This notice explains what personal data Aviari collects, why, and what you can do about it. Aviari is operated by Truffle Consultancy Ltd, a company registered in England and Wales (no. 14556226), registered office Acumen, 37th Floor, 1 Canada Square, London E14 5DY. Truffle Consultancy Ltd is the data controller.
Any questions, or any request about your data, go to hello@aviari.co.
What we collect
When you create an account
- Your first and last name.
- Your email address.
- Your password. This is handled by Google Firebase Authentication and stored in hashed form and we never see or hold your password. If you sign in with Google instead, we receive your name and email address from Google and no password is created.
As you use the course
- Your study plan, and your progress through it.
- Which chapters you have read, your flashcard ratings, and your quiz and mock exam attempts and results.
- How long you spend studying, so the app can show you your own study time.
When you buy something
- A record of what you bought and when your access to it ends.
- We do not collect or store your card details. Payments are taken by Stripe on their own checkout page. We receive confirmation that a payment succeeded and a customer reference, nothing more.
When you contact us
- Your email address, the topic you selected, and your message.
Why we use it, and our legal basis
- To provide the course you paid for: account, access, progress, results. Legal basis: performance of a contract.
- To take payment and grant access: purchase and entitlement records. Legal basis: performance of a contract.
- To send you service emails: email verification, password resets, purchase confirmations. Legal basis: performance of a contract.
- To answer you when you use the contact form. Legal basis: legitimate interests.
- To keep records we are required to keep, such as records of sale. Legal basis: legal obligation.
We do not use your data for advertising, we do not build profiles of you for marketing, and we do not sell or share your data with anyone for their own purposes.
Who processes data on our behalf
These are service providers acting on our instructions, not independent recipients of your data.
- Google Firebase (Google Cloud): authentication, database and hosting.
- Stripe: payment processing. Stripe is a data controller in its own right for payment data; see Stripe’s own privacy policy.
- Resend: sending transactional email.
Some of these providers operate outside the UK. Where data is transferred outside the UK, it is protected by the safeguards those providers have in place, such as UK International Data Transfer Agreements or equivalent standard contractual clauses.
How long we keep it
- Your account and study progress are kept while your account exists. When your access to a course expires, your account and your progress remain, so that you keep your history and can pick up where you left off.
- Records of sale are kept for six years, as UK tax law requires.
- Contact form messages are kept for as long as needed to deal with your enquiry.
- If you delete your account, we delete your profile and study data. Records of sale are retained as above.
Your rights
Under UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it;
- receive your data in a portable form;
- withdraw consent, where we relied on consent.
Email hello@aviari.co and we will respond within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
Aviari sets no cookies. See the cookie notice for what we do store on your device and why.
Changes
If we change this notice we will update the date at the top. If a change materially affects how we use your data, we will tell you by email.