FizzUp Privacy Policy

1. Who we are

The controller for the processing described in this Policy is DB 77 CUW Sp. z o.o., ul. Żółkiewskiego 31, 87-100 Toruń, Poland, NIP 8792706635, REGON 381680838, KRS 0000755526 (“FizzUp”, “we”, “us”).

Privacy contact: privacy@fizzup.ai.

General support and complaints: support@fizzup.ai.

If a Data Protection Officer is appointed, the contact details will be published in the Legal Center.

2. Scope

This Policy covers the FizzUp mobile app, website, individual accounts, organization-sponsored accounts, Family plans, AI features, user communications, payments and support.

FizzUp is intended for adults (18+). Section 14 explains the rules for people who have stated an age under 18.

3. Special B2B rule: the organization pays for access but does not receive private coaching data

In B2B, an organization may purchase and assign a FizzUp seat to a user. Funding the seat does not give the organization access to the user's Private Coaching Layer.

3.1 Organization administration data

For data needed to create an organization workspace, invite users, assign seats, bill the organization or process organization materials, the roles may be split as follows:

• the organization acts as controller for data it provides to FizzUp for license administration or other documented instructions;
• FizzUp acts as processor for that limited scope under the DPA;
• once a user activates their own account, FizzUp may simultaneously process certain account data as an independent controller where necessary to provide FizzUp directly to that user.

An organization admin sees, by name, only the data needed to administer licenses: name or account label, work email, role and department in the organization, invitation status (with invitation and activation dates), membership status and whether the user has completed onboarding. The admin also sees the title and date of a certificate if the organization issued one. The admin does not see, by name, the number or duration of sessions, the last-active date or minutes used.

The data visible to the Organization Admin are described in this Policy and in the Enterprise Terms. The Customer is responsible for establishing an appropriate legal basis and providing required transparency to its employees or contractors. License-utilization data must not be used as the sole basis for a decision concerning employment, pay, promotion, performance evaluation or termination.

3.2 Private Coaching Layer

For the Private Coaching Layer, FizzUp acts as an independent controller. This includes in particular:

• conversations and transcripts;
• comparison-task recordings, saved optionally with the user's consent (up to 7 days);
• language errors, exercise results, educational scoring and recommendations;
• goals, learning plans and coaching memory;
• detailed session history and progress data;
• individualized AI-generated educational inferences.

The organization, sponsor, manager or license admin does not receive these data and cannot require them to be disclosed as organization data. By name, they see only the data listed in section 3.1: identifying information, invitation, activation and onboarding completion. They do not see the number, timing or content of sessions, the last-active date, CEFR level, errors, results, saved phrases, recommendations or AI-generated narratives.

Organization reporting contains aggregated statistics only. Group results and activity are shown only when the group contains at least 10 active participants. Departments with fewer than 3 people are merged into “other”, and the department breakdown is hidden if subtraction would reveal a group smaller than 10. Reports cover completed weeks or months only.

4. Family

In a Family plan every member has their own independent account. Paying for or managing the plan does not by itself give access to other members' private coaching data.

Without a member's consent, the organiser sees: name or account label, email address, invitation, activation and onboarding status, billing information and the plan settings the organiser assigns to members (for example daily limits, available coaches, quiet hours).

The organiser sees a member's progress (for example estimated level, number of sessions, saved phrases, last activity, activity history) only if the member allows it in the app. The member can withdraw this at any time, with immediate effect. Even with consent, the organiser does not see language errors, conversation content or AI-generated session summaries. A certificate issued by the organiser may show the level and session count at the time it was issued.

If a member has stated an age under 18 in their profile, a parent or guardian decides whether their progress is shared: only the plan owner can see it, and only after guardian consent confirmed through a link sent to the guardian's email address (section 14).

5. Data we process, why and for how long

Retention settings in the app. In Profile › Privacy and data the user decides how long we keep their data:

• comparison-task recordings: “Delete after review” by default (at the latest after 7 days); also “Never save” or “Delete after 7 days” — a longer period cannot be chosen;
• transcripts: 90 days by default; also “Never save”, “Delete after review” (at the latest after 90 days), 30 days, 1 year, or keep until the user deletes them;
• coach memory and learning activity: kept until the user deletes them by default; also “Never save”, 30 days, 90 days or 1 year.

Each of these groups also has a “Delete now” button. “Never save” blocks storing new data from the moment it is chosen and deletes data already stored at the next automatic run. The run for transcripts, coach memory and activity happens once a day; for recordings, every hour.

After data are removed from active systems, copies may remain for a limited period in secured backups according to infrastructure-provider schedules and disaster-recovery procedures. Backups are not used as active user profiles. If disaster recovery restores deleted data, the deletion request is re-applied to the extent technically possible and legally required.

6. Loss of a B2B seat and continued relationship with FizzUp

Removing a seat ends organization-funded access and disconnects the account from the organization. It does not automatically transfer or delete the user's private history.

After a seat is removed, FizzUp may keep the private account and coaching data independently of the former organization so the user can:

• receive a new seat in the same or another organization;
• move to B2C or Family;
• export or delete their data.

The data remain subject to the user's right to deletion and to the periods in section 5 (for example recordings up to 7 days, transcripts 90 days by default). We currently do not automatically delete whole inactive accounts, or accounts after seat loss or subscription end: the account and remaining data stay until the user deletes them. If we introduce automatic deletion of inactive accounts, we will update this Policy and notify users before deletion. After a seat is removed, the former organization has no access to the private account or coaching data.

7. Voice, transcripts and external AI providers

FizzUp may use different AI model, speech and infrastructure providers. Users use FizzUp features; the underlying provider may change for quality, availability, safety or cost reasons.

Before transferring data, the feature identifies the AI provider selected for that operation, the data categories and processing purpose, and links to the current provider registry. For a live conversation, the notice covers audio and transcript. Acknowledging the notice is separate from accepting the Terms; it is not described as consent where processing is based on performing the user-requested service. Without the required acknowledgement, the feature does not transfer data. If a provider change, including a fallback, requires transferring data to another recipient, the notice and required acknowledgement are updated before that transfer. If the recipient cannot be resolved or is not admitted, the operation does not start.

Live conversation audio passes through the FizzUp server to the provider and is not stored by FizzUp. We store the transcript text under section 5. The only voice recordings we keep are comparison-task recordings — only after the user turns saving on, and for up to 7 days.

Processing necessary to provide the requested feature is generally based on Art. 6(1)(b) GDPR. Where a specific optional feature relies on consent, withdrawal does not affect the lawfulness of prior processing.

7.1 Optional transcription, generated speech and pronunciation feedback

For these three optional features, FizzUp uses Google through the Gemini Developer API. Each purpose has a separate optional consent on the current account, distinct from live voice or chat acknowledgement. Transcription sends the recording, its format, expected language and transcription instructions and returns text. Generated speech sends text and voice settings and returns audio; that request does not include a recording of your voice. Pronunciation feedback for exercises sends the recording, reference text and assessment instructions and returns holistic guidance, not individual phoneme scores or a diagnosis. The exact purpose notice is shown before consent. Choosing Cancel does not send data for that purpose. A matching server-confirmed consent for the current account and session is required before the operation can proceed. Withdrawal prevents subsequent admission for that purpose; it does not imply deletion of records held by Google or recall of data already transferred.

These operations send inline requests to generateContent. This selected implementation does not upload Files API objects or request explicit cachedContent, Interactions storage, grounding or a Live session for these three purposes. This does not establish zero provider retention: Google's applicable paid-service, security, abuse-monitoring and caching terms remain relevant. Paid-service terms distinguish product-improvement use from security and legal processing; we do not promise absence of authorized human review or immediate deletion of all provider records. See Subprocessors and Providers and Google's Gemini API terms and usage policies.

FizzUp records usage and cost metadata (account/session, feature, model, token or voice usage and cost) and purpose-consent evidence (account/session, purpose, provider, notice version/hash, language and acceptance/withdrawal times). These records are distinct from the audio and text sent for the feature. Technical timeouts are not deletion schedules. Temporary recording cleanup is tied to the owned recording operation; it is not a guarantee about every device cache or recovery after a crash. Saved transcripts, exercise progress and optional comparison recordings remain subject to the applicable settings and periods in section 5. Withdrawal of a purpose consent does not itself delete those separately saved records. Account deletion covers the account records handled by the deletion process; provider records, infrastructure logs and secured backups have their separate applicable lifecycle. No fixed period for those separate stores is inferred from an API timeout or temporary buffer lifetime.

8. No model training on private content

FizzUp does not use private conversations, transcripts, recordings or coaching data to train general AI models.

FizzUp requires external services, through available contractual terms and settings, not to use transferred data to train their general/public models where this is supported by the contracted service.

FizzUp may use anonymous or effectively aggregated data to improve teaching methodology, exercise design, content sequencing, product ergonomics and feature effectiveness, provided those data do not allow a specific person or private conversation to be reconstructed.

9. Recipients and providers

We use hosting, payment, sign-in, notification, email, AI and speech providers to the extent needed for the selected feature. “Subprocessors and Providers” lists integrations and conditions of use. The AI recipient is identified before transfer under section 7; listing a provider does not mean that every provider receives every user’s data.

We do not sell personal data. We do not use private conversations for behavioral advertising.

10. Transfers outside the EEA

Where a provider processes data outside the EEA, we use an appropriate lawful transfer mechanism, including an adequacy decision, the EU-US Data Privacy Framework for an eligible recipient, or the European Commission's Standard Contractual Clauses together with a transfer assessment and supplementary measures where needed.

11. Educational profiling and automated decisions

FizzUp may build an educational profile, for example recurring errors, learning pace, preferences and suggested next steps. It is used to personalize learning.

FizzUp does not use this profile to make solely automated decisions that produce legal effects or similarly significantly affect the user. A FizzUp language score is not an official language certificate or an employment decision.

12. Your rights

Subject to the GDPR, users may request access, a copy, rectification, deletion, restriction, portability and may object. Consent can be withdrawn at any time.

Account deletion and data export are available in the app. The in-app export does not currently include the text chat with the coach — we provide a copy on request. A deletion request or another data-rights request may also be sent to privacy@fizzup.ai; we may request identity verification before acting on it.

We respond without undue delay, generally within one month. Users may lodge a complaint with the Polish Data Protection Authority (Prezes UODO) or another competent supervisory authority.

13. Security

We use risk-appropriate measures including encrypted transport, access controls, tenant separation, least privilege, security logging, backups, provider review and incident-response procedures.

No information system can guarantee absolute security. Incidents are assessed and notified as required by applicable law.

14. Age

FizzUp is intended for adults (18+) and is not directed at children.

The app does, however, include a parent/guardian consent mechanism. If a user has stated an age under 18 in their profile, the following do not work without guardian consent: purchases, saving comparison-task recordings and sharing progress in a Family plan. The guardian confirms consent by clicking a link sent to their email address (valid for 14 days) and can also withdraw it — withdrawing consent to recordings deletes the saved recordings. Verification consists only of confirming the email address given as the guardian's.

If a guardian contact for notifications has been assigned to a learner's account, the guardian may receive an email about a missed scheduled lesson.

If we reliably determine that a person under 18 uses FizzUp without guardian consent, we may suspend the account and take steps to delete the data in accordance with law.

15. Changes

We may update this Policy as law, product features or providers change. Material changes affecting processing will be communicated in the app or another appropriate channel. The Privacy Policy is a transparency notice; we do not require artificial “consent to the privacy policy” where consent is not the correct legal basis.

The Polish version of this Policy is the reference version in the event of an unintended drafting discrepancy with the English translation. This does not limit rights granted by mandatory law.