Voovo
Privacy Notice – draft
Detailed English-language draft covering the processing of personal data on the VOOVO website, web and mobile applications, marketplace, courses, and related services.
1. Status and scope of this document
Version: draft-2026.08.14-en. This is a complete working version prepared on the basis of VOOVO's current services and technical operation. Before publication and entry into force, it requires legal review and internal verification of the data-retention periods and service-provider agreements.
This notice applies to the www.voovostudy.com website, VOOVO's web interfaces, iOS and Android applications, marketplace, courses, school and partner functions, customer support, and the related payment, measurement, and artificial-intelligence-assisted functions.
This notice explains what personal data VOOVO processes, for what purpose and on what legal basis, with whom data may be shared, how long it is retained, and how you may exercise your data-protection rights. The Hungarian notice is available on a separate page; the final Hungarian and English texts must be aligned in substance.
2. The data controller
Data controller: Voovo Hungary Korlátolt Felelősségű Társaság (short name: Voovo Hungary Kft.).
Registered office and postal address: 2083 Solymár, Budai Nagy Antal utca 51., Hungary. Company registration number: 13-09-216134. Tax number: 27478583-2-13. Represented by: Hermán Benedek Zsombor.
Privacy and customer-support contact: support@voovo.study. Telephone: +36 70 415 8036. You may submit a data-protection request by email or post.
3. Whose data do we process and where does it come from?
This notice applies to visitors, registered users, students, parents and legal guardians, teachers, institutional contacts, customers, content creators, business partners, and people who contact customer support.
We primarily receive data from you when you register, upload content, study, make a purchase, give consent, complete a form, or contact us. Data may also come from a parent, school or other inviting institution, payment provider, app store, social sign-in provider, content partner, or automatically from your device and use of the service.
If you upload another person's data or content about them, do so only if you have an appropriate legal basis or permission. You do not need to provide special-category data—such as health, biometric, religious, or political data—to use the service; please do not upload such data unnecessarily.
4. Account, identification, and provision of the service
Data processed: name or display name, email address, Firebase user identifier, the selected sign-in method and its technical identifiers, language, country or region, account status, settings, registration and login times, and limited data needed for age, parental permission, or institutional invitations.
Purpose: to create and protect the account, enable sign-in, manage subscriptions and access, operate the service in a personalized manner, and provide the requested functions. Legal basis: taking steps to enter into and performing the contract under Article 6(1)(b) of the GDPR; without the required data, the account-based service cannot be provided.
Passwords, social sign-in tokens, and other authentication data are handled by Firebase Authentication or the relevant sign-in provider. VOOVO does not see the password for your Google or Apple account.
Retention: for the lifetime of the account, followed by the period needed to complete a deletion request and overwrite backups. Data required by law or for the establishment, exercise, or defence of legal claims may be retained separately until the end of the applicable mandatory or limitation period.
5. Learning content, activity, and sharing
Processed content may include notes, documents, images, audio recordings, videos, flashcards, questions, answers, quizzes, exercises, AI conversations, sharing settings, and other learning material that you create or upload. For this purpose, the application may—with separate device permission—request access to the camera, microphone, photos, or files.
Processed learning data may include course and classroom membership, progress, answers, results, scores, study times, repetition schedules, study goals, streaks, rewards, and recommended and completed tasks. Purpose: to provide learning functions, adaptive repetition, progress displays, content sharing, and backup. Legal basis: performance of the contract.
When you share content, the users you select—or, in the case of public sharing, other visitors—may access it. Disabling a share code may prevent new copies, but it does not automatically delete an independent copy previously made by another user.
Retention: for as long as the account and the relevant content exist, or for as long as a shared or institutional copy is lawfully required. Upon deletion, active copies are removed except for another user's independent copy, mandatory retention, and backups retained for a limited period.
6. Schools, teachers, and institutional accounts
When a school sends an invitation, the institution may provide the student's name, email address, group, course, and identifiers needed for access. The teacher or institution may see learning data specified in the separate agreement and its own notice, such as participation, assignment status, progress, and results.
Where the school determines the purpose and essential means of processing, the school is the data controller and VOOVO is a data processor acting on the school's instructions. Separately, VOOVO is an independent data controller for its own account security, billing, service protection, and direct customer support.
The institution is responsible for informing the student and, where necessary, the parent, establishing an appropriate legal basis, and providing only the necessary data. When institutional access ends, data is deleted, returned, or separated according to the separate agreement, the institution's instructions, and applicable law.
7. Artificial-intelligence-assisted functions
When you request an AI function—for example, the creation of a flashcard, exercise, explanation, quiz, title, or answer—VOOVO may send the instructions, study material, question, and related technical data needed to fulfil the request to a contracted AI provider, such as Google Gemini, OpenAI, or Anthropic.
Purpose and legal basis: to provide the function you requested, meaning performance of the contract. VOOVO does not train its own general-purpose AI model using your private questions, uploads, conversations, or study materials, and does not permit its contracted providers to use them for general model training. Separate, explicit consent would be requested for any such future use.
We send only the content needed to produce the requested result and, where possible, remove direct identifiers. Do not provide unnecessary personal, special-category, or confidential data when using an AI function. AI providers may retain technical logs for a limited period for security and abuse prevention, in accordance with their contract with VOOVO.
Adaptive learning order, recommendations, and AI responses may use automated processing, but VOOVO does not make a decision based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.
8. Purchases, subscriptions, access, and billing
Data processed: the customer's name, email address, billing address and tax details, country, purchased product or course, amount, currency, discount, purchase and renewal dates, subscription status, refund, and the customer, transaction, subscription, and receipt identifiers provided by Stripe, RevenueCat, the Apple App Store, or Google Play.
Purpose: to prepare payment, fulfil purchases and subscriptions, grant access, prevent fraud, provide customer support, process refunds, perform accounting, and issue legally required documents. Legal basis: performance of the contract and compliance with accounting and tax obligations under Article 6(1)(c) of the GDPR.
For web card payments, Stripe processes the full bank-card details; VOOVO does not store them. App Store and Google Play purchases are also subject to the app store's own data-processing rules. RevenueCat synchronizes purchase entitlements and subscription status.
Retention: for as long as needed to perform the contract and manage access. Accounting documents and their supporting data are retained for eight years under Hungarian accounting rules. A payment provider may retain data for a different period under its own legal obligations.
9. Customer support, complaints, bug reports, and legal claims
Data processed: name, email address, account and purchase identifiers, the content of the request, attachments, screenshots, device and application data, and records of responses and actions taken.
Purpose and legal basis: responding to the request and performing the contract; compliance with a legal obligation for consumer complaints; and VOOVO's and others' legitimate interests in enforcing their rights in cases of fraud, abuse, disputes, or unlawful content under Article 6(1)(f) of the GDPR.
Consumer complaints and the responses to them are retained for the legally required period of three years. Other support cases are retained for the period needed after closure and for the limitation of possible claims, after which they are deleted or anonymized.
10. Newsletters, partner relations, forms, and social media
For newsletters and direct marketing, we may process your name, email address, selected topic, language, time of consent, and unsubscribe request. Legal basis: voluntary consent. You may withdraw consent at any time through the unsubscribe link in the email or by writing to support@voovo.study; withdrawal does not affect the lawfulness of earlier processing.
For partner or institutional enquiries, we may process the contact person's name, position, organization, email address, telephone number, social-media or YouTube channel, and the content of discussions. Purpose: handling the enquiry and preparing a possible collaboration. Legal basis: steps taken before entering into a contract or the legitimate interest in reasonable business contact.
The YouTube partner interface may also record the provided or selected public channel name, the channel's public data, browser type, and a non-reversible hash of the network address to verify access, prevent abuse, and document contact.
Partner enquiries are retained for the duration of discussions, for up to two years following an unsuccessful approach, or, where a relationship is established, for the duration of the contract and related legal claims. Newsletter data is processed until you unsubscribe; we may then retain the minimum suppression-list data needed to prevent further contact.
If you interact with VOOVO on Facebook, Instagram, TikTok, LinkedIn, or YouTube, the relevant provider also processes data under its own rules. We use comments, messages, and public profile data only for communication and moderation.
11. Technical logs, security, and error diagnostics
The website, application, and servers may record the IP address, time, requested page or action, device and browser type, operating system, application version, approximate region, Firebase identifier, network data, error code, crash report, and the circumstances of the error.
Purpose: operating the service, preventing unauthorized access, fraud, and overload, investigating errors, and examining security incidents. Legal basis: processing necessary to provide the service and the legitimate interest in secure and reliable operation.
An error report must not contain unnecessary user content or full authentication data. Technical logs are retained for the shortest period necessary to investigate the error and security risk, generally for no more than twelve months; data related to a confirmed security incident or legal claim may be retained longer, until the matter is closed.
12. Cookies, local storage, analytics, and advertising measurement
Strictly necessary cookies and browser-storage data keep sign-in, security, load balancing, purchasing, language settings, and consent preferences working. Their legal basis is providing the electronic service requested by you; disabling them may prevent certain functions from working.
Optional analytics and marketing measurement begin only if you explicitly allow them in the consent manager. We may then process a random visitor and session identifier, visited page, click, search or filter event, offer and price context, landing page, referring page, UTM parameter, Google and Meta click identifiers, and _ga, _fbp, and _fbc browser identifiers.
For purchase measurement, the permitted campaign and browser identifiers may be sent to the Meta or Google Ads account associated with the campaign together with the product, value, currency, and purchase-event data and, where necessary, a one-way cryptographic hash of the account email address. VOOVO's measurement records do not store the raw email address in such an event.
Legal basis: consent under Article 6(1)(a) of the GDPR. Refusal does not restrict the service's essential functions. You may change your consent at any time; upon withdrawal, VOOVO deletes optional local identifiers available to it, but data previously and lawfully sent to a provider is also subject to that provider's rules for deletion.
Optional browser data remains until the relevant cookie or local-storage item is deleted, consent is withdrawn, or the provider's configured expiry time is reached. Server-side measurement events are retained for the period needed for campaign evaluation, abuse prevention, and reconciliation, while identifiable data is kept for the shortest possible period.
13. Processors and other recipients
VOOVO provides contracted service providers only with the data needed to perform their task. Main provider categories and providers currently used: Google Cloud Platform and Firebase—for authentication, databases, file storage, hosting, analytics, and error diagnostics; Vercel—for web hosting and content delivery; Supabase—for web content, access, and purchase data; Sentry and Firebase Crashlytics—for error diagnostics.
Payment and entitlement: Stripe, RevenueCat, the Apple App Store, and Google Play. AI functions: Google Gemini, OpenAI, and Anthropic, according to the actual configuration of the relevant function. Email and communication: Google Workspace and the contracted email sender used by VOOVO. Optional advertising measurement: Google Ads and Meta.
Data may also be received by VOOVO's accountant, legal adviser, auditor, insurer, debt collector, or, where required by law, a court, authority, or other public body. In school use, the teacher or institution has access according to the applicable agreement and permissions. VOOVO does not sell personal data.
Certain payment, app-store, social-media, and advertising providers may be independent data controllers for their own purposes and legal obligations. Their published notices explain their own processing in detail. The provider list may change; this notice will be updated when a material change occurs.
14. Transfers outside the European Economic Area
VOOVO selects a European hosting region where this is available and reasonable for the service. However, some providers or their subcontractors operate in the United States or another country outside the European Economic Area, so personal data may be transferred there or accessed from there.
Such a transfer may take place only with safeguards under Chapter V of the GDPR: on the basis of an adequacy decision by the European Commission—including the EU–US Data Privacy Framework for certified US organizations—or using standard contractual clauses adopted by the European Commission and, where necessary, supplementary technical, organizational, or contractual safeguards.
You may request information about the safeguard applied to a particular provider and transfer, and a copy of it, at support@voovo.study; trade secrets and other people's personal data may be redacted from the copy.
15. Protection of minors' data
VOOVO's educational service may be used by secondary-school and higher-education students, including minors. We protect minors' data with particular care and process it only to the extent necessary for the service, security, and parental or institutional use.
In Hungary, when an information-society service is offered directly to a child and processing is based on consent, a child under 16 requires the consent or authorization of the person holding parental responsibility. Separate rules may apply to processing based on a contract, legal obligation, or institutional legal basis.
A user under 16 may use VOOVO with permission from a parent or legal guardian or on the basis of a lawful institutional invitation. VOOVO may request reasonable verification. A purchase for a minor must be made by an adult parent or legal guardian.
We do not use the account or learning data of a user known to be a minor for direct marketing or advertising profiling, and we do not sell personal data. A parent or legal guardian may request access, correction, or deletion on the child's behalf; VOOVO may verify their authority.
16. Legal bases for processing and legitimate interests
Performance of a contract: operating the account, learning content, requested AI function, purchase, subscription, access, and customer support. Legal obligation: accounting, taxation, consumer complaints, authority requests, and other mandatory retention. Consent: optional analytics and advertising measurement, newsletters, and any other purpose for which VOOVO requests separate permission.
Legitimate interests: information and account security, fraud and abuse prevention, error diagnostics, handling legal claims, measuring service quality without personal content, and reasonable contact with business partners. Before relying on any such purpose, VOOVO assesses the necessity of the purpose, the proportionality of processing, and the data subject's rights, particularly where a minor is involved.
You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time without giving reasons; following such an objection, the data will no longer be processed for that purpose.
17. Data security and personal-data breaches
VOOVO applies technical and organizational measures appropriate to the risk, including encrypted network connections, access management, separated permissions, logging, secret management, backups, updates, data minimization, and contractual oversight of providers.
No internet service can guarantee complete security. If we identify an event involving personal data, we investigate it, reduce the risk, document it, and, where required by the GDPR, notify the supervisory authority without undue delay and inform the data subject where there is a high risk.
Report suspected account compromise, unauthorized access, or data loss to support@voovo.study.
18. Your rights
You may request information and a copy of the personal data processed about you; ask for inaccurate data to be corrected, erased, or restricted; where the conditions apply, request the transfer of data you provided in a machine-readable format; object to processing based on legitimate interests; and request not to be subject to a decision based solely on automated processing that has a significant effect.
You may withdraw consent at any time for the future. The right to erasure is not absolute: VOOVO may retain data needed to perform a contract, comply with a legal obligation, establish or defend a legal claim, protect another person's rights, or meet another GDPR exception.
Send your request to support@voovo.study or to the postal address in Section 2. VOOVO requests only the additional data needed to verify identity and authority. We respond without undue delay and generally within one month; for complex or multiple requests, the period may be extended by a further two months under the GDPR, and you will be informed of the extension within one month.
Exercising your rights is generally free of charge. For a manifestly unfounded, repetitive, or excessive request, VOOVO may charge a reasonable fee or refuse to act and will explain its reasons.
19. Complaints and judicial remedies
If you believe that your personal data is being processed unlawfully, please first write to support@voovo.study so that VOOVO can investigate and resolve the matter. Independently of this, you may lodge a complaint with the supervisory authority for your habitual residence, place of work, or the place of the alleged infringement.
Hungarian supervisory authority: Hungarian National Authority for Data Protection and Freedom of Information (NAIH). Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary. Postal address: 1363 Budapest, Pf. 9., Hungary. Email: ugyfelszolgalat@naih.hu. Telephone: +36 1 391 1400. Website: www.naih.hu.
You are also entitled to bring proceedings against a controller or processor and to claim compensation under the conditions of the GDPR. Lodging a complaint does not exclude other administrative or judicial remedies.
20. Changes to this notice
VOOVO may update this notice when its services, providers, technology, or applicable laws change. The version and effective date will always appear at the beginning of the document.
We will provide clear advance notice of a material change affecting user rights or the purpose of processing in the application, on the website, or at the email address associated with the account. If a new purpose requires consent, we will request it separately; silence or continued use alone does not constitute consent.
Effective date: to be determined after legal and internal data-processing review. When the approved version is published, this draft label will be removed.