Privacy Policy

This policy explains what information Volvedu collects, why, who can see it, how long we keep it, and the choices parents, schools and users have. It covers the Volvedu web app at app.volvedu.com, this website, and our school platform (together, the “Service”).

Volvedu is designed for children aged 6 to 12, their parents and their schools. Questions about this policy: hello@volvedu.com.

1. Information We Collect

What we collect depends on how you use Volvedu.

• Family accounts: the learner’s name, age and country, an avatar, and the parent’s or guardian’s email address and password. For a learner under 13, the email address must be the parent’s or guardian’s.
• School pupils: the name the teacher enters, an avatar, the age group used to choose lessons, the pupil’s class, and a 4-digit PIN. The PIN is stored hashed, plus an encrypted copy so the teacher can show it again. Pupils sign in with a class code and their PIN; we create a login identifier for them that is not an email address. We do not collect pupil email addresses.
• Teachers and school administrators: name, email address, password, school, classes and role.
• Learning data: lessons opened and finished, quiz answers and results, missions, badges, XP points, and the days a learner was active.
• Usage data: while a learner is using Volvedu, the app records the time spent and how far they got in each lesson. This is what shows progress to the learner and to their parent or teacher.
• Technical data: IP address and browser and device type, in sign-in records and server logs. We use these to keep accounts secure.

We do not collect precise location, contacts, photos, audio recordings, browsing history outside Volvedu, or biometric information, and Volvedu does not use the camera or microphone. An approximate location (country or city) can be worked out from an IP address in our security logs and in anonymous page-view statistics.

2. How We Use Your Information

• Run the Service: sign-in, lessons, quizzes, missions and progress.
• Show lessons suited to the learner’s age.
• Show progress to the learner, and to their parent or teacher.
• Provide school features: the teacher dashboard, class missions and class leaderboards.
• Keep accounts secure: limits on sign-in attempts, lockouts after repeated wrong PINs, and abuse detection.
• Improve lessons and the app. When we analyse usage for this, we use pseudonymised or aggregated data.

We do not use children’s information for advertising, and we do not build marketing profiles.

3. Service Providers

We use a small number of service providers to run Volvedu. They process data only on our instructions and only to provide their service to us:

• a database, sign-in and file-storage provider, with data stored in the EU;
• a hosting provider for the app and this website, which also keeps server logs and privacy-friendly page-view statistics that use no cookies;
• an email delivery service for account emails, such as email confirmation and password reset;
• a form service that delivers the demo-request form on this website to our inbox.

Schools can ask us for the names of these providers. We never sell personal data, and we do not share it for advertising.

Some lesson content (illustrations, narration audio and lesson text) is produced with the help of AI tools and reviewed before it is published. The AI tools we use to produce lessons never receive personal data about learners, parents or teachers.

4. Children’s Privacy

Volvedu is designed for children aged 6 to 12.

• Family accounts for children under 13: a parent or guardian creates the account with their own email address, reads this policy and gives consent on the sign-up form. We then email that address, and the account can only be used once the parent confirms it.
• School pupils: the school decides to use Volvedu and is responsible for informing parents (see section 5).
• We collect only what the learning service needs.
• There is no advertising, and no third-party advertising or tracking tools in the app.
• Children cannot post anything publicly. In a school class, classmates see each other’s names, avatars and points on the class leaderboard, and the teacher can turn the leaderboard off. Family accounts have no leaderboard.
• A parent can delete a family account and all of the child’s data at any time in the app, or ask us by email. Deleting the account also withdraws consent.

5. School Use

When a school uses Volvedu, the school is responsible for its pupils’ data (it is the controller), and Volvedu processes that data on the school’s behalf. Questions about pupil data should go to the school first.

• A pupil’s progress is visible to the pupil, their teachers and the school’s administrators. Only teachers the school invites can see a class.
• We do not disclose pupil information outside the school relationship, except on the school’s instruction or where the law requires it.
• Teachers can remove a pupil from a class. To delete pupil accounts and their data permanently, the school asks us; we do it within 30 days and confirm in writing.

6. Data Security

• All traffic is encrypted in transit (HTTPS/TLS).
• Sign-in sessions are kept in cookies, not in browser local storage, and are only sent over HTTPS.
• Database access rules limit what each account can read, based on its role.
• Passwords are stored hashed. PINs are stored hashed, with an encrypted copy so a teacher can show a pupil’s PIN again.
• Repeated wrong sign-in attempts are limited, and a pupil’s sign-in locks after too many wrong PINs until the teacher unlocks it.
• We review our security regularly and limit production access to the people who need it.

7. Data Retention and Deletion

We keep account and learning data while the account is in use.

• Family accounts: the parent can delete the account in the app. Open Profile, choose Delete in the Account section, and type the account password. The account and all of the learner’s data (lesson progress, quiz results, badges, XP and missions) are deleted straight away. This cannot be undone.
• If you cannot sign in, or for any other account: email hello@volvedu.com from the account’s email address. We delete the account and its learning data within 30 days.
• School pupils: see section 5.
• Backups: deleted data can stay in our backups until those backups expire and are overwritten.

8. Your Rights

Depending on where you live, you may have the right to:

• see the personal information we hold about you;
• correct it (in the app, a family account can change the learner’s name and avatar, and teachers can edit their pupils’ details);
• delete it (see section 7);
• withdraw consent, including a parent’s consent for a child under 13;
• object to or restrict how we use it;
• receive a copy of it in a common format;
• complain to your data-protection authority.

To use any of these rights, email hello@volvedu.com with the subject “Privacy Request”.

9. Where Data Is Stored

We store data in the EU. Some of our service providers are based in the US and may access data from there. Their data-processing terms include safeguards for this, such as Standard Contractual Clauses.

10. This Website

volvedu.com counts page views with privacy-friendly statistics that use no cookies and do not identify you. If you send the demo-request form, we receive your name, work email, organisation, country and message by email and use them only to reply to you.

11. Changes to This Policy

We may update this policy. When we do, we post the new version on this page and change the “Last updated” date at the top. If a change affects children, we also tell parents.

12. Contact Us

Questions about this policy or about how we handle data, especially children’s data:

• Email: hello@volvedu.com
• Subject line for privacy requests: “Privacy Request”
• Response time: we reply within 7 days and complete requests within one month. We deal with requests about a child’s safety first.