Privacy Policy

Last updated: June 2026

Vunolin operates as an independent education service under the laws of the State of New Mexico, United States, and acts as the data controller for the personal data described here. Where you live, you may also have rights under your local law (the EU General Data Protection Regulation, the UK GDPR, the California Consumer Privacy Act and CPRA, and others). This policy is written to comply with all of them.

We collect the following categories of personal data when you use Vunolin. We only collect what is needed to run and improve the service. Below is each category and why we collect it:

Account information. Your name, email address, password (stored as a hash, never in plain text), gender, date of birth, and optional profile picture. If you sign in with Google or Apple, we receive the basic profile fields those services share with us.

Learning content. The courses you create, your lesson progress, your answers to questions, your chat conversations, and voice transcripts when you use the voice tutor. This is the content that makes the service personal to you.

Usage data. Which features you interact with, how long lessons take you, and aggregated patterns that help us improve the product. We never look at this data tied to a specific user without a strong reason such as fraud investigation.

Payment data. Your billing email, the plan you bought, and the transaction reference. Your card number and CVV are handled directly by Paddle (web) or by Apple and Google (in-app purchases). We never see or store full card details.

Device and log data. Your IP address, browser or app version, operating system, language preference, basic crash reports, and the timestamps of your activity. This is what every modern service collects automatically and we use it for security, debugging, and rate limiting.

Communications. Messages you send us through the contact email or feedback forms. We keep these so we can follow up and so future support staff have context.

How we use your data

We process your personal data for the following purposes:

Providing the learning service and keeping it personalized to you
Managing your account, subscription, and billing
Processing payments via Paddle, Apple, or Google
Improving the product through aggregated analytics
Detecting fraud, abuse, and security incidents
Communicating with you about service updates and support
Complying with legal obligations like tax records and lawful requests

Legal bases for processing

Under the EU GDPR and UK GDPR, we rely on the following legal bases (set out in GDPR Article 6). Where another jurisdiction applies, we map these to the equivalent local concept.

Performance of a contract. To deliver the service you signed up for, including running your account, generating courses, and processing payments.

Your consent. For optional analytics, optional marketing emails, and any data we collect beyond what is strictly necessary. You can withdraw consent at any time from the cookie banner or your account settings.

Legitimate interests. For security, fraud prevention, abuse detection, and improving the service. We weigh these interests against your rights and only proceed when our interest does not override your fundamental privacy.

Legal obligation. To keep records required by tax law, respond to lawful requests from authorities, and comply with consumer protection rules.

Who we share data with

We share your data only with the categories of recipients below, and only when needed to run the service or comply with law. We never sell your personal data.

Paddle is our Merchant of Record and processes payments made on the web, handling billing, tax, and receipts. Card details are sent directly to Paddle through their secure forms and never reach our servers. Paddle is PCI DSS Level 1 compliant.

Apple App Store and Google Play handle in-app purchases. When you buy a subscription inside the app, the store processes the payment, validates the receipt with us, and we never see your card details.

Our hosting and authentication provider stores our database and manages sign-in. Our web infrastructure provider serves the application and routes requests through its content delivery network. Both operate under data processing agreements that mirror our own commitments to you.

We use AI providers (such as OpenAI, Anthropic, and Google) to generate course content and power the voice tutor. Only the prompt content needed to fulfil your request is sent. We do not allow these providers to train their models on your prompts. Text requests are routed through the OpenRouter gateway; spoken audio is synthesized by ElevenLabs, and voice input may be transcribed by your device or browser's speech-recognition service.

Authorities, only when required by law. If we receive a lawful order to disclose specific data, we comply, but we challenge requests we believe are overbroad.

International data transfers

We and our service providers operate servers in the United States and other countries. When personal data is transferred across borders, for example from the EU, UK, or EEA to the United States, we rely on recognised transfer safeguards: adequacy decisions where they exist, and Standard Contractual Clauses (with the UK International Data Transfer Addendum) approved by the European Commission and the UK Information Commissioner's Office where they do not.

You can request a copy of the safeguards we have in place by emailing us.

How long we keep your data

We keep your data only as long as needed for the purposes listed in this policy. Indicative retention periods:

Account data: until you delete your account.
Learning content (courses, progress): until you delete the related course or your account. Chat conversations: up to 30 days.
Payment records and invoices: up to 7 years, to satisfy tax and accounting law.
Server and security logs: up to 30 days.
Support conversations: up to 30 days after the support ticket is closed.
Backups: up to 30 days after primary deletion, then permanently erased.

Your rights

Wherever you live, you have rights over your personal data. Under the EU GDPR, UK GDPR, and the California Consumer Privacy Act, these include:

The right to access a copy of your data
The right to correct inaccurate data
The right to delete your data (the right to be forgotten)
The right to restrict how we process your data
The right to object to processing
The right to data portability in a common format
The right to withdraw consent at any time
The right to lodge a complaint with a data protection authority
The right to limit the use of your sensitive personal information
The right not to be treated differently for exercising your privacy rights

To exercise any of these rights, reach us through our contact page. We respond within 30 days. If we need more time for a complex request, we will tell you why.

You can also complain to your local data protection supervisory authority. In the UK, that is the Information Commissioner's Office (ico.org.uk). In the EU, you can find your supervisory authority via edpb.europa.eu. In California, you can contact the California Privacy Protection Agency (cppa.ca.gov) regarding your CCPA rights.

Children's privacy

Vunolin is intended for users aged 13 and older. We do not knowingly collect personal data from children under 13.

Users between 13 and 17 should use the service with the involvement of a parent or guardian. By creating an account, you confirm that you have any consent legally required where you live.

If you believe a child under 13 has provided us with personal data, reach us through our contact page and we will delete it promptly. This includes complying with the US Children's Online Privacy Protection Act (COPPA) where applicable.

Cookies and similar technologies

We use essential cookies for sign-in, language preference, and security. With your consent, we may also use limited analytics cookies to understand which features people use. For the full list, including third-party cookies set by Paddle and our analytics provider, see our Cookie Policy.

How we protect your data

We use industry-standard measures to safeguard your data:

TLS 1.2 or higher for data in transit
At-rest encryption for sensitive fields
Passwords hashed with bcrypt
Optional two-factor authentication on your account
Regular security reviews and dependency audits
Internal access limited to staff who need it for their work

Changes to this policy

We may update this policy as the service evolves or laws change. We will let you know about meaningful changes by email or through a notice in the app. The date at the top of this page always reflects the latest version.

Contact us

If you have any question about this policy or how we handle your data, reach us through our contact page. We usually respond within two business days.