Privacy Policy

1. Scope of this Policy

JOYup is an educational application for learning English. It is designed for children and young learners and should be used under the supervision of a parent or legal guardian. The adult account holder is responsible for creating and managing the account, subscription and child profile.

We collect only the personal data reasonably necessary to provide, secure, maintain and improve the service. We do not sell personal data and we do not use children’s data for targeted advertising.

2. Personal Data We Process

2.1 Account and contact data

Depending on the features used, this may include:

• the adult account holder’s name and email address;
• an internal user identifier generated by our authentication system;
• account status, login information and support correspondence;
• information voluntarily provided when contacting customer support.

2.2 Child profile and learning data

To personalise the learning experience, we may process:

• the child’s first name, nickname or profile name;
• age or age range, course, level, unit and lesson information;
• answers, scores, progress, completed activities, streaks and achievements;
• learning history and words or skills identified for further practice.

Please do not enter a child’s surname, address, school name or other information that is not necessary to use the application.

2.3 Voice recordings, transcripts and AI-assisted feedback

When a user starts a speaking or pronunciation activity, JOYup may process a voice recording, a speech transcript, pronunciation measurements and AI-generated feedback. Recording starts only after the user actively chooses to record and grants microphone permission.

Raw audio is sent to Microsoft Azure Speech for speech recognition and pronunciation assessment. The resulting transcript, task context and relevant scoring information may be sent to OpenAI to generate educational feedback. Unless the feature is changed in the future, OpenAI does not need to receive the raw voice recording for this evaluation.

AI-generated scores and feedback are educational aids. They do not produce legal or similarly significant effects and may occasionally be inaccurate.

2.4 Subscription and purchase data

Apple App Store, Google Play and RevenueCat process purchases and subscriptions. We may receive the product purchased, subscription status, renewal or expiry information, transaction identifiers, store region and a pseudonymous app user identifier. We do not receive full payment-card details.

2.5 Technical, security and diagnostic data

We may process limited technical information needed to operate and protect the application, such as device type, operating-system version, app version, error messages, crash information, request logs, timestamps and security events.

2.6 Usage data

We may process information about how the service is used, such as screens or lessons opened, activities completed, response times and aggregated performance statistics. We use this information to provide learning features, understand service performance and improve JOYup, not for behavioural advertising.

3. Why We Process Personal Data

We process personal data to:

• create and manage accounts and child profiles;
• provide lessons, exercises, progress tracking and personalised learning;
• analyse speech and provide pronunciation or language feedback;
• process, verify and restore subscriptions and purchases;
• provide customer support and respond to requests;
• protect the service, prevent misuse and investigate technical issues;
• measure and improve the reliability and educational quality of JOYup;
• comply with legal, accounting and tax obligations.

4. Legal Bases for Processing

For users in the European Economic Area, we rely on the following legal bases:

• Performance of a contract — to provide the account, subscription and learning features requested by the adult account holder.
• Legitimate interests — to secure the service, prevent abuse, diagnose errors, provide support and improve JOYup, after considering the rights and interests of users, particularly children.
• Legal obligations — where we must retain or disclose information under applicable accounting, tax or other laws.
• Consent — where consent is required for an optional feature or permission. Consent may be withdrawn at any time without affecting earlier lawful processing.

5. Children’s Privacy and Parental Responsibility

JOYup is designed for children and young learners, but the account and subscription should be created and managed by a parent or legal guardian. A child should not independently provide contact details, purchase information or consent to optional processing where parental authorisation is required.

In Poland, where processing is based on consent in connection with an online service offered directly to a child under 16, consent or authorisation should be provided by the person holding parental responsibility. Requirements may differ in other countries.

We seek to minimise children’s data, do not sell it and do not use it for targeted advertising. A parent or guardian may contact us to access, correct or delete a child’s data.

6. Service Providers and Data Sharing

We disclose personal data only when necessary to provide the service, comply with law or protect users and JOYup. Our service providers may include:

• Supabase — authentication, database, storage and backend services;
• Microsoft Azure Speech — speech recognition and pronunciation assessment;
• OpenAI — generation of educational language feedback from transcripts and task context;
• RevenueCat — subscription status and purchase management;
• Apple — App Store distribution and in-app purchases;
• Google — Google Play distribution and in-app purchases;
• technical service providers used for hosting, security, diagnostics or customer support, where enabled.

These providers process data under their own legal obligations and, where they act on our behalf, under contractual data-protection requirements. We do not disclose personal data to advertising networks for targeted advertising.

We may also disclose information where required by law, a court or competent authority, or where reasonably necessary to prevent fraud, misuse or threats to safety and security.

7. International Data Transfers

Some service providers may process data outside Poland or the European Economic Area. Where required, we use appropriate transfer safeguards, such as an adequacy decision, the European Commission’s Standard Contractual Clauses or another lawful transfer mechanism.

8. Data Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, including:

• account, profile and learning data for the duration of the account and until deletion or anonymisation is completed;
• voice recordings only for the period necessary to process the requested activity, maintain security and resolve technical issues, after which they are deleted or anonymised unless longer retention is required by law;
• transcripts, scores and feedback as part of the learning history until the account is deleted or the data is anonymised;
• purchase and accounting records for the period required by applicable law;
• security, diagnostic and support records for a limited period proportionate to their purpose.

Residual copies may remain temporarily in protected backups until the applicable backup cycle is completed.

9. Account and Data Deletion

The adult account holder may request deletion of the JOYup account and associated personal data through the account-deletion option in the application, where available, or by emailing kontakt@joyup.pl from the address connected to the account.

We may ask for reasonable verification before acting on the request. We delete or anonymise data unless retention is required by law, necessary to resolve a dispute or needed to protect the service from fraud or abuse.

10. Your Data-Protection Rights

Subject to applicable law, you may have the right to:

• access personal data and obtain information about its processing;
• correct inaccurate or incomplete data;
• request deletion of personal data;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• receive eligible data in a portable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a competent data-protection authority.

In Poland, the competent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

11. Security

We use appropriate technical and organisational measures designed to protect personal data, including encrypted transmission, authentication, access controls, restricted administrative access, monitoring and software updates. No method of transmission or storage is completely secure, but we work to reduce the risk of unauthorised access, loss, alteration or misuse.

12. Changes to this Privacy Policy

We may update this Privacy Policy when the application, our service providers or legal requirements change. We will update the effective date above and, where a change is material, provide an appropriate notice in the application or by another suitable method.

13. Contact