Privacy Policy
Last updated:
This policy explains what personal data VIVA Tuition collects when you buy and study a course, why we use it, who we share it with and how long we keep it. It is written to reflect what the platform actually does, and we update it when that changes.
1. Who is responsible for your data
The data controller is VIVA Financial Tuition Limited, trading as VIVA Tuition, a company registered in Ireland with company number 596062, registered office Ground Floor, 71 Lower Baggot Street, Dublin, D02 P593, Ireland.
For anything to do with your personal data, email info@vivatuition.com.
We process personal data under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988 to 2018. Our lead supervisory authority is the Data Protection Commission in Ireland.
2. What we collect
Almost everything we hold about you comes from your own use of the platform.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Your name, email address and password (stored only as a one-way hash), or the fact that you sign in with Google; your sign-in sessions; your analytics consent choice. | You, at checkout and when you set up your account; Google, if you sign in with it. |
| Purchases | What you bought, when, the amount, any discount code or credit applied, refunds, and the identifiers our payment provider gives us for the transaction. We never see or store your card number. | You at checkout; Stripe. |
| Learning | Lessons you have watched and completed, your answers in mock exams, and your scores. | Your activity on the platform. |
| Written work | The answers you write in case study mock exams, the marks and feedback they receive, and, if your mock is one of the sample we check, our review of the marking. | You; our marking pipeline; our tutors. |
| Messages | Questions you ask your tutor and their replies; conversations with the AI Tutor; messages to and from our support inbox; the contact form, with the approximate country it was sent from (worked out from your internet connection; we do not keep the IP address). | You; our tutors and support team. |
| ACCA waitlist | If you join our ACCA waitlist without buying a course: your email address, your name if you give it, when you joined and which page you joined from. | You. |
| Marketing contacts | If you save an exam plan or download a free guide on our website, or signed up for our emails before (including through our earlier email provider): your email address and name; your country if you told us; the qualification, exams and sittings you told us about; which of our lists you joined or left, with the wording you agreed to and when; when you last opened or clicked one of our emails; and, if you have bought from us, which courses. We use this to group contacts by qualification, interest and how recently they were in touch, so that we only send emails that are relevant. No decision with a legal or similar effect on you is made this way. | You; our earlier email provider; our own records of emails and purchases. |
| Which emails we sent you, whether they were delivered, bounced or unsubscribed from. | Our email provider. | |
| Technical | IP address, browser and device type, pages visited and errors encountered. Usage analytics are collected only with your consent (see cookies below). | Your browser and device. |
We do not ask for, and you should not send us, special category data such as health information. If you tell us about a disability or a health condition so that we can support your study, we hold that only for that purpose and only with your consent.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the course you bought: your account, lessons, mock exams, marking, the AI Tutor, tutor question-and-answer and support. | Performance of our contract with you. |
| Taking payment, issuing receipts, applying credit and processing refunds. | Performance of our contract with you; legal obligation for the financial records we must keep. |
| Sending you service emails: receipts, password resets, marking results, and notices about your account. | Performance of our contract with you. |
| Sending you study nudges and product news by email. You can unsubscribe from these at any time using the link in each email; service emails are unaffected. | Our legitimate interest in helping you finish the course you bought and telling you about our services, balanced against your right to opt out. |
| Sending emails to people who have joined our ACCA waitlist but not bought: confirming that you are on the list, and telling you when ACCA courses open. | Consent, which you can withdraw at any time using the unsubscribe link in any of our emails, or by emailing info@vivatuition.com. We will then take you off the list. |
| Emailing you the exam plan you saved on our website. | Taking the step you asked us to take, so that we can send you what you requested. |
| Recording who downloads a free guide (such as our ACCA pass guide), which exam they told us they are sitting next, the approximate country they downloaded it from (worked out from their internet connection; we do not keep the IP address or city) and the link that brought them to our website, so that we know who the guide reaches and where. You get the guide whether or not you agree to our emails; we only email you offers and study updates if you tick the box. | Our legitimate interest in understanding who uses our free resources, balanced against your right to object, which you can do by emailing info@vivatuition.com. |
| Sending offers and study updates, including our Black Friday offer, to marketing contacts who asked for them and do not have an account with us. | Consent, which you can withdraw at any time using the unsubscribe link in any of our emails, or by emailing info@vivatuition.com. One unsubscribe takes you off every list. |
| Checking and improving the quality of our marking, including reviewing a sample of marked mocks. | Our legitimate interest in making sure our marking is accurate. |
| Keeping the platform secure: detecting fraud, abuse and account sharing, rate limiting, and recording security-relevant events. | Our legitimate interest in running a secure service. |
| Fixing errors: our error-monitoring service records the technical details of a failure, which can include your user ID and the page you were on. | Our legitimate interest in keeping the platform working. |
| Understanding how the platform is used, in order to improve it. Where this uses persistent identifiers in your browser it happens only after you accept analytics cookies. Aggregate product analytics on the server side use your account identifier, not cookies. | Consent for browser analytics; our legitimate interest in improving the product for server-side product analytics. |
| Measuring and personalising our adverts on Meta (Facebook and Instagram): which visits, demo sign-ups and purchases came from our adverts, and showing our adverts to people who have visited. Happens only after you accept cookies. | Consent, given on the cookie banner. You can withdraw it at any time in Cookie settings. |
| Improving the study engine, using de-identified learning data (which questions were answered, how, and when), not tied to a named account. | Our legitimate interest in making the course more effective. |
| Establishing, exercising or defending legal claims, and complying with law. | Legal obligation; our legitimate interest in protecting our rights. |
Where we rely on legitimate interests we have considered the effect on you and concluded that it is not outweighed by your rights. You can ask us for details of that assessment, and you can object (see your rights below).
4. AI marking, the AI Tutor and automated decisions
Written exam marking. When you submit a written case study mock, your answer and the exam materials are sent to Anthropic's Claude model, which produces marks and feedback against our marking grid. The marks and feedback are released to you automatically, without a tutor reviewing them first. We review a sample of marked mocks afterwards to check how the marking is performing. Marks and feedback are study feedback only and have no legal or similarly significant effect on you. Anthropic does not use your answer to train its models, and normally deletes it within 30 days.
AI Tutor. The assistant inside a lesson is provided by Bold Video's AI service. What you type is sent to that service, together with the lesson's transcript, so that it can answer. We store the conversation so that you can pick it up again, and you can clear it from within the lesson.
5. Who we share it with
We do not sell your personal data. If you accept cookies, we share limited information with Meta to measure and personalise our adverts (see below). We use the following service providers, each of which processes data only on our instructions and under a contract that requires them to protect it:
| Provider | What they do for us | Data involved |
|---|---|---|
| Supabase | Database and file storage for the platform. | Everything in section 2. |
| Vercel | Hosts and serves the platform. | Technical data; requests pass through their infrastructure. |
| Stripe | Takes payment and processes refunds. | Name, email, card details (held by Stripe, not us), amount. |
| Resend | Sends our emails. | Email address, name, the content of each email, delivery status. |
| Anthropic | Marks written mock exams, and provides the AI tools we use to build and support the platform. | Your written answers and the exam materials; other platform data where a support or maintenance task needs it. |
| Bold Video | Hosts lesson videos and provides the AI Tutor. | Viewing activity; what you type to the assistant. |
| Mux | Streams video. | Viewing activity and technical data. |
| PostHog (EU) | Product analytics. | Usage events; a persistent browser identifier only after you accept analytics cookies. |
| Sentry | Error monitoring. | Technical details of errors, which can include your user ID. |
| Sign in with Google, if you choose it. Hosts our email inbox and the documents and spreadsheets we use to run the business. | Your Google account email and name, if you sign in with Google; messages you send us; account and purchase details where we need them to support you. | |
| YAMM | Sends personalised emails from our inbox. | Your name, email address and the content of the email. |
Meta (Facebook and Instagram). Only if you accept cookies, we use Meta's tracking code on our
public website and demo pages, and send the same events from our servers through Meta's Conversions API. This
tells Meta when someone who saw our adverts visits a page, starts a demo or buys, so that we can measure our
adverts and show them to people who have visited. Meta receives the page, the event, its own cookie identifiers
(_fbp, _fbc), your browser type, your IP address when you start a demo, and, for demo
sign-ups and purchases, your email address and account ID in scrambled (hashed) form and the amount paid. We
never send your name or what you study. Meta uses this information under its own privacy policy. If you decline,
or withdraw consent later, nothing is sent to Meta.
Our tutors see the learning data, written work and questions of the students on the courses they teach, so that they can teach them. We may also share data where the law requires it, to protect our rights, or with a buyer if the business is sold, in which case the buyer takes on the obligations in this policy.
6. International transfers
We are based in Ireland. Some of the providers above are based in, or process data in, the United States, the United Kingdom and elsewhere in the European Economic Area. Transfers to the United Kingdom are covered by the European Commission's adequacy decision for the UK. Where personal data goes to the United States or elsewhere outside the EEA, we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard.
7. How long we keep it
| Data | How long |
|---|---|
| Your account and learning data | For as long as you have an account. Your account stays open when your access to a course ends, so you can see your history and study again if you buy again. That is until you ask us to delete your account. |
| Purchase and refund records | Six years after the transaction, as required by Irish company and tax law. When you delete your account these records are kept in that form only: they are separated from your name. |
| Written work and messages | For as long as you have an account; deleted with it. |
| Support conversations | For as long as you have an account; deleted with it, except that replies our staff wrote inside a conversation are kept without anything that identifies you. |
| ACCA waitlist (if you have not bought) | Until you ask us to take you off the list or to delete your details, or two years after you joined, whichever comes first. |
| Marketing contacts | Until you ask us to delete your details, or 24 months after you were last in touch with us (for example saved a plan, joined or left a list, opened or clicked one of our emails, or bought), whichever comes first. If you unsubscribe, or our emails to you bounce or are reported as spam, we keep only your email address and that fact, so that we never email you again. If you open an account, your contact record is linked to it and your saved plan moves to your account. |
| Demo requests | When you ask for a demo we keep your name, email address, the subject you chose, whether you are happy to hear from us (with the wording you agreed to) and any questions you send to our team from the demo, so we can reply and so each person gets one demo. We keep these until you ask us to delete them, or 24 months after your demo, whichever comes first. The demo account itself, and everything you do in it, is deleted within 15 minutes of the demo ending. |
| Error logs and analytics | For as long as we need them for the purpose, subject to the retention limits our providers apply. Learning data used to improve the study engine is kept in de-identified form. |
When you ask us to delete your account, we anonymise the account record, delete the learning data, written work, messages and files that belong to you, and keep only the financial records above.
8. Cookies and similar technologies
By default the platform runs without analytics or advertising cookies: until you make a choice on the cookie banner, our analytics run in a cookieless mode that stores nothing on your device and cannot recognise you across visits, and nothing is sent to Meta. Only the cookies needed to run the service are set without asking.
| Name | Type | Purpose | Lasts |
|---|---|---|---|
| Sign-in session cookie | Strictly necessary | Keeps you signed in. Set when you sign in. | 30 days, refreshed while you use the platform. |
| Session hint | Strictly necessary | Lets pages that are cached for everyone show the right signed-in state without exposing your details. | Session. |
viva_demo_device | Strictly necessary | Records that this browser has already had its demo, so each person gets one. | 1 year. |
viva_analytics_consent (local storage) | Strictly necessary | Remembers whether you accepted or declined analytics and advertising cookies, and which version of the cookie banner you answered. | Until you clear your browser storage. |
viva-qual-preference (local storage) | Functional | Remembers whether you were looking at CIMA or ACCA pricing. | Until you clear your browser storage. |
PostHog cookies (ph_...) | Analytics, consent only | Recognise your browser across visits so that we can understand how the platform is used. Set only after you accept analytics cookies. If you decline, or withdraw consent later, these cookies are removed and we only count page views without cookies and without linking them to you. | Up to one year. |
Meta cookies (_fbp, _fbc) | Advertising, consent only | Set by Meta's tracking code on our public website and demo pages, only after you accept cookies. They let Meta tell us which adverts lead to visits, demo sign-ups and purchases, and show our adverts to people who have visited. Never set inside the learning platform. If you withdraw consent, we remove them and stop sending anything to Meta. | 90 days. |
You can change your mind at any time using the Cookie settings link at the bottom of every page of our website, or . Blocking strictly necessary cookies will stop you signing in.
9. Your rights
Under data protection law you have the right to:
- access the personal data we hold about you, and receive a copy;
- correct data that is inaccurate or incomplete - your name and email address can be changed from your account;
- delete your account and personal data, subject to the financial records we must keep;
- restrict how we use your data while a question about it is resolved;
- receive your data in a portable form where we process it by automated means on the basis of contract or consent;
- object to processing based on our legitimate interests, and to any direct marketing at any time;
- withdraw consent where consent is our basis, for example for analytics cookies, without affecting anything done before you withdrew it.
To exercise any of these rights, email info@vivatuition.com from the address on your account. We will respond within one month, and we do not charge for a request unless it is manifestly unfounded or excessive. We may ask you to confirm your identity first.
If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Data Protection Commission at dataprotection.ie, or to the data protection authority in the country where you live or work.
10. How we protect it
Data is encrypted in transit and at rest with our hosting providers. Passwords are stored only as one-way hashes. Access to the database is restricted to our service and to the staff who need it, under separate credentials for our production and test environments. We log security-relevant events and review them. No system is perfectly secure; if we ever discover a breach that puts your rights at risk, we will tell you and the Data Protection Commission as the law requires.
11. Children
The platform is for adults studying for professional accountancy qualifications. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.
12. Changes to this policy
We update this policy when what we do with your data changes. The date at the top shows when it was last changed. If a change is significant, for example a new purpose or a new category of provider, we will email account holders before it takes effect.
Questions about this document: info@vivatuition.com.