Privacy Policy
Last updated:
This policy explains what personal data VIVA Tuition collects when you buy and study a course, why we use it, who we share it with and how long we keep it. It is written to reflect what the platform actually does, and we update it when that changes.
1. Who is responsible for your data
The data controller is VIVA Financial Tuition Limited, trading as VIVA Tuition, a company registered in Ireland with company number 596062, registered office Ground Floor, 71 Lower Baggot Street, Dublin, D02 P593, Ireland.
For anything to do with your personal data, email info@vivatuition.com.
We process personal data under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988 to 2018. Our lead supervisory authority is the Data Protection Commission in Ireland.
2. What we collect
Almost everything we hold about you comes from your own use of the platform.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Your name, email address and password (stored only as a one-way hash), or the fact that you sign in with Google; your sign-in sessions; your analytics consent choice. | You, at checkout and when you set up your account; Google, if you sign in with it. |
| Purchases | What you bought, when, the amount, any discount code or credit applied, refunds, and the identifiers our payment provider gives us for the transaction. We never see or store your card number. | You at checkout; Stripe. |
| Learning | Lessons you have watched and completed, your answers in mock exams, and your scores. | Your activity on the platform. |
| Written work | The answers you write in case study mock exams, the marks and feedback they receive, and, if your mock is one of the sample we check, our review of the marking. | You; our marking pipeline; our tutors. |
| Messages | Questions you ask your tutor and their replies; conversations with the AI Tutor; messages to and from our support inbox; the contact form. | You; our tutors and support team. |
| ACCA waitlist | If you join our ACCA waitlist without buying a course: your email address, your name if you give it, when you joined and which page you joined from. | You. |
| Which emails we sent you, whether they were delivered, bounced or unsubscribed from. | Our email provider. | |
| Technical | IP address, browser and device type, pages visited and errors encountered. Usage analytics are collected only with your consent (see cookies below). | Your browser and device. |
We do not ask for, and you should not send us, special category data such as health information. If you tell us about a disability or a health condition so that we can support your study, we hold that only for that purpose and only with your consent.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the course you bought: your account, lessons, mock exams, marking, the AI Tutor, tutor question-and-answer and support. | Performance of our contract with you. |
| Taking payment, issuing receipts, applying credit and processing refunds. | Performance of our contract with you; legal obligation for the financial records we must keep. |
| Sending you service emails: receipts, password resets, marking results, and notices about your account. | Performance of our contract with you. |
| Sending you study nudges and product news by email. You can unsubscribe from these at any time using the link in each email; service emails are unaffected. | Our legitimate interest in helping you finish the course you bought and telling you about our services, balanced against your right to opt out. |
| Sending emails to people who have joined our ACCA waitlist but not bought: confirming that you are on the list, and telling you when ACCA courses open. | Consent, which you can withdraw at any time using the unsubscribe link in any of our emails, or by emailing info@vivatuition.com. We will then take you off the list. |
| Checking and improving the quality of our marking, including reviewing a sample of marked mocks. | Our legitimate interest in making sure our marking is accurate. |
| Keeping the platform secure: detecting fraud, abuse and account sharing, rate limiting, and recording security-relevant events. | Our legitimate interest in running a secure service. |
| Fixing errors: our error-monitoring service records the technical details of a failure, which can include your user ID and the page you were on. | Our legitimate interest in keeping the platform working. |
| Understanding how the platform is used, in order to improve it. Where this uses persistent identifiers in your browser it happens only after you accept analytics cookies. Aggregate product analytics on the server side use your account identifier, not cookies. | Consent for browser analytics; our legitimate interest in improving the product for server-side product analytics. |
| Improving the study engine, using de-identified learning data (which questions were answered, how, and when), not tied to a named account. | Our legitimate interest in making the course more effective. |
| Establishing, exercising or defending legal claims, and complying with law. | Legal obligation; our legitimate interest in protecting our rights. |
Where we rely on legitimate interests we have considered the effect on you and concluded that it is not outweighed by your rights. You can ask us for details of that assessment, and you can object (see your rights below).
4. AI marking, the AI Tutor and automated decisions
Written exam marking. When you submit a written case study mock, your answer and the exam materials are sent to Anthropic's Claude model, which produces marks and feedback against our marking grid. The marks and feedback are released to you automatically, without a tutor reviewing them first. We review a sample of marked mocks afterwards to check how the marking is performing. Marks and feedback are study feedback only and have no legal or similarly significant effect on you. Anthropic does not use your answer to train its models, and normally deletes it within 30 days.
AI Tutor. The assistant inside a lesson is provided by Bold Video's AI service. What you type is sent to that service, together with the lesson's transcript, so that it can answer. We store the conversation so that you can pick it up again, and you can clear it from within the lesson.
5. Who we share it with
We do not sell your personal data and we do not share it with advertisers. We use the following service providers, each of which processes data only on our instructions and under a contract that requires them to protect it:
| Provider | What they do for us | Data involved |
|---|---|---|
| Supabase | Database and file storage for the platform. | Everything in section 2. |
| Vercel | Hosts and serves the platform. | Technical data; requests pass through their infrastructure. |
| Stripe | Takes payment and processes refunds. | Name, email, card details (held by Stripe, not us), amount. |
| Resend | Sends our emails. | Email address, name, the content of each email, delivery status. |
| Anthropic | Marks written mock exams, and provides the AI tools we use to build and support the platform. | Your written answers and the exam materials; other platform data where a support or maintenance task needs it. |
| Bold Video | Hosts lesson videos and provides the AI Tutor. | Viewing activity; what you type to the assistant. |
| Mux | Streams video. | Viewing activity and technical data. |
| PostHog (EU) | Product analytics. | Usage events; a persistent browser identifier only after you accept analytics cookies. |
| Sentry | Error monitoring. | Technical details of errors, which can include your user ID. |
| Sign in with Google, if you choose it. Hosts our email inbox and the documents and spreadsheets we use to run the business. | Your Google account email and name, if you sign in with Google; messages you send us; account and purchase details where we need them to support you. | |
| YAMM | Sends personalised emails from our inbox. | Your name, email address and the content of the email. |
Our tutors see the learning data, written work and questions of the students on the courses they teach, so that they can teach them. We may also share data where the law requires it, to protect our rights, or with a buyer if the business is sold, in which case the buyer takes on the obligations in this policy.
6. International transfers
We are based in Ireland. Some of the providers above are based in, or process data in, the United States, the United Kingdom and elsewhere in the European Economic Area. Transfers to the United Kingdom are covered by the European Commission's adequacy decision for the UK. Where personal data goes to the United States or elsewhere outside the EEA, we rely on the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard.
7. How long we keep it
| Data | How long |
|---|---|
| Your account and learning data | For as long as you have an account. Because courses come with lifetime access, that is until you ask us to delete your account. |
| Purchase and refund records | Six years after the transaction, as required by Irish company and tax law. When you delete your account these records are kept in that form only: they are separated from your name. |
| Written work and messages | For as long as you have an account; deleted with it. |
| Support conversations | For as long as you have an account; deleted with it, except that replies our staff wrote inside a conversation are kept without anything that identifies you. |
| ACCA waitlist (if you have not bought) | Until you ask us to take you off the list or to delete your details, or two years after you joined, whichever comes first. |
| Error logs and analytics | For as long as we need them for the purpose, subject to the retention limits our providers apply. Learning data used to improve the study engine is kept in de-identified form. |
When you ask us to delete your account, we anonymise the account record, delete the learning data, written work, messages and files that belong to you, and keep only the financial records above.
8. Cookies and similar technologies
By default the platform runs without analytics cookies: until you make a choice on the cookie banner, our analytics run in a cookieless mode that stores nothing on your device and cannot recognise you across visits. Only the cookies needed to run the service are set without asking.
| Name | Type | Purpose | Lasts |
|---|---|---|---|
| Sign-in session cookie | Strictly necessary | Keeps you signed in. Set when you sign in. | 30 days, refreshed while you use the platform. |
| Session hint | Strictly necessary | Lets pages that are cached for everyone show the right signed-in state without exposing your details. | Session. |
viva_analytics_consent (local storage) | Strictly necessary | Remembers whether you accepted or declined analytics cookies. | Until you clear your browser storage. |
viva-qual-preference (local storage) | Functional | Remembers whether you were looking at CIMA or ACCA pricing. | Until you clear your browser storage. |
PostHog cookies (ph_...) | Analytics, consent only | Recognise your browser across visits so that we can understand how the platform is used. Set only after you accept analytics cookies. If you decline, or withdraw consent later, these cookies are removed and we only count page views without cookies and without linking them to you. | Up to one year. |
You can change your mind at any time using the Cookie settings link at the bottom of every page of our website, or . Blocking strictly necessary cookies will stop you signing in.
9. Your rights
Under data protection law you have the right to:
- access the personal data we hold about you, and receive a copy;
- correct data that is inaccurate or incomplete - your name and email address can be changed from your account;
- delete your account and personal data, subject to the financial records we must keep;
- restrict how we use your data while a question about it is resolved;
- receive your data in a portable form where we process it by automated means on the basis of contract or consent;
- object to processing based on our legitimate interests, and to any direct marketing at any time;
- withdraw consent where consent is our basis, for example for analytics cookies, without affecting anything done before you withdrew it.
To exercise any of these rights, email info@vivatuition.com from the address on your account. We will respond within one month, and we do not charge for a request unless it is manifestly unfounded or excessive. We may ask you to confirm your identity first.
If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Data Protection Commission at dataprotection.ie, or to the data protection authority in the country where you live or work.
10. How we protect it
Data is encrypted in transit and at rest with our hosting providers. Passwords are stored only as one-way hashes. Access to the database is restricted to our service and to the staff who need it, under separate credentials for our production and test environments. We log security-relevant events and review them. No system is perfectly secure; if we ever discover a breach that puts your rights at risk, we will tell you and the Data Protection Commission as the law requires.
11. Children
The platform is for adults studying for professional accountancy qualifications. It is not directed at children and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email us and we will delete it.
12. Changes to this policy
We update this policy when what we do with your data changes. The date at the top shows when it was last changed. If a change is significant, for example a new purpose or a new category of provider, we will email account holders before it takes effect.
Questions about this document: info@vivatuition.com.