1. Who we are

Ulern is operated by Novatra B.V. (“Ulern”, “we”, “us”), the company responsible for deciding how and why your personal data is processed — the “data controller” under the GDPR.

Company: Novatra B.V., a private limited company in the Netherlands
Registered address: In de Wolken 244, 1186 BR Amstelveen, The Netherlands
Chamber of Commerce (KvK) number: 98010298
VAT (BTW) number: NL868323627B01
Privacy contact: privacy@ulern.com

2. What data we collect

We collect only what we need to provide and improve Ulern:

Account data — your name, email address, and password (stored only as a secure hash), or your Google account identifier if you sign in with Google.
Profile and preferences — your learning goals, background, preferences, and constraints.
Learning data — your journeys, plans, your answers and responses, activity, and the progress and understanding the system derives from them.
Payment data — handled by our payment provider (Stripe). We store your plan and subscription status and a Stripe customer identifier; we do not store full card details.
Technical and usage data — device and browser information, IP address, and logs of how you use the platform.
How you use the apps — which screens you open, when a lesson starts and finishes, how long you actually listen, whether you answer the check-in questions, and whether you accepted a reminder. We record the time each of these happened on your own phone, so that a session you had on a walk without signal is still counted at the time you had it. We record what you did, never what you wrote or said: these records hold set values and counts only, no free text. We use this to understand what helps people learn and why people stop, and you can switch it off at any time — see “Your rights”.
Spoken questions — if you use the listening app and speak to it, your phone turns your speech into text on the device and sends us the text, not a recording. We store that text, the answer we gave, and the audio of that answer. We never store a recording of your voice.
The microphone while you listen — with “Answer out loud” switched on, the listening app opens the microphone for a few seconds after each question, so you can answer without touching the phone. If you also switch on the “Hey Ulern” phrase, it keeps the microphone open for as long as a lesson is playing, so that it can hear those two words. Nothing is recorded, transcribed or sent anywhere until you speak into a question or say the phrase; between those moments your phone is matching that phrase on the device only, and keeps nothing. Both switches are off-able in Settings at any time, and you can answer by tapping or with a headset button instead.
Communications — messages you send us, for example when you contact support.

3. How we use your data, and our legal bases

Under the GDPR we must have a legal basis for each use of your data:

To create your account and deliver your personalized learning journeys — to perform our contract with you (Art. 6(1)(b)).
To process payments and manage your subscription — to perform our contract with you.
To send essential service emails (verification, account, billing, security) — to perform our contract; any marketing emails are sent only with your consent (Art. 6(1)(a)), which you can withdraw at any time.
To secure the platform, prevent abuse, and improve our service — our legitimate interests (Art. 6(1)(f)), balanced against your rights.
To meet legal obligations such as tax and accounting — legal obligation (Art. 6(1)(c)).

4. AI processing of your content

Ulern is an AI-powered platform. To plan your learning, generate explanations and activities, and adapt to you, your inputs, answers, and learning context are processed by AI models — including those of our AI provider (currently Anthropic).

We do not sell your data, and we do not use your personal data to train AI models. We use our AI provider through its business API, under which the content we send is not used to train its models and is retained only briefly for abuse monitoring before deletion. We process this data under a data-processing agreement with the provider.

AI-generated content can be incomplete or inaccurate; please see our Terms of Service for the limits of what AI output should be relied on for.

5. Who we share data with

We do not sell your personal data. We share it only with vetted service providers (“processors”) who act on our instructions under data-processing agreements:

Stripe — payment processing and subscription billing.
Anthropic — AI processing of your learning inputs and content.
Google — sign-in (Google login) and email delivery.
Our cloud hosting provider — hosting and storing the platform and its data (EU region by default).

We may also disclose data where required by law, or to protect our rights, users, and the security of the service.

6. Where your data is processed

By default we host and process your data within the European Union. Some providers (for example our AI provider) may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards under the GDPR — such as the European Commission’s Standard Contractual Clauses or an adequacy decision — to protect your data.

7. Cookies

We use strictly necessary cookies to run the platform, such as keeping you signed in and keeping your session secure. These are required for Ulern to work.

If and when we introduce analytics or other non-essential cookies, we will ask for your consent through a cookie banner first. You can also manage cookies through your browser settings.

This section is about cookies. It is separate from the record of how you use the apps described in section 2, which is not a cookie and does not involve third-party advertising or tracking: we measure it ourselves, on our own servers, under our legitimate interest in understanding and improving the product. You have an absolute right to object to it, and switching it off in the app is how you exercise that — see “Your rights”.

8. How long we keep your data

We keep your personal data while your account is active. After your account is deactivated (for example, when your subscription or trial ends), we retain your data for up to 365 days and then delete or anonymize it — except where we are legally required to keep certain records longer (for example, invoices for tax purposes). You can also ask us to delete your data sooner; see “Your rights” below.

When you delete your account, we permanently erase your personal data: your profile, journeys, answers, notes, uploads, and everything you wrote. A few things are kept in a form that cannot identify you (Art. 89(1) GDPR — statistics): usage and cost statistics with every link to you removed or replaced by random values; and one coarse summary of how the account was used — the week it was opened, how many weeks it was active, rounded totals in broad bands, and how the subscription ended. That summary carries no name, no identifier, no dates beyond the week, no record of what was listened to, and no note of when it was written, so it cannot be traced back to you or to the moment you left. We keep it because it is the only way to understand why people stop once the underlying records are gone. Also kept: a one-way keyed hash of your email address so a deleted account cannot claim a second free trial (legitimate interest — fraud prevention, time-capped), and records the law requires us to keep. Security tokens issued before deletion expire on their own within days.

9. Your rights

Under the GDPR you have the right to:

Access the personal data we hold about you, and receive a copy.
Have inaccurate data corrected (rectification).
Have your data deleted (erasure), where applicable.
Restrict or object to certain processing. Where we rely on our legitimate interest, you can object at any time and we will stop unless we have compelling grounds not to.
Receive your data in a portable format (data portability).
Withdraw any consent you have given, at any time.

You do not need to email us to object to the record of how you use the apps described in section 2. In the Ulern Go app, open Settings and switch off “Usage analytics”; we stop keeping it from that moment, and the app carries on working exactly as before. You can switch it back on whenever you like.

To exercise any of these rights, email privacy@ulern.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local supervisory authority.

10. Children

Ulern is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact privacy@ulern.com and we will delete it.

11. How we protect your data

We use appropriate technical and organizational measures, including encryption of data in transit and at rest, access controls, and regular review of our security practices. No method of storage or transmission is perfectly secure, but we work to protect your data and to respond quickly if something goes wrong. To report a security concern, email privacy@ulern.com.

12. Changes to this policy

We may update this policy to reflect changes in our practices or the law. We will post the updated version here with a new date and, for material changes, notify you by email or within the platform.