Privacy Policy

2. Overview

Moduvation is a learning platform that connects teachers, students, and parents and provides vocabulary training (Leitner spaced-repetition system). This policy describes which personal data is collected, how it is used, and how long it is kept.

3. Data We Process

3.1 Account data

On registration: name, email address (optional for students, who instead receive an internal student ID), a hashed password (the plaintext password is never stored), the chosen role (teacher, student, parent), and a referral code used to link accounts.

3.2 Learning progress

During vocabulary training: which words were assigned, training results (correct/incorrect), Leitner progress, and the configured language level. This data is visible to the linked teacher(s) of a student and to the linked parent(s) of a child.

3.3 Google Drive connection (teachers only, optional)

Teachers may voluntarily connect their own Google account so Moduvation can access a folder they choose in their Google Drive (reading and adding files). We store: the connected Google email address, an encrypted access and refresh token, and the ID and name of the chosen folder. The access token is stored exclusively in encrypted form in our database (AES-256-GCM) and is never stored or displayed in plain text. This connection can be revoked at any time from the account settings; once disconnected, Google access is revoked immediately and all stored tokens are deleted from our database.

4. Purpose and Legal Basis

Account data and learning progress are processed to fulfil the terms of use (GDPR Art. 6(1)(b)). The Google Drive connection is an explicitly optional add-on feature and relies on the individual teacher's consent (GDPR Art. 6(1)(a)), which can be withdrawn at any time with effect for the future.

5. Minors

Moduvation is also used by students, some of whom may be minors. Registering a student account requires that an authorized person (a parent/guardian, or the school/teacher within the context of instruction) has agreed to the use of the service. For children under 16, GDPR Art. 8 generally requires parental consent. Parents/guardians may at any time request access to, correction of, or deletion of their child's data via the contact address above.

6. Sharing with Third Parties

• Google LLC — only when a teacher actively connects their Google Drive account; Moduvation then accesses that teacher's own, self-chosen Drive folder on their behalf.
• Hosting provider — our database and application run on our hosting provider's servers (all-inkl.com).
• Email delivery — for registration confirmations and password resets.

We do not share data for advertising purposes.

7. Use of Google API Data

Moduvation's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Content retrieved via the Google Drive API is used exclusively to provide the feature you requested (access to the folder you chose) — never for advertising, never to train AI models, and never shared with third parties outside that feature.

8. Retention

Account data is kept for as long as the account exists. After an account is deleted, personal data is removed within 30 days unless a legal retention obligation applies. Google access tokens are deleted immediately when the connection is disconnected.

9. Cookies and Sessions

We use only technically necessary session cookies for login management. We do not use third-party tracking, analytics, or advertising cookies.

10. Your Rights

You have the right to:

• Access the data we hold about you (GDPR Art. 15)
• Correct inaccurate data (GDPR Art. 16)
• Request deletion of your data (GDPR Art. 17)
• Restrict processing (GDPR Art. 18)
• Data portability (GDPR Art. 20)
• Object to processing (GDPR Art. 21)
• Lodge a complaint with a data protection supervisory authority

To exercise these rights, simply contact us at the address above.

11. Changes to This Policy

We update this policy whenever our data processing changes. The current version is always available at this address.