Privacy – evulpo

Privacy.

In this privacy policy, we explain how evulpo AG (“Evulpo”, “we”, “us”) collects, uses and protects your personal data when you use our online learning platform (website and services on evulpo.com). We are committed to handling your information in accordance with applicable data protection laws, including the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR). This policy applies to all Evulpo users, whether you use Evulpo through a school or for private use.

If you have any questions about data protection at Evulpo, feel free to contact us at any time at support@evulpo.com. We’re here to help.

We may update this privacy policy from time to time, for example as we expand our services. You can always find the current version on our website at: https://evulpo.com/de-ch/privacy

1. What is personal data, and what does data processing mean?

Personal data refers to information about an identified or identifiable natural person, such as a student, teacher or parent. This includes, for example, your name, your email address, or usage data generated while using the Evulpo platform. In this privacy policy, the term “data” refers to such personal data.

Data processing refers to any action taken with data, whether automated or not. This includes in particular the collection, storage, use, alteration, transmission, restriction or deletion of data.

2. Who is responsible for your data?

evulpo AG is the main organization responsible for processing your data when you use the Evulpo platform. In this capacity, evulpo AG determines the purposes and means of processing and is your point of contact for data protection questions. Our contact details are:

evulpo AG · Pfingstweidstrasse 60 · 8005 Zurich · Switzerland · support@evulpo.com

Private use: If you use Evulpo as a private individual (student or parent), evulpo AG acts as the data controller for your information.

School use: If you use Evulpo as part of a school or educational institution (for example, if a teacher creates student accounts or a school provides access to Evulpo), the school or institution may be the data controller for the students’ data, and Evulpo acts as a data processor on the school’s behalf. This means the school determines why student data is collected and used, and Evulpo processes it according to the school’s instructions and our contractual agreement. We offer schools a data processing agreement to ensure compliance with the GDPR and Swiss law when handling student data. If you are a teacher or school administrator providing us with personal data about students, you are responsible for having the appropriate authority or consent.

School use:

3. What personal data we collect, and why

We collect various types of personal data to provide and improve the learning platform. The specific data we collect depends on how you interact with Evulpo. Below, we describe the categories of data we process and the purposes for which we use them:

Account and profile information: When you register for an Evulpo account, we ask for certain information to create your profile. For students, this may include your name, email address, school level or class, and the region or school (e.g. canton or district) you attend. Teachers or parents creating accounts may provide similar information (such as name, contact details, school or class affiliation).

Account and profile information:

Purpose: To identify you on the platform, to provide suitable learning content (for example, exercises matched to your class and curriculum), and to manage your account settings.

Purpose:

Learning progress and usage data: When you use Evulpo to learn, we collect data about your activity on the platform. This includes the lessons or topics you view, exercises you complete, your answers and results on exercises, your progress on a topic, and other learning activities. If you are a student in a teacher’s class on Evulpo, we also record which class or teacher is linked to your account.

Learning progress and usage data:

Purpose: To improve educational outcomes and enable the core functions of learning, for example by tracking your progress so we can show you your results and provide feedback or corrections.

Purpose:

Contact and communication data: When you get in touch with us, we collect and store your contact details and the content of the communication. This may include your name, email address, phone number (if you provided one), and any information you share in your message or question.

Contact and communication data:

Purpose: We use your information to respond to inquiries, provide customer support and send marketing communications. If you are under 16, please obtain a parent’s or guardian’s permission before signing up for marketing communications. You can unsubscribe from these communications at any time.

Purpose:

Payment and purchase data: If you, your parent/guardian, or a school decides to purchase a subscription or a paid feature, we process the data required for payment. This includes the payer’s name and billing information, payment method details (such as credit card number or account number), and transaction information such as payment date and amount.

Payment and purchase data:

Purpose: To process your order, fulfill our contract by providing access to paid content, and manage billing. We use third-party payment processors to handle your payment securely (see Section 5 on service providers).

Purpose:

Technical and device data: When you visit evulpo.com or use the platform, our systems automatically collect certain technical information about your device and how you access our service. This includes your IP address, browser type and version, device type (e.g. laptop or smartphone and operating system), language settings, and the dates/times of your visits and interactions. This technical data doesn’t directly identify you, but it can be linked to your profile when you’re logged in.

Technical and device data:

Purpose: To ensure the website and platform function properly and securely. Technical data helps us deliver pages correctly, adapt the user interface to your device, and maintain the security of our service (e.g. by logging access and fixing errors).

Purpose:

Behavioral and analytics data: We use cookies and similar tracking technologies to collect data about how you use Evulpo and how you found our site. This may include information about the website or advertisement that brought you to Evulpo, which content or links you click, how long you spend on certain lessons, and other interaction patterns. Some of this data may come from third-party analytics tools (as described in Section 7 below) that track usage on our behalf.

Behavioral and analytics data:

Purpose: By analyzing behavioral data, we can improve the user experience. This data also helps us personalize your experience (for example, by suggesting content that might interest you).

Purpose:

Other data: We may process additional personal data in other contexts consistent with the purposes described in this policy. For example, we might collect information if you take part in a user survey, participate in a promotion or competition, or provide feedback.

Other data:

4. Legal bases for processing personal data

We process different types of personal data depending on how you use Evulpo – whether as a learner, teacher, visitor, applicant or business contact. Below is an overview of the main categories.

Performance of a contract: Most of our data processing is necessary to provide Evulpo’s services in accordance with our terms of use. For example, we process account data, progress data and class information to provide access to the learning platform, whether you sign up directly or are registered by your school.

Performance of a contract:

Your consent: In some cases, such as with optional cookies, we ask for your consent. You can always decide whether to give consent, and you can withdraw it at any time with effect for the future (e.g. via an unsubscribe link or cookie settings).

Your consent:

Legitimate interests: We may process data to improve and secure our services, prevent misuse, support business growth, or contribute to educational research, as long as this doesn’t override your fundamental rights. For example, we analyze usage patterns to improve features, send relevant updates to active users, and may share anonymized data with universities in Switzerland, the EU or the EEA for non-personal scientific research purposes. You can object to processing based on legitimate interests at any time.

Legitimate interests:

Legal obligation: In certain cases, we must process data to comply with legal requirements, such as retaining transaction records for tax purposes or responding to lawful requests from authorities.

Legal obligation:

Public or vital interests: On rare occasions, we process data in the public interest or to protect someone’s vital interests, such as in an emergency. Evulpo does not currently rely on these bases in practice.

Public or vital interests:

How does this apply to school use? When Evulpo is used by students via a school, teacher, or other educational institution, the primary legal basis for processing student data typically rests with the school. This may include the school’s legitimate interest in providing education, its public task or legal obligation under applicable education regulations, or the performance of a contract between the school and Evulpo.

In such cases, the school or institution acts as the data controller and is responsible for ensuring an appropriate legal basis. Evulpo acts as a data processor on the school’s behalf and processes data strictly according to the school’s instructions and on the legal basis chosen by the school.

When Evulpo processes personal data as an independent controller, for example to comply with legal obligations, improve platform performance, or prevent misuse, we rely on one of the legal bases described above, such as legitimate interest or legal obligation.

5. How we share your personal data

We do not sell your personal data to third parties. However, in certain situations we share your data with others when necessary to run our business and provide our services. Whenever we share data, we make sure appropriate safeguards or a contract are in place to protect your information. The main categories of recipients of personal data are:

Service providers (processors): We work with third-party companies that help us provide Evulpo and process data on our behalf. These include, for example, hosting providers, IT infrastructure and software tools, email and notification services, analytics services, customer support tools, payment processors and other technology providers. These third parties act under our instructions and are “processors” under data protection law. This means they may only use your data for the specific tasks we’ve engaged them for, and they must protect your data in the same way we do. A regularly updated list of service providers can be found here.

Service providers (processors):

Teachers and schools (for school accounts): If your Evulpo account was created as part of a school program or by a teacher, we share your relevant personal data with the organizing person or institution. For example: if a teacher registers a class of students on Evulpo, they (and possibly other authorized school staff) may view certain information about the student accounts they manage. This typically includes the student’s name, class or grade level, and learning progress or results on the platform. We grant this access to support Evulpo’s educational purpose in the classroom.

Teachers and schools (for school accounts):

Important: Personal data of students and teachers processed as part of school-managed access is stored exclusively on servers operated by Hetzner Online GmbH in Germany. For example, we do not send marketing emails directly to students in a school-organized class, nor do we share their data with third parties, unless necessary to provide the Evulpo service.

Important:

Advertising partners: We may work with an advertising partner or marketing platform (such as Google, Facebook, or other ad networks) to reach people who might be interested in Evulpo. In doing so, we may provide a partner with limited data, such as your email address in encrypted form or device identifiers, so they can check whether you are also a user on their platform and then show you Evulpo advertising or relevant content. We only share such data with your consent, where required. Online advertising via cookies or custom audiences will only involve your data if you have accepted advertising cookies or similar tracking (see Section 7). We do not share information such as your learning progress or contact details with advertisers in a way that would personally identify you to them.

Advertising partners:

Payment providers and financial institutions: If you purchase a subscription as an individual and make a payment to Evulpo, your payment data is processed by third-party providers such as Stripe or PayPal. We share data such as your email, billing address, and the amount to be charged with the payment processor, and they inform us whether the payment was successful. In some cases, we must also share information with banks or credit card companies to process refunds or resolve disputes (for example, if you request a chargeback or refund, we may need to provide proof of your transaction). These recipients process your data under their own legal obligations (e.g. anti-fraud and accounting laws), and we only share what is necessary for the transaction.

Payment providers and financial institutions:

Legal and regulatory authorities: We may disclose your personal data to government agencies, regulators, courts, or law enforcement authorities when legally required to do so, or when such disclosure is reasonably necessary to (i) comply with a legal obligation, process, or request (e.g. a subpoena, court order, or formal request from a data protection authority); (ii) enforce our terms of use or other agreements; or (iii) protect the rights, property, or safety of Evulpo, our users, or the public. When we receive a request for your data, we will review it carefully to ensure it has a valid legal basis and provide only the minimum data required. Where permitted, we may notify you of such requests.

Legal and regulatory authorities:

Corporate transactions: If evulpo AG is involved in a merger or acquisition, your data may be transferred as part of that transaction. We would only do this if necessary to continue providing you with services, and any receiving party will be required to respect your personal data in a manner consistent with this privacy policy (we will ensure appropriate safeguards through the transaction agreements). If a transfer of your data is planned, we will notify you and give you any choices available at that time (for example, the option to delete your data before the transfer, where legally permitted).

Corporate transactions:

Aside from the parties described above, our internal teams at Evulpo have access to your data on a need-to-know basis (for example, our customer support team may view your profile data when helping you, our technical team may view necessary data for maintenance, etc.). All Evulpo employees are bound by confidentiality and data protection obligations.

No public disclosure: We do not publish your personal information publicly. Other Evulpo users cannot see your data, except in the specific context of school use (as explained, a teacher can view the data of their own students). We do not make any data searchable or visible to the general public (Evulpo is not a social network).

No public disclosure:

6. Cookies and online tracking technologies

Like most online platforms, Evulpo uses cookies and similar tracking technologies to make our website work, to understand how you use our services, and to support our marketing. This section explains what these technologies are and how we use them.

What are cookies? Cookies are small text files placed on your device when you visit a website. They serve different purposes, such as keeping you logged in, remembering preferences, analyzing usage, or supporting marketing. These may be set by us (first-party) or by partners (third-party, e.g. analytics tools or advertising providers).

Types of cookies and tracking on Evulpo:

Essential cookies: These are necessary for our platform to operate. For example, we use a cookie to keep you logged in as you navigate between pages, so you don’t have to re-enter your login details with every click. Essential cookies also help with security (for example, to protect your session or help us detect malicious activity). Without these cookies, key features of Evulpo would not work correctly. Because they are necessary, these cookies are typically active by default, and you cannot opt out of them if you want to use our core services (but they are also the least privacy-invasive, as they usually don’t collect information beyond what’s needed for the service).

Essential cookies:

Preference and functionality cookies: These cookies remember your choices and preferences to provide a more personalized experience. For example, we might use a cookie to store your language choice or the region/curriculum you last used, so the site can present content matched to your location without asking every time. They may also enable certain non-essential but helpful features on the site.

Preference and functionality cookies:

Analytics cookies and tracking: We use analytics tools to collect information about how users interact with Evulpo. For this purpose, we and our analytics partners place cookies or similar trackers that collect data such as which Evulpo pages you visit, how long you stay, how you move through our content, and which features you use. This helps us understand usage patterns and user behavior overall. For example, we can see which subjects are most popular or whether a new feature is being used. Data collected via analytics cookies is usually aggregated and anonymized (e.g. statistics on overall usage), so it doesn’t directly identify individual users. However, if you’re logged in, some analytics data may be linked to your account for our internal analysis, but we don’t profile individual learners without consent beyond what’s necessary to improve the service.

Analytics cookies and tracking:

Advertising and marketing cookies: Evulpo and our advertising partners may use cookies or pixels to deliver and track advertising content. Advertising cookies record information about your visit to Evulpo and your interests (for example, which subjects you’ve viewed), so we or our partners can show you relevant ads on other websites or social media platforms. For example, we might use a Facebook pixel on our site to let Facebook know that a certain user (identified anonymously) visited a page, which could later let us show that user an Evulpo ad on Facebook. Similarly, cookies help ensure you don’t see our ads too often and that they’re shown to the right audience when we advertise on Google or other networks. We may also use a method called “custom audiences,” where we submit a hashed version of your email or user ID to an advertising platform (such as Facebook or Google); if you’re a user of that platform, they can match the hash and add you to a group to receive specific advertising. This process does not reveal your actual email in plain text to the platform, and if you’re not a user of that platform, the information is disregarded.

Advertising and marketing cookies:

Important: We only use advertising cookies or share data for targeted advertising with your consent. The first time you visit our site, our cookie banner will ask whether you accept advertising cookies. If you decline, we won’t use these cookies, and you’ll simply see generic (non-targeted) ads or fewer Evulpo ads. Even if you accept, you can change your mind later by adjusting your cookie settings or deleting cookies. Declining these cookies doesn’t mean you won’t see any ads, just that ads won’t be personalized using your data. Also note that even with advertising cookies enabled, we don’t share personal data with advertisers beyond what’s described here (and this sharing often happens in encrypted or pseudonymous form). We don’t allow third parties to independently track you on Evulpo for their own purposes; any advertising use of data is orchestrated by Evulpo with approved partners as described.

Important:

Cookie consent and management: On your first visit to Evulpo, we show you a cookie consent banner to inform you about our use of cookies. You can choose whether to allow all cookies or only essential cookies. Your choice is stored in a cookie so we can remember your preferences for future visits. If you’d like to change your preferences later, you can usually do so by deleting your browser cookies to trigger the consent prompt again. You can also manage your cookie settings directly in your browser. Please note that blocking all cookies may limit Evulpo’s functionality; for example, you may not be able to log in or keep your settings.

Cookie consent and management:

7. Social media and external links

Evulpo’s website and communications may contain links to third-party websites, including social media platforms such as Facebook, Instagram, TikTok, LinkedIn or YouTube (where we may have official pages or communities). We may also provide simple links or icons that let you visit our profiles on these platforms or share content.

If you choose to click on these links or icons, you’ll be redirected to the relevant third-party website. Please note: once you leave the Evulpo website or interact with a social media plugin, the processing of your data is governed by that third party’s privacy policy, not Evulpo’s.

Social media sign-ins: If you create an account or sign in via social media accounts (such as “Sign in with Google”), we receive the information necessary from that provider to authenticate you (for example, your email address and name). This information is handled in accordance with this privacy policy. Any data the social media platform collects during your login is subject to their policy.

8. International data transfers

We generally process your data within the EU. In some cases, however, such as when using specific service providers or software applications, your data may be transferred abroad. These transfers primarily involve the European Free Trade Association (EFTA), but may also involve countries worldwide, such as the United States (particularly in connection with cookies, social media plugins and other third-party tools).

When personal data is transferred to a country that doesn’t offer an adequate level of data protection under Swiss or EU law, we ensure appropriate safeguards, typically through the use of standard contractual clauses approved by the European Commission, supplemented where necessary by additional security measures. In specific cases, we may rely on legal exceptions, such as your explicit consent, the necessity of the transfer to perform a contract, the establishment, exercise or defense of legal claims, overriding public interests, data that has been made public by the data subject, or the need to protect an individual’s vital interests.

9. Data retention and deletion

We will retain your data only as long as necessary to fulfill the purposes for which we collected it, including to meet legal, accounting, or reporting requirements.

Deletion requests: You have the right to request the deletion of your data at any time (see Section 11, Your rights). Upon such a request, we will assess which data we can delete. We will comply with your request as far as possible while complying with legal retention obligations.

10. Data security

Evulpo takes the security of your data very seriously. We implement a range of technical and organizational measures to protect your information from unauthorized access, loss, alteration, or disclosure. These measures include:

Encryption: We use encryption protocols (such as HTTPS/TLS) to secure data in transit between your device and our servers. This means that when you enter personal information on evulpo.com, it is encrypted before being sent over the internet. We also use encryption or hashing for certain sensitive data at rest (for example, passwords are stored in hashed form, meaning they aren’t stored in plain text and can’t easily be recovered or read by anyone, including us).

Access controls: Personal data stored on our servers is only accessible to authorized personnel who need access to perform their duties. We restrict access based on roles and use authentication measures (such as strong passwords, two-factor authentication, and monitoring of access logs) to prevent unauthorized internal access. Our staff and any partners are trained in data protection and bound by confidentiality obligations.

Secure infrastructure: We host data on servers operated by Hetzner Online GmbH in Germany. Hetzner is certified to ISO/IEC 27001, an internationally recognized standard for information security management, and implements robust technical and organizational measures to protect data. These include firewalls, DDoS protection, access controls, and regular security updates. Evulpo also performs encrypted backups to guard against data loss. All data is transmitted and stored securely, and access is granted only to authorized personnel.

Data minimization: Wherever possible, we minimize the amount of personal data we collect and store. By limiting what we hold, we reduce the risk associated with any potential security issue. For example, as mentioned, we don’t store sensitive payment information in our systems; this is handled by specialized payment providers.

11. Your rights as a data subject

As an Evulpo user, you have several rights regarding your personal data under applicable data protection laws, such as the Swiss FADP and the EU GDPR. While specific rights may vary slightly depending on where you live, we strive to uphold these rights for all users, as far as possible:

Access: You can access your data and receive a copy of it.

Rectification: If your data is incorrect or incomplete, you can ask us to update or correct it. In some cases, you can edit information directly in your account settings.

Deletion: You can ask us to delete your data in whole or in part, unless we are legally required to keep it.

Objection: You can object to data processing in certain situations, particularly for direct marketing. Where we rely on “legitimate interests,” you can object for reasons relating to your particular situation.

Withdrawal of consent: Where we process your data based on consent (e.g. cookies or marketing), you can withdraw that consent at any time.

To exercise any of these rights, contact us at support@evulpo.com.

12. Children’s privacy and special considerations for school use

Evulpo is an educational platform that can be used by both children (students) and adults (teachers, parents). Protecting children’s personal data is especially important to us.

Private use: If you are under 16, please only use Evulpo with the involvement of a parent or guardian. We require children under 16 to have a parent’s or legal guardian’s permission to create an account for private use. In practice, this means a parent should oversee the sign-up process. We do not knowingly allow a child under 16 to sign up or purchase a paid subscription without parental consent. If we learn that we have collected a child’s personal data without proper consent, we will take steps to delete that data.

School or teacher use: In some cases, particularly in the education sector, a teacher or school may act in place of parents to provide consent for using Evulpo for educational purposes. If you’re a teacher or school staff member creating accounts for your students, you confirm that you have the authority to do so.

Restricted use of children’s data: We ensure that all personal data about students/children is used exclusively for educational and support purposes. Any analytical data we collect about how a student uses Evulpo serves to improve educational outcomes and user experience. We do not share a child’s personal details with third-party advertisers, and any necessary communication about the account (such as password resets) is handled in a privacy-conscious way (often via the responsible teacher or parent).

13. Updates to this privacy policy

We may revise or update this privacy policy from time to time. Laws, regulations, and our services may evolve, and we want our privacy practices to remain current and transparent. If we make changes, we will publish the updated policy on our website and change the “last updated” date below. For material changes, we may also notify you directly through a prominent notice on our website or by email, particularly where required by applicable law.

Last updated: April 23, 2026

You can download our data processing agreement:

Download PDF