habla tabla
Privacy Policy
Last updated October 25, 2026
This explains what data we collect when you use Habla Tabla (hablatabla.com, the 3D world in the browser and the dashboard), why we collect it, how long we keep it and the choices you have. It accompanies our Terms of Service.
In short: learners don't need accounts, children in School get made-up names by default, voice and video are never recorded, chat isn't stored, and we don't show ads, sell data or build profiles of anyone.
Who we are
Habla Tabla is operated by KONSTANTLY, LLC, a Virginia limited liability company ("we", "us"). We are the data controller for hosts' account data. This policy covers Habla Tabla only; our other products have their own privacy policies. Our contact details are at the end of this page.
When a school, district, company or other organization uses Habla Tabla with its students or staff, we process their information on the organization's behalf and under its instructions, as its processor or service provider, and, for student records, as a "school official" with a legitimate educational interest under FERPA. The organization decides how Habla Tabla is used and is responsible for any notices and consents its learners need. Questions about how a school or employer uses Habla Tabla should go to that organization; we will help them answer.
Two kinds of people
Hosts (teachers, trainers, administrators) have accounts and run spaces from the dashboard. Learners (students, employees, participants) join a space with its link or code and have no account, no email and no password with us.
What we keep
| What | Details | Kept until |
|---|---|---|
| Host accounts | Email, name, a hashed password (or, if you sign in with Google, your Google account identifier instead), when you agreed to our Terms and which version, the school or company you're in and your role | You delete the account |
| Sign-in sessions and invite links | Scrambled (hashed) tokens only | 30 days for sessions, 7 days for invites, or sooner when you sign out or withdraw them |
| Spaces | Name, join code, lessons and quiz questions, pictures and logos you add, the islands' look and names, things built and whiteboard drawings, the schedule, and which features the space allows | The space is deleted |
| Learner records | A random id made in the learner's browser, the name they used in the space, lessons finished, quiz scores, photo hunt finds, and when they last came | A host forgets them, the space is deleted, or 365 days after they were last seen |
| Reports | Who reported whom (the names used in the space), the reason, a few words of detail, and the reported person's last few chat messages | A host deletes the report, or the space is deleted |
| AI usage | How many AI drafts an organization made each day | The organization is deleted |
| Error reports | When something breaks in a browser: the error message, where in our code, the page path and the browser name. Never names, chat or content | Our server logs, which are overwritten as they fill |
In School, learners get generated names ("Brave Fox") and typed names are refused, so we hold no real names of children unless a teacher types one into a lesson or the school's owner turns on own names for a space. Things built and drawn are tagged with a code made from the space and the learner's random id, not a name.
What passes through and isn't kept
- Chat goes to the people in the space and isn't stored, except the reported person's last few messages attached to a report. School spaces use set phrases unless the school turns on free typing.
- Voice, webcam video and shared screens go directly between the browsers of people near each other, encrypted, and never through our servers or into storage. When a network blocks direct connections, they may pass through a relay that cannot decrypt them. They're off in School unless the school's owner turns them on.
- Where people are and how their characters look is live and gone when the room closes.
- Photos taken with the in-game camera stay in the browser that took them.
- IP addresses are held in memory for at most two hours, to stop floods of requests, and not written anywhere.
Cookies and browser storage
Hosts get one cookie that keeps them signed in, and, only while signing in with Google, a second one that lasts ten minutes and checks the sign-in really came from them. The game remembers settings, the chosen character and name, finished stations and photo hunt progress in the browser's own storage, and in-game photos in the browser's database. There are no analytics, advertising or tracking cookies, so there is nothing to accept. Anyone can clear what Habla Tabla stored by clearing the site's data in their browser.
How we use it
- To run the Service: sign hosts in, show spaces, save progress and builds, and let people meet and talk.
- To keep it safe: rate limits, abuse prevention, reports to hosts, and finding and fixing errors.
- To reply when you write to us.
We don't sell personal data, share it for advertising, show ads, build profiles of learners, or use anyone's content or data to train AI models. Students' information is used only to provide Habla Tabla to their school.
Children and students
Habla Tabla School is designed for students in grades 4 to 8, used under a teacher's supervision. We collect from children only what the Service needs for teaching, as described above, and only with their school's authorization: under COPPA, a school may consent on parents' behalf for use in the school context, for the school's benefit and no other commercial purpose. We don't ask children for email addresses, phone numbers, photos of themselves or locations.
Schools can review and delete their students' records at any time from the dashboard (one student, a whole class, or a space), or by writing to us. Parents and guardians who want to review or delete their child's records, or stop further collection, should ask the child's school; they can also write to us, and we will work with the school to respond. We delete students' records when a school asks or when it stops using the Service.
Our public demo islands need no account. Children should use them with a parent, guardian or teacher. A demo island may be one of our own spaces, so the name and progress used there are kept like any space's learner records (see the table above).
Host accounts are for adults. If we learn a host account belongs to someone under 18, we close it.
Our legal bases
Where the GDPR or UK GDPR applies, we rely on: performing our contract with hosts (their accounts and spaces); our legitimate interests in keeping Habla Tabla secure, preventing abuse and fixing errors, which you can object to; the organization's instructions, for learners' information we process on its behalf; and legal obligations. We don't make decisions about anyone with legal or similarly significant effects based solely on automated processing.
Who we share it with
- Amazon Web Services hosts our servers, the database and its backups, in the United States.
- Google, when a host chooses to sign in with Google: we receive the account identifier, name, email address and whether the email is verified. Browsers using voice, video or screen sharing also ask Google's connection servers (STUN) for their public network address, so those servers see players' IP addresses.
- Resend delivers the emails we send to hosts: a welcome, password reset links and notices about the Service. It receives the host's email address and the message.
- Anthropic, only when a host uses the AI lesson writer or builder: it receives the topic or request the host types and the edition. Never learner data.
- A connection relay (TURN), when one is needed on strict networks, passes encrypted voice, video and screens between browsers and sees their IP addresses.
People in a space see each other's names, characters and chat, and, if the space allows, voice and video. We may also disclose data if required by law, in a merger or acquisition (subject to the commitments in this policy), or to protect the safety of our users, especially children.
Your rights
Depending on where you live, including the EU/EEA, the UK and California, you have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. Most of this is self-service: hosts can change their name and password and delete their account on the dashboard's Account page, and export or forget learners' records on each space's Progress page. Learners should ask their school or host, who controls their records. For anything else, email [email protected]; we'll verify the request and respond within the time your local law requires.
If you're in the EU/EEA or the UK and think we've handled your data unlawfully, you can complain to your local data protection authority. We'd appreciate the chance to fix it first, so please write to us too. We don't sell or share personal data for advertising, so there is nothing to opt out of; we don't respond to "Do Not Track" signals because we don't track.
Retention, deletion and backups
We keep data for the periods in the table above. Deleting an account deletes the schools or companies only that person is in, with their spaces and records; the person leaves the others. The database is backed up daily and backups are kept for up to 30 days, with access limited to administrators, so deleted information leaves the backups within 30 days. Backups are used only to recover the Service.
How we protect it
Our administrators see hosts' accounts (name, email, when they joined and last signed in) and each space's name, link and activity as numbers, to run and support the Service; they don't see learners' names or records unless a school asks for help with them. Connections are encrypted. Passwords are stored only as hashes, sessions and invites as scrambled tokens, and access to production systems and backups is limited to administrators. Spaces can only be reached with their link or code, and only a space's hosts can see its records. No system is perfectly secure; if a breach affects personal data, we'll tell the affected schools, organizations and people, and the authorities, as the law requires.
International transfers
KONSTANTLY, LLC is based in the United States, and Habla Tabla stores and processes data in the United States. If you use it from elsewhere, your data is sent to the United States. Where legally required, transfers from the EU/EEA, the UK or Switzerland are covered by appropriate safeguards, such as Standard Contractual Clauses. Ask us at [email protected] about the arrangements that apply.
Changes to this policy
We may update this policy. We will post the updated policy on this page with its date and tell hosts in the dashboard or by email about changes that matter. We won't make a material change to how we use students' information without notice to their schools and any consent the law requires, and an update never authorizes an incompatible use of information collected earlier.
Contact
Questions or requests about your data: [email protected]. Formal legal notices: [email protected].