How we look after your data
Last updated 15 October 2026- We only store what you need to practise.
- No ads, no tracking, and we never sell your data.
- You can download or delete everything at any time.
Data controller
Zepto IT, CVR 38103806, Copenhagen, Denmark, is the data controller for the information Viva processes about you.
What we store
Your email, first name, level and field of study, language, time zone and settings. Your exams, topics and plans. Your practice sessions with the text of the conversations, your answers, grades and feedback. The files you upload and the text we read from them. Your reminders, notifications and messages to us. For each device you sign in on: its name, type and when it was last active.
Audio
Viva does not store audio recordings. Only the text of your conversations is stored.
What we use it for
To provide Viva: asking you questions, giving feedback and grades, building your plan, reminding you to practise and showing your progress. We do not use your data for ads or profiling, we do not track you across apps, and we never sell your data.
Legal basis
We process your data to fulfil our agreement with you when you use Viva (GDPR Article 6(1)(b)). Error reports and the AI usage log rest on our legitimate interest in keeping Viva stable and its costs down (Article 6(1)(f)).
AI
To write questions, feedback and grades, we send the text that is needed – your topic, your answers and extracts of your notes, along with your level and field of study – to our AI provider, OpenAI. We do not send your email or your name. Photos of notes or questions that you take or pick in the app are sent to OpenAI, so the AI can read the text in them. A photo of your notes is deleted once its text has been read, and a photo of questions is not stored at all. For each AI call we store which feature it was and how much it used, so we can keep the AI limit – not what it said.
Who helps us
Render (servers and database, in Frankfurt in the EU), Google Firebase (sign-in and your files), OpenAI (AI models), Sentry (error reports from the app, without personal data), NestJS Observe (measuring how the server runs) and our email provider. They may only process your data on our instructions. Where data is processed outside the EU, this is based on the European Commission's standard contractual clauses or equivalent protection.
How long
For as long as you have an account. Notifications are deleted after 30 days, and a download of your data stays available for 7 days. If you delete your account, it is deleted with all content and files 14 days later – until then you can change your mind. After that, the AI usage log is kept without any link to you.
Your rights
You have the right to access your data, have it corrected or deleted, receive it in a portable form, restrict its processing and object to it. Under Profile › Your data you can download all your data as a file, delete your history and delete your account. You can complain to the Danish Data Protection Agency (datatilsynet.dk).
Security
The connection between the app and our servers is encrypted, and your data can only be fetched when you are signed in.
Contact
Questions about privacy: write to us under Profile › Send a message or at no-reply@zeptoit.dk.
Questions? Write to us at no-reply@zeptoit.dk