Privacy Policy

1.1 Account Information. When you request access or register, we collect your name, email address, and password (stored securely as a hash). A request for access may also include your role and, for authors, your field and published titles. If you sign in through a supported third-party provider such as Google or Apple, we receive your name and email from that provider.

1.2 Learning and Usage Data. We collect information about how you use the Platform, including your membership plan, the Courses in your course slots, previews used, lessons and topics completed, quiz and test results, certificates, AI tutor and chat conversations, research and quiz sessions, and your use of plan allowances. We use it to provide and personalize your learning experience and to apply your plan's limits.

1.3 Uploaded Materials. When you upload documents to the Work workspace, we store the files and the text, page images, summaries, search indexes, and embeddings derived from them, together with your chats, research, quizzes, and exports about them. Files are identified by a fingerprint of their content so that an identical file is stored and processed only once. If another user uploads the same file, the processed results may be reused for their copy, but your copy, your conversations, and your account information are never made available to them.

1.4 Voice and Video Sessions. When you use a voice or video AI tutor or the Cavua Companion, audio from your microphone is streamed to our service providers to produce responses in real time, and we keep a transcript and the duration of each session. Our AI tutors do not analyze video of you; where a session lets you turn on your camera, doing so is optional. If you turn on the Companion's wake word, your browser's own speech recognition service, which may be operated by your browser's vendor, processes audio from your microphone while the feature is on.

1.5 Payment Information. Payments are processed by Stripe. We do not store your full card details. Stripe holds your card and the billing details you give at checkout, such as your name, email address, phone number, and billing address. We keep records of your membership, add-on, session pack, and other payments, including amounts, dates, and invoices, and display the brand and last four digits of your saved cards.

1.6 Referral and Earnings Data. We record referral relationships (who referred whom) and the referral commissions and, for authors, royalties earned on the Platform. Payee identity, banking, and tax details are collected by Tipalti through its own portal.

1.7 Author Information. If you are an author, we also collect your credentials and biography, the Author Content you upload, and the sources and notes in your research workspace. If you create an AI tutor of yourself, we collect video and audio recordings of you, including a recorded consent statement, which are used to create a digital replica of your appearance and a synthetic copy of your voice.

1.8 Communications and Device Data. If you contact us, we retain those communications to resolve your inquiry. If you enable browser notifications, we store a push subscription and basic browser information for each device. Our servers also process technical data such as IP addresses to keep the Platform secure and to limit abuse.

We use your information to: provide and operate the Platform and its features; manage your membership, course slots, and allowances; personalize your learning experience and AI tutor responses; process payments, and calculate and distribute author royalties and referral commissions via Tipalti; send transactional messages (account confirmation, receipts, renewal and payment notices, payout notifications) and, where you have enabled them, browser notifications; send marketing emails where permitted by law, which you can turn off at any time in your settings; respond to support requests; monitor for fraud, abuse, or violations of our terms; and improve the Platform through aggregate analytics.

We do not sell your personal data to third parties. We do not use the content of your Uploaded Materials, or authors' Author Content, to train artificial intelligence models. Subject to the Student Terms of Service, we may use other information you submit, such as questions and prompts, to improve the Platform, including to evaluate and improve its AI features.

3.1 Payment Processing. We share necessary payment data with Stripe to process membership and other payments.

3.2 Payout Processing. We share your name, payee reference, and earnings data with Tipalti to process payouts for authors and referral earners.

3.3 AI Services. We use the following providers, each processing data on our behalf, to deliver AI features: OpenAI (generating Courses from Author Content, AI tutor and chat responses, reading and describing uploaded documents and scanned pages, research, search embeddings, and content moderation); Tavus (video AI tutors and the Cavua Companion, including session audio, transcripts, and lesson context, and authors' AI tutor replicas); ElevenLabs (voice AI tutors, narration and audio summaries, and authors' AI tutor voices); and Pinecone (search indexes of Course content and uploaded documents, including short excerpts). We do not intentionally share your account details, such as your email address, with AI providers beyond what a feature requires.

3.4 Infrastructure. We use cloud providers, including Amazon Web Services, for hosting, file storage, content delivery, and email delivery. Browser notifications are delivered through your browser vendor's push service. These providers are bound by data processing terms.

3.5 Research Sources. When research features are used, search queries are sent to public scholarly and reference databases, such as OpenAlex, Crossref, Semantic Scholar, Europe PMC, DOAJ, Unpaywall, Wikipedia, and Stack Exchange. These services receive the query, not your account information.

3.6 Authors. Authors can see the name and email address of students enrolled in their Courses, together with information about their enrollment in those Courses.

3.7 Embedded Content. Some Courses include videos hosted by YouTube or Vimeo. When you play one, that provider may collect information under its own privacy policy.

3.8 Legal Requirements and Business Transfers. We may disclose your information if required to do so by law, regulation, or valid legal process, and may transfer it to a successor in connection with a merger, acquisition, or sale of all or part of our business.

We retain your account, learning, and usage data, including session transcripts, for as long as your account is active. Uploaded Materials are removed from your account when you delete them; the underlying file and its processed results are deleted after a short grace period once no account holds a copy. If you ask us to close your account, we will delete or anonymize your personal data within 90 days, except where retention is required by law (for example, financial transaction records, which may be retained for up to 7 years). An author's AI tutor replica, voice, and source recordings are deleted on request or when the Author Agreement ends, subject to any legal obligation to retain them.

Depending on your jurisdiction, you may have rights including: the right to access the personal data we hold about you; the right to correct inaccurate data; the right to request deletion of your data (subject to legal retention requirements); the right to object to or restrict certain processing; and the right to data portability.

To exercise any of these rights, including closing your account, contact us at support@cavua.ai. We will respond within 30 days.

We use a sign-in cookie (auth_token) to keep you logged in, and your browser's local storage to remember your session and display preferences such as theme and layout. We do not use analytics or advertising cookies, or tracking pixels. Third-party services that we embed may set their own cookies when you use them, including Stripe on payment pages, Tipalti in the payout portal, our video call provider during calls, and YouTube or Vimeo when you play an embedded video.

We implement industry-standard security measures including encrypted data transmission (TLS), hashed password storage, authentication token management, and access controls on our systems. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

The Platform is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact support@cavua.ai and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on the Platform. Continued use of the Platform after changes take effect constitutes your acceptance of the revised policy.