Privacy Policy

The controller of personal data within the meaning of Regulation (EU) 2016/679 ("GDPR") and the Swiss Data Protection Act of 25 September 2020 ("revDSG") is:

Ing. Michaela Mušková Meždejová
Registered address: Rue Auguste Matringe 6, 1180 Rolle, Switzerland, Europe
UID/IČO/IDE: -
Email for data protection matters: privacy@photovoc.online
General contact: support@photovoc.online

Data Protection Officer (DPO): The controller is not required to appoint a DPO under Article 37 GDPR. For data protection matters you may contact us at any time at privacy@photovoc.online.

EU representative under Art. 27 GDPR: The controller is assessing whether the exemption under Art. 27(2) GDPR applies (occasional processing with low risk, without large-scale processing of special categories of data). Processing in the app does not involve special categories of data or criminal data and is low-risk given the small scale and the absence of advertising or data sales; the controller periodically reviews the question of regularity. Until this assessment is concluded, you may address requests directly to privacy@photovoc.online.

PhotoVoc is an educational app for learning vocabulary, definitions and conjugation. The user uploads a photograph of a text page, which is sent for content recognition. From the recognized words the app automatically creates flashcards, quizzes, writing exercises, tests and conjugation practice for the user's native language (conjugation for foreign languages is being prepared). It offers a free plan (with limits) and paid monthly/yearly subscriptions.

The app is built and hosted on the Base44 platform (backend-as-a-service), which provides the database, authentication, file storage, email, AI and payment infrastructure. The controller processes data exclusively through this platform and its sub-processors.

• Identification data: email and full name from the account.
• User content: word sets, flashcards, notes, example sentences, word knowledge status, created tests.
• Uploaded photographs: images of pages sent for recognition (stored in the platform file storage, see point 8).
• Usage and subscription data: plan, period dates, scan/quiz/test/write counters, bonus credits.
• Sharing between users: recipient email, share token, set metadata.
• Device data: OS and device type (Desktop/Tablet/Mobile).
• Subscription transaction data: plan type, payment period, invoice identifier.
• Technical/log data: timestamps, IP (used for security and operations).

Special categories of data (Art. 9 GDPR): PhotoVoc does not deliberately request or collect these. A user may nonetheless accidentally upload a photograph containing sensitive information. The user should not upload photographs containing such data unless necessary to use the service.

• Providing the service: registration, creating sets, flashcards, quizzes, tests — performance of a contract (Art. 6(1)(b) GDPR / revDSG).
• AI content recognition from photographs: performance of contract — necessary to create flashcards (see point 5).
• Sharing sets and invitations: performance of contract at the user's request.
• Billing and payments: performance of contract + legal obligation (Art. 6(1)(c) — accounting, taxes).
• Security and prevention of abuse of limits and bonuses: legitimate interest of the controller (Art. 6(1)(f)). This also includes keeping the email hash after account deletion (see points 8 and 12).
• Technical support and service improvement (aggregated): legitimate interest; data is aggregated or pseudonymized.
• Marketing/notification emails: only on the basis of consent (Art. 6(1)(a)), revocable at any time.
• Use of the service by minors (under 16): consent of the holder of parental responsibility (Art. 8 GDPR in conjunction with Art. 6(1)(a)); for adult users the legal basis is performance of a contract (Art. 6(1)(b)).
• Parent portal and consent management: the parent's email is also processed so that the parent can log in to PhotoVoc with the same email, see the progress of all their children in one place, manage weekly reports and invite a co-parent — on the basis of consent (Art. 6(1)(a)), revocable at any time. This purpose is separate from the consent to process the child's data.

Provision of data (Art. 13(2)(e) GDPR): Providing certain data — in particular email and name at registration, and uploaded photographs for text recognition — is a contractual requirement necessary to provide the service. Without this data we cannot provide the service. Other data (e.g. notes, optional sharing) is voluntary; not providing it does not affect the basic functioning of the service.

The photograph uploaded by the user is stored in the Base44 platform file storage and its URL is sent to the platform's AI interface (InvokeLLM), which recognizes the text on the image and generates flashcards (translations, definitions, synonyms, example sentences).

• Provider and place of processing: recognition is provided by an AI/LLM service available within the Base44 platform. On the Builder plan, data is stored in the US; transfers are covered by DPA/SCC. On request we will provide available information about the specific provider that processed your data.
• Model training: we have no information that uploaded photographs or text are used to train third-party models. If this changes, we will update this document and request your consent where applicable.
• Legal basis: processing is necessary to provide the main service you requested (Art. 6(1)(b) GDPR).
• Human oversight: AI output serves as educational content and does not constitute a decision about the user (see also point 13).

The controller uses the following sub-processors (with DPAs in place):

Payment data: PhotoVoc does not store the card number, expiry date or CVV. The user enters these directly with Stripe (PCI-DSS). We only store the plan type, period dates, invoice identifier and email from the transaction.

The email and AI services are part of the Base44 platform (Core integrations). We will provide information about the contractual safeguards of these services on request. PhotoVoc does not use external analytics cookies (e.g. Google Analytics).

On the current (Builder) plan of the Base44 platform, your data is stored in storage located in the United States (USA). The controller has a DPA with the platform and transfers outside the EU/Switzerland are covered by Standard Contractual Clauses (SCC). The platform's sub-processors may also operate outside the EU and Switzerland; protection during transfer is ensured in particular by:

• Standard Contractual Clauses (SCC) approved by the European Commission, or the Swiss equivalent under revDSG / FedDtA.
• Additional technical and organizational measures (encryption, minimization, strict access management) per EDPB Recommendations 01/2020.

A copy of the SCC and the available list of sub-processors will be provided on request (point 10).

• Account and user content: for the duration of the active account. After "Delete account" or other account deletion, all your sets, flashcards, notes, statistics, tests, share tokens and other records you own are deleted (soft delete). The Base44 platform keeps deleted records in a 30-day trash and then permanently erases them. The actual total data lifetime is therefore approx. 30 days from deletion.
• Parental consent denied: the child's account and data are deleted within at most 24 hours of the parent's denial; a 30-day trash follows, so permanent erasure occurs within approx. 31 days of denial. The same email may re-register.
• Parent did not respond to consent: if the parent does not respond to our consent request within 7 days, the account and data are deleted automatically; permanent erasure within approx. 37 days of sending the request. The email may re-register.
• Uploaded photographs: stored in the Base44 platform storage. They are not currently auto-deleted after recognition; they remain for the lifetime of the account unless deleted during account deletion or on request. PhotoVoc does not use the photograph for further educational functions after recognition; the resulting text content is stored in the account independently of the original photograph.
• Usage records (CreditUsage, DeviceEvent): 24 months, unless no longer needed sooner.
• Subscription data (Subscription): for the lifetime of the account; deleted upon account deletion.
• Accounting/billing data: per the statutory retention period for accounting (Switzerland / EU — generally 10 years); only necessary data.
• Stripe payment records: per Stripe policies and statutory periods.
• Usage and security logs: 12 months, or shorter; longer only under legal obligation or an ongoing incident investigation.
• Account deletion records (DeletedAccountLog): we store an HMAC-SHA-256 of the email (with a server secret key), the plan type, limit usage and deletion reason — for approximately 10 years — to demonstrate compliance with Swiss statutory retention periods, improve the service and prevent abuse (see points 4 and 12).
• Parental consent history (ParentalConsentEvent): for minors we keep records of consent requests sent (pending) and each parental decision (granted/denied) — for approximately 10 years for compliance and audit.

Shared sets after account deletion: if we shared a set with another user and they accepted it, an independent copy is created in their account that belongs to them. When we delete our account, this copy remains in the recipient's account and we no longer control it.

• Technical / functional: session and login state provided by the platform — the service does not work without them, no consent required.
• Local storage (localStorage): the app stores only the state of some modals in the browser. These are not cookies or tracking.
• Analytics: we use internal platform analytics (base44.analytics), which records anonymized events. We currently do not use external analytics cookies.
• Marketing cookies: we do not use any.

Third parties (e.g. Stripe) may store their own cookies during the payment process — these are governed by their own terms.

• Right of access — a copy of your data and information about processing.
• Right to rectification — of incorrect or incomplete data.
• Right to erasure ("right to be forgotten") — unless this conflicts with a legal obligation.
• Right to restriction of processing.
• Right to data portability — in a structured, machine-readable format.
• Right to object — to processing based on legitimate interest or direct marketing.
• Right to withdraw consent at any time; the lawfulness of processing before withdrawal is not affected.

How to exercise your rights: by email to privacy@photovoc.online with the subject "GDPR — request". The response period is 1 month (extendable by a further 2 months in complex cases) under Article 12 GDPR. To verify your identity we may ask for additional information. The first copy of your personal data will be provided free of charge on request (Art. 12(5) GDPR).

Complaint to a supervisory authority: you may lodge a complaint with a supervisory authority without first having to address the matter with us:

• Switzerland: FDPIC — www.edoeb.admin.ch
• EU: the supervisory authority in the Member State of your habitual residence (list on the EDPB website).

• Transport encryption (TLS) and encryption of the database at rest (provided by the platform).
• Row-level security (RLS): the user sees only their own sets; the exception is deliberately activated sharing at their instruction.
• Principle of least privilege, strict access management in the controller's team.
• Access logging and monitoring of abuse of limits/bonuses (anti-fraud).

Personal data breach: in the event of a breach, we assess the notification obligation under GDPR and revDSG. Where required, we notify the supervisory authority without undue delay (generally within 72 hours) and inform affected individuals.

Upon account deletion we retain an HMAC-SHA-256 of your email address (with a server secret key), the plan type at the time of deletion, limit usage and any deletion reason. A cryptographic hash is not automatic anonymization under GDPR; we therefore treat it as pseudonymized personal data and protect it like any other data. Purpose: prevention of abuse of bonuses and limits (anti-fraud), legal basis Art. 6(1)(f) GDPR. The retention period for this record is approximately 10 years (Swiss statutory period for demonstrating compliance).

PhotoVoc does not carry out automated decision-making with legal or similarly significant effects for the user (Art. 22 GDPR). The AI only generates educational content: flashcards, quizzes, definitions and tests. The user may edit or delete the content at any time.

PhotoVoc is not intended for persons under 16 years of age. Persons under 16 may use the service only with verified parental consent (via a link sent by email). If consent is denied by the parent, the account and data are deleted within at most 24 hours (permanent erasure within 30 days). If the parent does not respond within 7 days, the account and data are deleted automatically (permanent erasure within 30 days). Each parental decision is recorded in an audit log (see point 8).

Legal basis: for minors (under 16), processing of their personal data for providing the service is lawful on the basis of the consent of the holder of parental responsibility under Art. 8 GDPR (in conjunction with Art. 6(1)(a) GDPR); for adult users the legal basis is performance of a contract (Art. 6(1)(b) GDPR). The age threshold for requiring parental consent is set at 16 years.

We may update this document to the extent corresponding to a change in processing (new sub-processor, new features, change of AI/LLM provider, legislative change). Material changes will be announced in the app or by email. The latest revision is shown in the header.

Questions regarding data processing, DPA/SCC, the list of sub-processors or exercising your rights should be directed to privacy@photovoc.online. We recommend resolving the matter with us first; this in no way limits your right to lodge a complaint with a supervisory authority (see point 10).