Privacy Policy

1. Who We Are

Violto is operated by Violto. Violto is an AI-native learning platform that generates personalized courses on demand for individuals learning technical skills.

Contact: support@violto.com

2. What Violto Does

Violto is a subscription-based AI learning platform. Users describe a topic, complete a short knowledge assessment, and Violto generates a fully structured, personalized course — calibrated to their exact level and learning goals. Each lesson is generated on demand via AI. The platform also includes a course-aware AI chat assistant, progress tracking, and optional PDF export (Pro plan).

A free plan is available. Paid plans (Plus and Pro) unlock unlimited course generation, AI assistant usage, and additional features.

3. Information We Collect

What We Do Not Collect

• We do not collect contact lists, address books, or social graphs.
• We do not collect precise location data (GPS coordinates).
• We do not store your payment card details — payment is handled entirely by Stripe.
• We do not sell your personal information to third parties.

Account Data

When you register, we collect your email address and a hashed password. This data is managed by Supabase (our authentication and database provider). Your email is used to identify your account, manage your subscription, and send transactional communications (e.g., billing receipts, password resets).

Course Content and AI Inputs

When you use Violto, you submit content such as topic descriptions, assessment answers, and AI chat messages (collectively, "Your Content"). This content is sent to OpenAI's API to generate courses, lessons, and chat responses. OpenAI does not use API-submitted data to train its models. We retain Your Content in your account to maintain your course history and progress.

Generated Content

Course structures, lessons, quizzes, and AI chat responses are generated by AI models and stored in your account so you can continue learning across sessions. You own this generated content and may use it for any lawful purpose.

Payment Data

Payments are processed by Stripe. We receive confirmation of payment status and your Stripe customer ID to manage your subscription. We do not receive or store full card numbers, CVC codes, or bank account details.

Analytics Data

We may collect anonymized usage analytics (page views, feature interactions, session duration, device type, browser, and country-level location) to understand how the platform is used and improve it. This data does not identify you individually.

4. How We Use Your Information

• Service provision: To generate your courses, lessons, and AI responses; to maintain your progress and course history.
• Account management: To authenticate you, manage your subscription, and send billing and account communications.
• Platform improvement: To understand how features are used, identify issues, and improve the product.
• Security: To detect abuse, prevent unauthorized access, and maintain platform integrity.
• Legal compliance: To comply with applicable laws, respond to legal requests, and enforce our Terms.

AI Model Training: Violto does not use your submitted content to train its own AI models. Content submitted through the Service is processed by OpenAI via its API; under OpenAI's API data usage policies, such content is not used to train OpenAI's models.

5. Cookies

We use essential cookies to keep you logged in and maintain session state. We may use analytics cookies to measure aggregate usage patterns.

We do not use advertising cookies or cross-site tracking cookies. The site does not respond to Do Not Track (DNT) signals in a standardized way, but you can opt out of analytics cookies as described above.

6. Third-Party Data Processors

We share data with the following third parties as part of operating the service:

All processors are contractually required to process data only as instructed and to maintain appropriate security measures.

7. Data Retention

• Account data (email, subscription status): retained while your account is active. Deleted within 30 days of account deletion, subject to applicable law.
• Course content and AI inputs (topics, assessments, chat history): retained in your account to maintain progress. Deleted with your account.
• Payment records: retained as required by applicable tax and financial regulations (typically 7 years).
• Analytics data: retained for up to 14 months (Google Analytics default).
• Server access logs: retained for up to 30 days for security and debugging purposes.

8. Your Rights

GDPR — EEA and UK Residents

If you are located in the European Economic Area or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data ("right to be forgotten").
• Restriction: request that we limit how we process your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests.
• Complaint: lodge a complaint with your national data protection supervisory authority.

Legal basis for processing: We process your data under the following GDPR bases: (a) contract performance — to provide the service you signed up for; (b) legitimate interests — for security, fraud prevention, and product improvement; (c) consent — for optional analytics and marketing communications.

CCPA — California Residents

If you are a California resident, you have the right to:

• Know what categories of personal information we collect and how it is used.
• Delete personal information we hold about you (subject to certain exceptions).
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information.

Violto does not sell or share personal information with third parties for advertising or cross-context behavioral advertising purposes.

How to Exercise Your Rights

Email support@violto.com with your request. We will respond within 30 days. We may ask you to verify your identity before processing your request.

9. International Data Transfers

Violto is a global service. Your data may be processed in the United States and other countries where our processors (Supabase, Stripe, OpenAI, Vercel) operate. When we transfer personal data from the EEA or UK to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms to ensure an equivalent level of data protection.

10. Children

Violto is not directed to children under 13 (or under 16 for EEA/UK residents). We do not knowingly collect personal information from children below these ages. If you believe a child has provided personal information through our service, please contact us at support@violto.com and we will delete it promptly.

11. Security

We take reasonable technical and organizational measures to protect your data, including:

• All data in transit is encrypted via TLS/HTTPS.
• Passwords are hashed by Supabase using industry-standard algorithms — we never store plaintext passwords.
• Payment data is processed by Stripe (PCI DSS compliant) — we do not handle or store card details.
• Access to production systems is restricted to authorized personnel.

No system is completely secure. If we become aware of a security breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new "Last updated" date. For significant changes, we may also notify you by email or in-app notice. We encourage you to review this page periodically.

13. Contact

For privacy-related questions, requests, or concerns, contact us at:

Violto
support@violto.com
We aim to respond within 30 days.