Privacy Policy

1. Introduction

We respect your privacy and take care to protect your personal data. This policy applies to the Verbalu website and application and describes how we process information about teachers, trainers, administrators and participants using the Service. Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and Polish data-protection law.

2. Data Controller

The controller of your personal data is Octigo sp. z o.o., with its registered office in Wrocław, ul. Redycka 38/1, 51-169 Wrocław, Poland, entered in the register of entrepreneurs of the Polish National Court Register under KRS number 0000360836, tax ID (NIP) 8951978011, statistical ID (REGON) 021299876 ("Octigo", "we"). Octigo is the operator of the Verbalu website and application.

For any matter relating to personal data you can contact us at hello@verbalu.com or in writing at the company's registered address. We have not appointed a data protection officer - please send data-protection correspondence to the email address above.

3. Our Role: Controller and Processor

We act as the controller for people who create a Verbalu account themselves (teachers, trainers, organization administrators), as well as for billing data, correspondence, contact-form enquiries and the technical data needed to run the Service securely.

Where a teacher, trainer, school, company or other organization uses Verbalu to run sessions and enters participant data into the Service (for example names, email addresses, quiz and exercise answers, results), that person or institution remains the controller of that data, and we process it solely on their documented instructions as a processor within the meaning of Article 28 GDPR. The session organizer decides the purpose and scope of the data collected and is responsible for the legal basis for processing it and for informing participants.

We provide organizations with a data processing agreement (DPA) on request - just write to hello@verbalu.com. Where we act as a processor, we pass participant requests concerning their data to the controller, that is the session organizer, and assist them in handling those requests.

4. Data We Collect

Account data: information provided at sign-up, such as name, email address and organization, together with account settings and preferences. An account can also be created by signing in with Google or with a one-time code sent by email.

Content and usage data: the materials you create (quizzes, boards, games, articles), the prompts you send to AI features, participants' answers and information about how the Service is used.

Technical data: information collected automatically, such as IP address, device and browser type and log data used to operate and secure the Service.

Billing data: for paid plans - the data needed to issue an invoice, plus payment and subscription history. We do not collect or store payment card details; they are passed directly to our payment provider.

5. How We Use Data

We use your data to provide and operate the Service, authenticate users, run sessions, store your content, handle payments, provide support and improve features.

We also use data to keep the Service secure, prevent abuse, comply with legal obligations and - where you consent or where otherwise permitted - to send you Service-related communications.

6. Legal Basis for Processing

We process personal data on the basis of contract performance (Article 6(1)(b) GDPR - delivering the Service you request), our legitimate interests (Article 6(1)(f) GDPR - securing and improving the Service, handling enquiries, pursuing claims), your consent where applicable (Article 6(1)(a) GDPR - for example newsletters and usage statistics), and compliance with legal obligations, including tax and accounting duties (Article 6(1)(c) GDPR).

7. Artificial Intelligence, Profiling and Automated Decisions

Verbalu offers features powered by artificial intelligence (for example generating quizzes, exercises, articles, images and summaries). When you use them, the content of your prompt and any material you attach to it (such as pasted text or a source file) is sent to the Google Gemini model and processed solely to generate a response for you. We do not use your content to train AI models. Please do not enter special-category data into AI features, or data about other people that you have no legal basis to share with us.

We do not take decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Automatically calculated quiz and exercise scores, points, leaderboards and session reports serve an educational and informational purpose for the session leader, who assesses their meaning independently; we do not build marketing profiles from them.

8. Sharing and Processors

We do not sell your personal data and we do not share it with third parties for their own marketing purposes. We do use trusted providers (subprocessors) who process data on our behalf under data processing agreements and strictly on our instructions.

Google Ireland Limited and Google LLC: Firebase and Google Cloud (user authentication, database, file storage, server-side functions and hosting; our server-side functions run in the europe-west1 region in Belgium), Google Analytics (anonymous usage statistics), Google Ads (measuring the effectiveness of our advertising campaigns - only where you consent to marketing cookies), Google Workspace (outgoing email from the Service and handling correspondence) and the Gemini API (artificial-intelligence features).

Hotjar Ltd., based in Malta (part of the Contentsquare group): analysis of how the site is used, including heatmaps and anonymized behavioural statistics, loaded only where you consent to statistical cookies.

Stripe Payments Europe, Ltd., based in Ireland, together with other Stripe group companies: payment, subscription and invoicing services for paid plans.

The list of subprocessors above is complete as of the last-updated date of this Policy. We keep it up to date as the Service changes and announce material changes as described in the "Changes to This Policy" section. You can also request the current list at any time by writing to hello@verbalu.com.

We may also disclose data where required by law or where necessary to protect our rights, our users or the security of the Service.

9. Transfers Outside the EEA

Some of our providers belong to groups headquartered in the United States and may process data outside the European Economic Area. In such cases the transfer takes place under a European Commission adequacy decision (the EU-U.S. Data Privacy Framework, which Google LLC and Stripe, Inc. have joined) or under standard contractual clauses approved by the European Commission, supplemented by additional technical measures such as encryption.

You can obtain a copy of the safeguards we rely on by writing to hello@verbalu.com.

10. Data Retention

We keep personal data for as long as your account is active or as long as necessary to provide the Service, and thereafter only to the extent required to meet legal obligations, resolve disputes and enforce our agreements. You can request deletion of your data at any time.

For example: account data and the content you create are kept for the lifetime of the account and, after deletion, only to the extent required by law; session data and participant results are kept until the session organizer deletes them; billing data and invoices are kept for 5 years from the end of the year in which the tax obligation arose; correspondence is kept for as long as needed to handle the matter and until any related claims become time-barred.

11. Your Rights

Subject to applicable law, you have the right to access, correct, delete or restrict the processing of your personal data, to object to processing based on our legitimate interest, to data portability, and to withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact us at hello@verbalu.com. You also have the right to lodge a complaint with the relevant data-protection authority (in Poland, the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw).

We respond to every request without undue delay and at the latest within one month of receiving it. Where a request is complex or where we receive a number of requests, we may extend that period by a further two months, informing you of the extension and the reasons for the delay within one month of receiving the request. Exercising your rights is free of charge; where a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse to act. If we have doubts about the identity of the person making the request, we may ask for additional information to confirm it.

12. Cookies and Local Storage

We use cookies and similar technologies (including browser local storage) in three categories. Necessary cookies keep you signed in, remember your language and colour theme, store your cookie choice and protect the Service against abuse - the Service does not work properly without them, so by law they do not require consent.

Statistical cookies (Google Analytics and Hotjar) collect only anonymous data about how the site is used: the number of page views, the path taken through the site, the referral source, an approximate country- or city-level location, and device and browser type. They help us understand what needs improving. We do not combine them with your name or with the content you create in the Service.

Marketing cookies (Google Ads) are used only while we are running advertising campaigns. They measure how effective those campaigns are, that is whether a visit from an ad ended in a sign-up, and they cap how often the same ad is shown, including for remarketing. We do not sell cookie data and we do not share it with data brokers.

Statistical and marketing cookies are only set after you consent in the cookie banner shown on your first visit. You can change or withdraw that consent at any time by clicking "Cookie settings" in the site footer or at the bottom of this page; withdrawal does not affect the lawfulness of processing carried out beforehand. Session cookies are deleted when you close your browser, and persistent cookies, including statistical and marketing ones, are kept for no longer than 24 months. You can also manage all cookies in your browser settings - though blocking necessary cookies may prevent parts of the Service from working.

13. Data Security

We apply appropriate technical and organizational measures to protect your data against unauthorized access, loss or misuse - including transport encryption (HTTPS), access control at the database and file level, user authentication, and limiting access to data to those who need it. However, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

14. Age Requirement

Only adults aged 18 or over may create a Verbalu account. The Service is not intended for children, we do not direct content or marketing communications to them, and we do not knowingly collect data about people under 18.

Where a teacher, trainer or organization enters other people's data into the Service or creates accounts for them, it is assumed that those people are 18 or over and that whoever enters the data has their consent or another legal basis for sharing it with us and has informed them about the processing. If we learn that data about someone under 18 has ended up in the Service, we will delete it without undue delay - please report such cases to hello@verbalu.com.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will publish the updated version with a new "last updated" date and, where appropriate, notify you of material changes.

16. Contact

If you have questions about this Privacy Policy or about how we handle your data, contact us at hello@verbalu.com or in writing at: Octigo sp. z o.o., ul. Redycka 38/1, 51-169 Wrocław, Poland.