Privacy policy
Effective from 24 October 2026
1. Who the controller is
The controller of personal data is Sovo spółka z ograniczoną odpowiedzialnością, ul. Targowa 10, 35-064 Rzeszów, Poland, entered in the National Court Register (KRS) kept by the District Court in Rzeszów, 12th Commercial Division, under number 0000903160, tax ID (NIP) 8133861225, REGON 389027492 (“Sovo”, “we”).
Contact for data protection matters: info@sovo.pl or by post to the address above.
This policy covers the Sovo mobile app for iOS and Android (the “App”). The rules for using the App are set out in the Terms of use.
2. What data we process
Account
- email address, username and the avatar you choose;
- your password if you sign in with email – we store only a one-way hash, never the password itself;
- if you sign in with Google or Apple: the account identifier and email address that service provides (Apple lets you hide your real address).
Your studying
- subjects and what you are preparing for (e.g. “biology final exam”), and the exam date;
- topics, notes, flashcards and quizzes, including those created by AI;
- materials you upload (PDF files, photos of notes) and the text read from them;
- answers in practice tests, their grading and results;
- conversations with the AI tutor.
Please don’t upload materials containing data you don’t need for studying, such as other people’s personal data or identity documents.
Points and purchases
- your points balance and account type (free, subscription, lifetime);
- purchase details: product, date, transaction identifier and status. Payments are handled by the App Store or Google Play – we never receive card or other payment details.
Notifications
- if you allow notifications: your device’s notification identifier (push token) and your reminder time. Study reminders are scheduled on your device; the token lets us send you notifications about your studying. You can turn notifications off in your phone’s or the App’s settings.
Technical and usage data
- events about using features (e.g. “opened flashcards”, “started a test”), device model, system and App version, approximate country. We don’t use the device’s advertising identifier;
- server logs (e.g. time and type of request, error code), needed for security and fixing bugs.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) | How long |
|---|---|---|
| Running your account and providing the App: storing subjects and materials, creating notes, flashcards, quizzes and tests, grading answers, the AI tutor, the study plan, reminders | Art. 6(1)(b) (contract) | until the account is deleted |
| Handling purchases, points and subscriptions | Art. 6(1)(b) (contract) | until the account is deleted; billing records – as tax law requires |
| Accounting and tax obligations | Art. 6(1)(c) (legal obligation) | for the period required by law (usually 5 years from the end of the tax year) |
| Usage statistics and improving the App | Art. 6(1)(f) (legitimate interest) | up to 14 months; after that only in aggregate, not linked to any person |
| Security, preventing abuse, establishing and defending claims | Art. 6(1)(f) (legitimate interest) | server logs up to 30 days; data needed for claims – until they are time-barred |
| Answering your messages and complaints | Art. 6(1)(b) and (f) | until the matter is settled, then until claims are time-barred |
We don’t show ads, don’t send newsletters and don’t sell data.
4. Artificial intelligence
Notes, flashcards, quizzes, topics, practice tests, their grading and the tutor’s replies are created by an AI model provided by OpenAI. We send it only what each task needs: the subject and topic names, what you are preparing for, your materials and their text, your test answers or your message to the tutor. We don’t send your email address or username.
Under OpenAI’s terms for its API services, the data sent is not used to train models, and OpenAI may keep it for up to 30 days to detect abuse.
AI-generated content may contain mistakes – use it as a study aid, not as the final source of knowledge. Practice test results are calculated automatically, but they serve only your studying and have no legal effect on you.
5. Who we share data with
We use providers that process data on our behalf and on our instructions:
| Provider | For | Where |
|---|---|---|
| Google (Firebase, Google Cloud) | sign-in, database, file storage, App servers, statistics, Sign in with Google | account and study data are stored in the EU (Warsaw); statistics may also be processed in the USA |
| OpenAI | AI content and grading | USA |
| RevenueCat | purchases and subscriptions | USA |
| Expo (650 Industries) | delivering notifications and App updates | USA |
| Apple, Google (App Store, Google Play) | sales and payments; Sign in with Apple | under those stores’ terms |
We may also disclose data to public authorities where the law requires it, and to our advisers (e.g. accountants, lawyers) to the extent necessary.
Transfers outside the European Economic Area. When data goes to the USA, we rely on the European Commission’s decision on the EU-U.S. Data Privacy Framework for providers certified under it, or otherwise on the Standard Contractual Clauses approved by the European Commission.
6. How long we keep data and how to delete your account
We keep account and study data for as long as you have an account.
Delete your account in the App: Profile → Account → Delete account. We then immediately delete the account, profile, subjects, materials, uploaded files, results and tutor conversations. Data disappears from database backups within 7 days at most. If you no longer have access to the App, email info@sovo.pl from your account’s address and we will delete it for you.
Deleting your account does not cancel a subscription – do that in your App Store or Google Play settings.
7. Your rights
You have the right to:
- access your data and receive a copy;
- have it corrected;
- have it erased (you can also do this yourself in the App);
- restrict processing;
- data portability;
- object to processing based on our legitimate interest (e.g. statistics);
- lodge a complaint with a supervisory authority – in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).
To exercise your rights, email info@sovo.pl. We will reply within one month.
Providing data is voluntary, but you can’t create an account without an email address (or a Google or Apple account), and we can’t prepare materials for you without the content you enter or upload.
8. Minors
Students use the App. If you are under 16, use the App with the knowledge and consent of a parent or legal guardian, and ask them to read this policy.
9. Security
Connections to the App are encrypted. Each user can access only their own data, and operations such as awarding points or grading tests run only on our servers. Uploaded files are not visible to other users. The database is backed up daily and protected against accidental deletion.
10. Changes to this policy
We will tell you about significant changes in the App. The current version is always available at sovo.pl/en/privacy-policy.