Privacy Policy

# Exaveo Privacy Policy

Last updated: 31 August 2026

This Privacy Policy explains how Exaveo collects, uses, stores, shares and protects personal data relating to users of [https://www.exaveo.com\](https://www.exaveo.com) and its related services.

Exaveo is an online platform for preparing for German-language examinations, completing practice exercises, saving learning progress and reviewing written work.

Personal data is processed in accordance with the Law of Ukraine “On Personal Data Protection”, the EU General Data Protection Regulation (GDPR) where applicable, and other applicable privacy laws.

## 1. Data Controller

The data controller is:

ФОП МИХАЛЬЧУК ЛЮДМИЛА СЕМЕНІВНА (sole proprietor under Ukrainian law)

Ukrainian taxpayer identification number: 2258403884

Address: 2 Vesniana Street, Pidlisky village, Rivne District, Rivne Region, 35431, Ukraine

Privacy contact: info@exaveo.com

Website: https://www.exaveo.com

In this Policy, “Exaveo”, “we”, “us” and “our” refer to the controller identified above.

## 2. Scope

This Policy applies to registered users, guests using exercises without registration, purchasers of paid plans or subscriptions, users contacting support, website visitors and adult users aged 18 or over.

The Platform may be used by people in Ukraine, Germany, Austria, Switzerland and other countries.

Exaveo is intended exclusively for persons aged 18 or over. Persons under 18 may not register, create an account or use the Platform’s interactive features.

## 3. Personal Data We Process

### 3.1 Account and authentication data

We may process:

- first and last name;

- email address;

- password in securely hashed form;

- email verification status;

- time-limited technical tokens for email verification and password resets;

- account creation and last-use dates;

- technical user and session identifiers.

Passwords are never stored in plain text. We cannot view or recover a user’s password; access is restored by creating a new password through the reset process.

### 3.2 Google or Telegram login

If a user chooses third-party login, we may receive:

- from Google: Google account ID, email address, name and profile-image URL;

- from Telegram: Telegram User ID, first name, last name, Telegram username and profile-image URL.

We receive only the information made available under the permissions shown during login and the user’s provider settings. Exaveo never receives the password for a Google or Telegram account.

### 3.3 Learning profile and preferences

We may process the user’s native language, target German examination or proficiency level (for example B1 or B2), preferred interface language, selected light/dark/system theme and other learning preferences voluntarily selected in the profile.

### 3.4 Learning activity and results

We may store:

- answers to exercises, including selected options, completed gaps and free-text responses;

- written assignments submitted for review;

- automatically generated or teacher-assigned scores;

- results of AI-assisted assessment;

- error statistics, attempt history, completion time and learning progress;

- information about started, completed and saved exercises;

- a pseudonymous guest identifier and temporary progress for users without an account.

Guest progress may be merged with the user’s account after registration.

### 3.5 Uploaded files and media

Where this functionality is available, a user or teacher may upload scans or photographs of written work, audio recordings, images and other learning files. We may also store the file name, size, format, MIME type and upload date.

Exaveo does not secretly record online lessons. Audio, images and documents are processed only when a user or authorised teacher uploads them.

Please do not include unnecessary personal data, identity documents, medical or financial information, or other confidential information in assignments or uploaded files.

### 3.6 Payments, plans and subscriptions

We may process the selected plan, package or subscription; amount and currency; promotional code; transaction date, status and identifier; subscription identifier where recurring payments are used; and access start and end dates.

Payments are processed by WayForPay. Exaveo does not receive or store full payment-card numbers, CVV/CVC codes or other complete card details.

### 3.7 Technical data

We may automatically process IP address, browser and operating-system information, device type, User-Agent, browser language, access date and time, viewed pages, technical requests, errors, security events, referring source, referrer, cookies and session identifiers.

This information is used to operate the website, maintain authentication, diagnose errors and protect against spam, overload, password guessing and misuse.

### 3.8 Analytics and marketing data

With the user’s prior consent, we may process information about website use through Google Analytics 4; interaction data through Microsoft Clarity, including clicks, scrolling, pointer movements, page navigation, session recordings and heatmaps; UTM parameters such as source, medium, campaign, content and search term; the first landing page and referrer; and interaction with informational or promotional emails.

UTM parameters may not identify a person by themselves but may constitute personal data when combined with cookies, IP addresses or an account.

### 3.9 Communications

When a user contacts us, we may retain the email address, message, attachments, correspondence date and information required to answer and resolve the request.

## 4. Purposes and Legal Bases

| Purpose | Legal basis |

|---|---|

| Account creation, login and access recovery | Performance of a contract or pre-contractual steps |

| Access to the practice platform and storage of progress, results and preferences | Performance of a contract |

| Review of exercises, results and learning personalisation | Performance of a contract and our legitimate interest in providing and improving the educational service |

| Processing payments, plans and subscriptions | Performance of a contract and compliance with legal obligations |

| Tax, accounting and legal records | Compliance with a legal obligation |

| Security and prevention of fraud, spam and technical abuse | Our legitimate interest in protecting the Platform and its users |

| Support and responses to enquiries | Performance of a contract or legitimate interest |

| Google Analytics 4, Google Tag Manager, Microsoft Clarity, optional UTM cookies and marketing analytics | Prior voluntary consent |

| Promotional emails, news, offers and campaigns | Voluntary consent |

Providing data needed for an account, payment and core functionality is voluntary, but without it we cannot provide the relevant service.

## 5. Email Communications and Marketing Consent

We may send service messages required for email verification, password recovery, payment or subscription confirmation, access delivery, security and important Platform updates. These messages are not marketing and may be sent where necessary to provide the service.

News, promotions and marketing materials are sent only to users who have separately agreed to receive them. Marketing consent is voluntary, is not required to register or purchase access, must be given through a separate unticked checkbox, and may be withdrawn at any time through an unsubscribe link or by contacting info@exaveo.com.

Withdrawal does not affect processing that took place before withdrawal and does not stop necessary service messages.

## 6. AI-Assisted Assessment

Exaveo may use OpenRouter, Google Gemini and OpenAI to assess written work, identify language errors and generate learning feedback.

The text of an assignment and its technical task context may be sent for assessment. We seek not to send names, email addresses or other direct identifiers unless necessary. A provider may nevertheless receive technical data required to process the request.

Users must not include real personal data, confidential information or third-party information in their assignments. Providers process submitted text under their applicable terms, privacy notices and service configurations.

AI feedback is educational and advisory, may contain errors, and is not an official examination result. Exaveo does not use it to make decisions producing legal or similarly significant effects.

## 7. Cookies and Similar Technologies

Cookies are small files or identifiers stored on or read from a user’s device.

### 7.1 Strictly necessary cookies

These support authentication, security, sessions and core functionality. A session cookie may remain valid for up to 30 days. Disabling necessary cookies may prevent login or use of parts of the Platform.

### 7.2 Guest cookies

These preserve unfinished tests and guest progress. A guest identifier may remain for up to 60 days or until deleted by the user.

### 7.3 Google Analytics 4

With prior consent, we use the Google Analytics 4 web analytics service. The provider for users in the European Economic Area and Switzerland is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics helps us assess traffic, referral sources, use of Exaveo features, page performance and possible technical issues so that we can improve the Platform.

The data processed may include pages visited and interactions with website functions, date, time and approximate visit duration, referral source, referrer and UTM parameters, approximate location, device type, operating system, browser, language, screen size, online identifiers, analytics cookies and other technical information. The IP address may be technically processed when establishing a connection and determining an approximate location. According to Google, Google Analytics 4 does not log or retain IP addresses as separate data.

The legal basis is voluntary consent under Article 6(1)(a) GDPR and the applicable rules on accessing information on a user’s device. Google Analytics is not activated before consent is given.

The retention period for user and event data depends on the property settings and may be 2 or 14 months. Aggregated reports that do not directly identify a user may be retained longer. Current cookie lifetimes are shown in the cookie settings. Google may engage affiliated companies and service providers, including in the United States. Further information is available in the [Google Privacy Policy](https://policies.google.com/privacy).

### 7.4 Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to centrally deploy and manage technical and analytics tags.

Google Tag Manager does not itself create a separate advertising profile. However, its loading may transmit the IP address and other technical information needed to connect to Google servers. Other services, including Google Analytics, may be loaded through Tag Manager; each such service is governed by its own purposes, terms and legal bases.

Google Tag Manager and optional analytics tags deployed through it are configured in accordance with the user’s choice and are activated only after consent. The legal basis for analytics use is Article 6(1)(a) GDPR.

### 7.5 Microsoft Clarity

With prior consent, we use Microsoft Clarity. The provider for users in the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.

Microsoft Clarity helps us analyse interface usability and how users interact with the Platform. The service may generate session replays, heatmaps and aggregated behavioural metrics.

Data processed may include viewed pages, navigation and visit duration, clicks, scrolling, pointer movements and interface interactions, approximate location, IP address, device type, operating system, browser, language and screen size, referrer, URLs, session and cookie identifiers, and recordings of page displays.

Password fields, payment details and other confidential fields are not intended to be recorded. We configure masking for fields and content that may contain a name, email address, password, written assignment, learning result, payment information or other confidential information.

The legal basis is prior voluntary consent under Article 6(1)(a) GDPR and the applicable rules on accessing information on a user’s device. Microsoft Clarity and its optional cookies are not activated before consent is given.

According to Microsoft, standard session replay data is retained for 30 days, labelled or favourited sessions for up to 9 months, and click and heatmap data for up to 9 months. Further information is available in the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement).

Microsoft Clarity should not be used on websites or apps directed at users under 18. Exaveo is therefore intended exclusively for adult users.

### 7.6 UTM parameters

With consent, we may retain UTM parameters such as source, medium, campaign, content and search term, together with the referrer and first landing page, to assess the effectiveness of informational and advertising campaigns.

### 7.7 Managing and withdrawing consent

On the first visit, users may accept or reject optional analytics cookies. Accept and reject options must be available without coercion, and optional consent must not be preselected.

Users may change or withdraw consent at any time through the cookie settings and may delete or block cookies in their browser. Withdrawing consent must be as easy as giving it. Withdrawal does not affect the lawfulness of earlier processing. Rejecting analytics cookies does not restrict access to Exaveo’s core functions.

## 8. Service Providers and Recipients

We do not sell users’ personal data.

| Provider | Purpose | Data categories |

|---|---|---|

| Neon | Cloud database | Account, profile, progress, results and order data |

| Cloudflare R2 | Cloud file storage | Uploaded documents, images, audio and file metadata |

| Vercel | Application hosting, delivery, performance and security | IP address, technical requests, User-Agent, error and usage logs |

| SendPulse | Service and marketing emails | Email, name, subscription status and delivery/opening events |

| WayForPay | Payments and subscriptions | Email, order number, amount, currency, payment status and identifier |

| Google Ireland Limited | Google login, Google Analytics 4 and Google Tag Manager | Login data and, with consent, online identifiers, technical and analytics data, referral sources and website interactions |

| Microsoft Ireland Operations Limited | Microsoft Clarity session replays, heatmaps and usability analysis | With consent, online identifiers, technical data, clicks, scrolling, pointer movements and website interactions |

| Telegram | Telegram login | Telegram User ID, name, username and profile image |

| OpenRouter, Google Gemini, OpenAI | AI-assisted assessment | Assignment text, task context and necessary technical data |

Limited information may also be disclosed to employees, teachers and contractors who need it for support or assessment; accountants, lawyers and professional advisers subject to confidentiality; and public authorities or courts where required by law or necessary to protect legal rights.

Passwords, credentials, database addresses, internal APIs, storage architecture and secret technical settings are not published in this Policy.

## 9. International Data Transfers

Personal data may be processed in Ukraine, the European Economic Area, the United States and other countries where our providers or their subprocessors operate.

Where the GDPR applies, international transfers rely on available lawful mechanisms, which may include adequacy decisions, standard contractual clauses, certified transfer frameworks or other appropriate safeguards, depending on the provider and transfer.

When Google Analytics 4 and Google Tag Manager are used, data may be transferred to Google LLC and other recipients in the United States. Depending on the transfer, Google may rely on certification under the EU–US Data Privacy Framework, the European Commission’s Standard Contractual Clauses and additional safeguards.

When Microsoft Clarity is used, data may also be transferred to Microsoft Corporation, affiliated companies or service providers in the United States and other countries. Depending on the transfer, Microsoft may use the EU–US Data Privacy Framework, Standard Contractual Clauses and other safeguards permitted by law.

## 10. Retention

We retain personal data only for as long as necessary for the relevant purpose:

- account, profile and learning data while the account is active or the data is needed to provide the service;

- uploaded files and written work while needed for learning, review, support or progress history;

- payment, tax and accounting records for statutory retention periods;

- support correspondence while needed to resolve the request, document arrangements or protect rights;

- marketing data until consent is withdrawn or the user unsubscribes; minimal suppression data may be retained to prevent further marketing;

- security and technical logs while needed for diagnostics and protection, and longer where required to investigate an incident;

- Google Analytics user and event data according to the property settings, generally for 2 or 14 months; aggregated reports may be retained longer;

- standard Microsoft Clarity session replays generally for 30 days, and labelled or favourited sessions, click data and heatmap data for up to 9 months;

- cookies for the periods described in Section 7 and in the cookie settings.

When retention ends, data is deleted, anonymised or restricted where continued storage is legally required. Backups may be erased through the ordinary overwrite cycle.

## 11. Account Deletion

Users may request deletion through account settings, where available, or by emailing info@exaveo.com.

After verification, the account becomes unavailable and data is deleted or anonymised within the period required by law and the technical deletion cycle. Certain payment, accounting, fraud-prevention or legal records may be retained where required by law or necessary to establish, exercise or defend legal claims.

## 12. Age Restriction

Exaveo is intended exclusively for users aged 18 or over. We do not knowingly offer services to persons under 18 and do not intend to collect their personal data.

During registration, a user must confirm that they are at least 18 years old. If a user provides false information about their age, we may restrict access, suspend or delete the account.

If we learn that personal data relating to a person under 18 has been collected, we will take reasonable steps to stop the processing and delete the data unless retention is required by law.

Parents or legal guardians who believe that a minor has provided personal data to us may contact info@exaveo.com to request review and deletion.

## 13. Security

We use appropriate technical and organisational measures, including password hashing, secure sessions and time-limited tokens, access controls, encryption in transit, security logging, automated-abuse protection, backups and security-capable cloud providers.

No internet transmission or storage method is completely secure. If an incident occurs, we will respond according to its nature and applicable legal requirements.

## 14. User Rights

Subject to applicable law, users may request access to their data; correction; deletion; restriction; objection to processing based on legitimate interests; withdrawal of consent; and data portability where applicable. Users may also complain to a competent data protection authority.

In Ukraine, a complaint may be submitted to the Ukrainian Parliament Commissioner for Human Rights. Where the GDPR applies, users may complain to the supervisory authority in the EU/EEA country of residence, employment or alleged infringement. Swiss users may contact the Swiss Federal Data Protection and Information Commissioner.

Requests may be sent to info@exaveo.com. We may request information reasonably necessary to verify identity and prevent disclosure to an unauthorised person.

## 15. Third-Party Links

The website may link to third-party resources. We do not control their data practices. Users should review the relevant privacy notice before providing information to another service.

## 16. Changes to This Policy

We may update this Policy when Platform functionality, providers or legal requirements change. The current version will be published on this page with the updated date. Where changes materially affect users’ rights or data use, we may provide an additional notice through the website or available contact details.

## 17. Contact

For privacy and personal-data enquiries, contact:

ФОП МИХАЛЬЧУК ЛЮДМИЛА СЕМЕНІВНА (sole proprietor under Ukrainian law)

Email: info@exaveo.com

Address: 2 Vesniana Street, Pidlisky village, Rivne District, Rivne Region, 35431, Ukraine