Privacy Policy

1. Data Controller

VWUPass is operated by Emir Takhaviev, based in Vienna, Austria. For data protection inquiries, email us at support@vwupass.com or message us on Instagram: @vwupass

2. Data We Collect

We collect the following data:

Account data (registered users only)

• Name and email address (from your Google account)
• Google account identifier

Sign-up survey (registered users only): optional answers, and when it was shown, answered or skipped

• Your goals (for example, which exam you are preparing for)
• How you heard about us, and, if you chose "other", the free text you typed
• When and how often we showed you the survey, so that we can see how many people it reached and whether they answered it (our legitimate interest, Art. 6(1)(f) GDPR)
• Whether and when you skipped the survey, and how many times, so that after a first skip we ask you again only once, no earlier than 30 days later, and after a second skip not at all, and so that we can see how many people skip it (our legitimate interest, Art. 6(1)(f) GDPR)

We use these answers for two purposes. To measure which channels bring students to VWUPass, we rely on our legitimate interest in understanding how people find us (Art. 6(1)(f) GDPR); you can object to this at any time (see section 6). If you have agreed to receive marketing emails, we also use your answers to choose which of those emails are relevant to you; this use rests on your consent (Art. 6(1)(a) GDPR) and stops as soon as you withdraw it. Every question can be left empty.

Usage data

• Problem-solving progress and statistics
• Exam practice history
• Feature usage patterns
• Technical problems you run into (errors, failed evaluations)

Technical data

• Browser type and version
• Device information
• IP address (server logs)

3. Legal Basis for Processing

We process your personal data based on the following legal grounds (GDPR Art. 6):

• Contract performance — to provide the service you signed up for, including progress tracking and access to the content you purchased
• Legitimate interest — to improve our service, prevent abuse, and ensure security
• Consent — for analytics and advertising cookies, which load only after you accept them (see section 7), and for marketing communications (you can withdraw consent at any time)

Marketing emails: we send them only if you tick the box in the sign-up survey or switch them on under "Emails" in your account settings. Ticking the box is a separate action; skipping the survey never counts as consent. We keep a record of each consent and withdrawal: the time, the version of the text you saw and the language it was shown in. You can withdraw your consent at any time in your account settings, as easily as you gave it. You can also unsubscribe with the link in every email: one click, without signing in. If you have bought a course from us, we may write to you about similar courses without separate consent, but every such email contains an unsubscribe link, and after you use it we send no more marketing emails (§ 174 para. 4 TKG). Unsubscribing also deletes your course waitlist entries.

Course waitlist: if you sign in with your Google account on the page of a course that has not opened yet and confirm with the button that names your email, we store that email, the course, the language of the page, the page address, the version of the consent text and the time, and link the entry to your account. We use them only to tell you once that the course has opened, and delete the entry after that email. This rests on your consent (Art. 6(1)(a) GDPR). You can withdraw it earlier at any time by writing to support@vwupass.com; we then delete your entry.

4. Data Storage

Your data is stored on Amazon Web Services (AWS) servers in the EU (eu-central-1, Frankfurt). We implement appropriate technical and organizational measures to protect your data.

5. Third-Party Services

We use the following third-party services:

• Google OAuth (via AWS Cognito) — for authentication
• AWS (Amazon Web Services) — for hosting, database, and infrastructure
• Payment processor — for processing payments (we do not store payment card details)
• Google Analytics 4 (Google Ireland Limited and Google LLC) — for measuring website usage and purchases, including which Google Ads led to a purchase (see section 7)

6. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — withdraw consent at any time without affecting prior processing

To exercise any of these rights, email us at support@vwupass.com or message us on Instagram: @vwupass

7. Cookies

When you sign in, the Amazon Cognito sign-in page sets the cookies it needs, and we keep your sign-in tokens in your browser's local storage. These are strictly necessary for signing in and do not require consent.

We also store a random device ID in local storage. It is sent with usage events to our own servers, not to Google, and we use it for our own usage statistics, for example to count how many devices use one account.

Your choice about analytics cookies is kept in your browser's local storage together with the date you made it, so that we do not ask again on every visit. This too is strictly necessary.

Google Analytics 4 and Google Ads conversion measurement

Google Analytics and Google Ads are loaded only after you press "Accept" in the cookie notice. Until then, and if you press "Reject", no Google Analytics or Google Ads code is loaded, no such cookies are set and nothing is sent to Google.

On vwupass.com we use Google Analytics 4, provided by Google Ireland Limited and Google LLC. It sets analytics cookies, such as _ga and cookies starting with _ga_, to measure how the site is used: for example visits, page views, sign-ups, checkouts and purchases, and how you use the practice and theory pages. Our Google Analytics property is linked to our Google Ads account, so these measurements are also used to see which Google Ads led to a purchase (conversion measurement), and Google Ads may set its own cookies for this. Google may process this data, including your IP address, in the United States.

• What is collected — the pages you view and how long, the events listed above (such as sign-ups, checkouts and purchases with their amount), the site that referred you and campaign parameters in the link, your browser, device, screen size and language, and an approximate location. Google receives your IP address with each request; according to Google, Google Analytics 4 uses it to derive the approximate location and does not store it.
• Legal basis — your consent (Art. 6(1)(a) GDPR), and for storing and reading cookies on your device § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).
• Recipient — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, and the European Commission's adequacy decision of 10 July 2023 permits transfers to certified companies.
• Retention — Google Analytics keeps data linked to cookies and user identifiers for 2 months; after that only aggregated reports remain. The _ga cookies expire after 2 years and the Google Ads cookie _gcl_au after 90 days, unless you delete them earlier.
• Withdrawing consent — at any time, through "Cookie settings" at the bottom of every page or the button below. Withdrawal does not affect processing that happened before it. When you withdraw, we stop Google Analytics on the page and delete its cookies.

8. Data Retention

We retain your account data and progress for as long as your account is active. If you request account deletion, we will erase your personal data within 30 days, except where retention is required by law.

Usage events we record to find problems in the product (for example, a recording that could not start, or an evaluation that failed) are kept for 365 days, or 90 days if you are not signed in. Records of AI evaluations (outcome, duration, score) are kept for 365 days. Voice recordings and photos of handwritten essays are deleted once they have been read or evaluated, and in any case within 7 days.

The servers that deliver this website keep an access log: for each request your IP address, the page requested, your browser and the site that referred you. These logs are kept for 30 days and are used to see where visitors come from and to find errors.

9. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users of significant changes via email. The latest version is always available on this page.

10. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde).