This Privacy Policy explains how Verva Digital Ltd ("Verva", "we", "us", or "our") collects, uses, and protects your personal data when you use the Verva mobile application and website (together, the "Service"). We are committed to protecting your privacy and handling your data in a transparent way.

Verva Digital Ltd is a company registered in England and Wales. For questions about this policy, contact us at support@verva.ai.

1. Information We Collect

We collect the following types of information:

Information you provide

• Account information: When you create an account, we collect your email address and authentication credentials. If you sign in with Apple or Google, we receive the name and email address associated with that account.
• Language preferences: Your native language, learning language, and proficiency level.
• Learning activity: Words and phrases you save, chat messages you send, exercise answers, and progress data.

Information collected automatically

• Usage data: How you interact with the app — screens viewed, features used, session duration, and learning patterns. This is collected via PostHog analytics (see Section 5).
• Device information: Device type, operating system version, and app version.
• Crash reports: If the app crashes, we collect diagnostic data via Firebase Crashlytics to identify and fix bugs.

Information we do not collect

• We do not collect the Apple Identifier for Advertisers (IDFA) or any advertising identifiers.
• We do not record audio from your device. The app uses your device's speakers for playback only.
• We do not access your contacts, photos, location, or other device sensors.

2. How We Use Your Information

We use your information to:

• Provide the Service: Deliver articles, generate AI explanations and exercises, track your saved words and learning progress.
• Personalise your experience: Adapt content difficulty, exercise types, and recommendations based on your proficiency and learning activity.
• Process payments: Manage subscriptions through Apple's App Store and our payment processor (RevenueCat).
• Improve the Service: Analyse usage patterns to fix bugs, improve features, and develop new functionality.
• Communicate with you: Send important account notifications. We do not send marketing emails unless you opt in.

3. Legal Basis for Processing (UK GDPR)

Under UK data protection law, we process your personal data on the following legal bases:

• Contract: Processing necessary to provide the Service you signed up for (account management, delivering content, tracking progress).
• Legitimate interests: Analytics and product improvement, provided these interests are not overridden by your rights. You can opt out of analytics (see Section 11).
• Consent: Where we rely on your consent (e.g., optional communications), you can withdraw it at any time.
• Legal obligation: Where we are required to process data to comply with the law.

4. AI-Generated Content

Verva uses artificial intelligence to generate explanations, examples, and practice exercises in response to your questions and learning activity. When you use the chat feature or generate exercises:

• Your messages and the article context are sent to an external cloud AI service to generate responses.
• AI-generated content is for language learning purposes and should not be relied upon as professional linguistic or educational advice.
• We do not use your chat messages to train AI models.

5. Third-Party Services

We use the following third-party services to operate Verva. Each processes data according to their own privacy policies:

Service	Purpose	Data shared
Firebase Authentication (Google)	Account creation and sign-in	Email, authentication tokens
Firebase Crashlytics (Google)	Crash reporting and diagnostics	Device info, crash logs (no personal data)
Cloud Firestore (Google)	User data storage	Learning progress, saved items, preferences
Cloud AI service	AI-powered explanations and exercises	Chat messages, article text context
RevenueCat	Subscription management	Anonymous user ID, purchase receipts
PostHog (EU)	Product analytics and session replay	Usage events, anonymised session recordings
Cloudflare	Website hosting, content delivery, data storage	Article content, audio files
Apple / Google Sign-In	Authentication	As per Apple/Google's sign-in data sharing

6. Data Retention

• Account data: Retained for as long as your account is active. When you delete your account, your personal data is deleted within 30 days.
• Learning data: Saved words, exercise history, and progress are deleted when you delete your account.
• Analytics data: Usage data in PostHog is retained for 12 months, then automatically deleted.
• Crash reports: Retained in Firebase Crashlytics for 90 days.
• Chat messages: Stored for your session and learning continuity. Deleted when you delete your account.

7. International Data Transfers

Verva Digital Ltd is based in the United Kingdom. Some of our third-party services process data outside the UK:

• Google (Firebase, Gemini): Data may be processed in the United States. Google operates under Standard Contractual Clauses and the UK International Data Transfer Agreement.
• PostHog: Your analytics data is stored in the EU (Frankfurt) via PostHog's EU cloud.
• Cloudflare: Content is served from global edge locations. User data is stored in Cloudflare's infrastructure.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR.

8. Your Rights

Under UK data protection law, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure: Ask us to delete your personal data (see Section 9).
• Portability: Request your data in a structured, machine-readable format.
• Restriction: Ask us to limit how we process your data.
• Objection: Object to processing based on legitimate interests, including analytics.
• Withdraw consent: Where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at support@verva.ai. We will respond within one month, as required by UK GDPR.

9. Account Deletion

You can delete your account at any time from within the app (Settings → Account → Delete Account). When you delete your account:

• Your profile, email address, and authentication data are permanently deleted.
• Your saved words, learning progress, chat history, and exercise data are permanently deleted.
• Your subscription (if active) remains valid until the end of the current billing period. Manage subscriptions through the App Store.
• Anonymised analytics data may be retained, as it can no longer be linked to you.

Account deletion is irreversible. Once deleted, your data cannot be recovered.

10. Children's Privacy

Verva is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at support@verva.ai and we will delete it promptly.

11. Analytics and Tracking

We use PostHog for product analytics to understand how people use Verva and improve the experience. PostHog collects:

• Screen views and feature interactions
• Session recordings (anonymised — no text input or personal data is captured in recordings)
• Performance metrics

PostHog data is stored in the EU (Frankfurt). We do not use cookies in the mobile app. The Verva website uses only essential cookies required for the site to function.

We do not use any advertising trackers, and we do not sell or share your data with advertisers.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS)
• Secure token storage on your device (using the device's secure enclave)
• Access controls and authentication for all backend services

While we take reasonable precautions, no method of transmission or storage is 100% secure. If you become aware of a security issue, please contact us immediately at support@verva.ai.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you through the app or by email. The "Last updated" date at the top of this page indicates when the policy was last revised.

We encourage you to review this policy periodically.

14. Contact Us

If you have questions about this Privacy Policy or how we handle your data:

• Email: support@verva.ai
• Company: Verva Digital Ltd, United Kingdom

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority: ico.org.uk/make-a-complaint.

15. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information we collect and how it is used.
• The right to request deletion of your personal information.
• The right to opt out of the sale of your personal information. We do not sell your personal information.
• The right to non-discrimination for exercising your privacy rights.

To exercise these rights, contact us at support@verva.ai.