password reset links and notices about the Service. It receives the host's email address and the message. When someone writes to us with the contact form, it also delivers that message to our team.
- Anthropic, only when a host uses the AI lesson writer or builder: it receives the topic or request the host types and the edition. Never learner data.
- Google (Gemini API) or Anthropic (Claude API), whichever we use for Luna on the Team demo island: they receive the questions visitors type to her, with her recent answers, to write a reply. Not their names or anything else about them. Google (Gemini) also turns what Luna says into speech; it receives only her words.
- A connection relay (TURN), when one is needed on strict networks, passes encrypted voice, video and screens between browsers and sees their IP addresses.
People in a space see each other's names, characters and chat, and, if the space allows, voice and video. Voice, video and screens go directly between the browsers in a call where the network allows it, so those browsers learn each other's IP addresses. We may also disclose data if required by law, in a merger or acquisition (subject to the commitments in this policy), or to protect the safety of our users, especially children.
Your rights
Depending on where you live, including the EU/EEA, the UK and California, you have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. Most of this is self-service: hosts can change their name and password and delete their account on the dashboard's Account page, and export or forget learners' records on each space's Progress page. Learners should ask their school or host, who controls their records. For anything else, email [email protected]; we'll verify the request and respond within the time your local law requires.
If you're in the EU/EEA or the UK and think we've handled your data unlawfully, you can complain to your local data protection authority. We'd appreciate the chance to fix it first, so please write to us too. We don't sell or share personal data for advertising, so there is nothing to opt out of. We honor Global Privacy Control and Do Not Track by not loading analytics at all.
Retention, deletion and backups
We keep data for the periods in the table above. Deleting an account deletes the schools or companies only that person is in, with their spaces and records; the person leaves the others. The database is backed up daily and backups are kept for up to 30 days, with access limited to administrators, so deleted information leaves the backups within 30 days. Backups are used only to recover the Service.
How we protect it
Our administrators see hosts' accounts (name, email, how they sign in, their schools or companies, when they joined and last signed in) and each space's name, link and activity as numbers, to run and support the Service; and, for a day, reports made on the public demo islands. They don't see learners' names or records in spaces unless a school asks for help with them. Connections are encrypted. Passwords are stored only as hashes, sessions and invites as scrambled tokens, and access to production systems and backups is limited to administrators. Spaces can only be reached with their link or code, and only a space's hosts can see its records. No system is perfectly secure; if a breach affects personal data, we'll tell the affected schools, organizations and people, and the authorities, as the law requires.
International transfers
KONSTANTLY, LLC is based in the United States, and Habla Tabla stores and processes data in the United States. If you use it from elsewhere, your data is sent to the United States. Where legally required, transfers from the EU/EEA, the UK or Switzerland are covered by appropriate safeguards, such as Standard Contractual Clauses. Ask us at [email protected] about the arrangements that apply.
Changes to this policy
We may update this policy. We will post the updated policy on this page with its date and tell hosts in the dashboard or by email about changes that matter. We won't make a material change to how we use students' information without notice to their schools and any consent the law requires, and an update never authorizes an incompatible use of information collected earlier.
Contact
Questions or requests about your data, and formal legal notices: [email protected].
KONSTANTLY, LLC, 8401 Mayland Drive, Ste S, Richmond, VA 23294, United States. Telephone: (757) 447-4303.