1. Controller and contact
The controller for data processed by Naukado is x1 technologies. NIP: 1251792192 · REGON: 542436628. Controller details and contact.
This policy describes the new version of Naukado (NEXT). The older app has separate legal information, but the account, sign-in and Premium entitlements are shared. Some account and purchase data therefore serves both versions, and deleting the shared account also covers older data. The policy provides information about processing; it is not consent to every purpose.
2. Data we receive
You provide your email, registration details, language and selected learning preferences, topics and instructions, uploaded photos and PDF files, pasted text, notes, questions and answers. Extracted and generated content, lesson and conversation history, exercise results, progress and reviews are also created. We record decisions about the terms and voluntary consents, with the document version, language and event time.
Depending on the chosen method, Apple or Google provides an account identifier and the email and profile details shared with us; Apple may use a relay email address. The store and RevenueCat provide information about purchases, products, periods, renewals and Premium entitlements. We do not receive your full payment-card number. Technical systems also process session identifiers, IP addresses, device, system and app-version information, security events, errors and usage limits. A support message contains the reply address you provide and the message text. The app also sends the app usage statistics described in section 15.
Naukado also processes the internal account identifier, a profile name or given name shared with us, linked sign-in methods, session and authentication data, and Premium status. These support the account, security and access to the service; processing them in Naukado does not mean they are automatically sent to AI models.
3. Purposes and legal bases
Account and learning: registration, authentication, material storage, selected AI content generation, Tutor, exercises, progress, preferences and synchronisation are necessary to perform the contract or take steps at your request before entering it — Article 6(1)(b) GDPR. The same applies to administering Premium and restoring entitlements.
Support and complaints: performance of the contract — point (b); complaint and data-rights obligations — point (c); establishing, exercising or defending claims — point (f). Security and reliability: abuse prevention, session protection, resolving uncertain operations and error diagnostics serve our legitimate interest in a secure, functioning service — point (f). Tax and accounting obligations: point (c), for data actually covered by those obligations.
Optional learning emails: voluntary consent — point (a), together with the required electronic-communication consent. Evidence of acceptance and consent choices is kept to demonstrate the contract, fulfil obligations and provide accountability; this does not make consent the basis for the whole service. We do not sell data as part of this service or share it with advertisers to display ads in NEXT.
App usage statistics: improving the app and the offer relies on our legitimate interest — point (f) (section 15).
4. Data used for AI
The Tutor uses OpenAI's GPT model, and the other AI functions use Anthropic's Claude models. Depending on the function, Anthropic receives the user's topic and instructions, pasted text or selected material excerpts, PDF and photo content, answers and learning context. This is used to extract material, prepare lessons, exercises, quizzes and flashcards, titles and suggested next topics, and choose a cover from a shared photo library. Covers are not generated from your data. OpenAI receives Tutor messages and conversation history, the user's question or answer, the necessary lesson or material excerpts and learning context, to prepare a response or the selected Tutor action. These functions do not send PDF files or photos as files to OpenAI; they may send text derived from them.
The data may include technical identifiers of sources or material excerpts, such as UUIDs, and language, subject, level and selected learning duration. We do not automatically include the account owner's email, given name, user identifier, session token (JWT), payment information or Premium status. However, material and message content is not fully anonymised: it can contain your or another person's personal data, such as a name in a note or message. The normal photo-upload flow re-encodes the image without EXIF/GPS metadata; this does not remove information visible in the image. A PDF may be transmitted as a file with its content and metadata. Data may also reach the provider when input size is measured (token counting), before a lesson or response is generated.
Share only the necessary content and remove unnecessary identifiers or confidential information. Do not submit special-category data, such as your own health information, unless needed and you have the proper basis to share it. A biology topic alone is not information about your health. We do not require such disclosure for learning. We save results in Naukado for the selected function; extraction and responses may contain errors and not every result is independently checked by a person.
AI provider retention and training: Under its standard commercial API policy, Anthropic deletes inputs and outputs within 30 days, subject to legal and safety-enforcement exceptions. Content flagged as a policy violation may be retained for up to 2 years, and safety classification scores for up to 7 years. It does not offer ad hoc deletion of individual API requests. OpenAI normally retains abuse-monitoring logs, which may contain inputs and responses, for up to 30 days; legal or safety needs may justify longer retention. Tutor response-generation requests use store=false to disable saving responses for later API retrieval; this does not mean zero retention of all data by OpenAI. Both providers exclude commercial API data from model training by default; separate voluntary sharing or an agreement may change that rule. We do not claim a custom zero-retention agreement or AI processing exclusively in the EEA.
5. Recipients and service providers
Data is received, to the extent necessary, by providers participating in a particular function: Anthropic — AI and extraction; OpenAI — Tutor; Neon — database; Cloudflare R2 — files and earlier images; Hostinger — servers and hosting; Titan — email; Sentry — error diagnostics; RevenueCat — subscription and entitlement information. Apple and Google participate in selected sign-in, purchases and notification delivery through the applicable system services. Not every provider receives material or conversation content.
Infrastructure providers process what is needed for their function. Apple and Google also operate their own accounts, stores and payments as separate controllers under their policies. Authorised authorities, legal advisers or accounting providers may receive data where justified, limited to a particular duty or matter. Using a function does not publicly publish a private material.
6. Processing locations and transfers
Naukado's database is hosted in Neon's Frankfurt region (AWS eu-central-1). Private files use Cloudflare R2 configured for EU jurisdiction. These settings do not mean that every provider operation, technical support, email, diagnostics and AI function occurs exclusively in the EEA.
International providers may involve processing outside the EEA. A transfer requires an applicable basis under Chapter V GDPR, such as an applicable adequacy decision or appropriate safeguards. Accepting the terms or this policy is not consent replacing that basis. You can request information about a particular transfer's basis and safeguards and an available copy of those safeguards at info@x1technologies.pl. We do not claim that all listed providers share a location, certification or retention conditions.
Anthropic's commercial API terms include a Data Processing Addendum (DPA), which incorporates standard contractual clauses (SCCs) for transfers outside the EEA. Anthropic processes API data in the United States or globally, not exclusively in the EEA. OpenAI's API terms include a Data Processing Addendum (DPA); for a customer in the EEA its party is OpenAI Ireland Ltd., and onward transfers outside the EEA rely on standard contractual clauses (SCCs) or an adequacy decision. Tutor data may be processed outside the EEA, including in the United States. Standard Cloudflare, Neon/Databricks, RevenueCat and Hostinger terms incorporate processing addenda and SCCs for transfers within their scope. Titan terms incorporate a DPA referring to data-protection clauses under Article 46(2)(c) GDPR. This describes standard terms for the relevant services, not a statement that an additional individual agreement was signed or that all processing is European. Sentry diagnostics are covered by an accepted Data Processing Addendum (DPA), which provides transfer safeguards within its scope.
7. Retaining accounts and content
We retain account details, preferences, materials, saved lessons, notes, conversations, answers and progress so you can use your account and return to learning, until the data or account is deleted, subject to the specific purposes below. Inactivity alone is not a promise to delete an account automatically after a set number of days.
An uncommitted import stage is valid for 24 hours; expired resources are subject to cleanup. Raw files are stored temporarily in the database during import; their bytes are removed from that stage when the material is committed. Accepted text and provenance remain with the material until deletion. Photos and PDF files uploaded for a lesson from a file, together with text extracted from a PDF, are kept in the database only while the lesson is prepared: a file not used in a lesson becomes eligible for deletion after 6 hours, and a used file once the lesson is prepared, at the latest 7 days after upload; periodic cleanup deletes them. The prepared lesson stays with the material until the material is deleted. The 24-hour period is not an automatic expiry rule for all Cloudflare R2 objects. Deleting a NEXT material covers linked lessons, images, sources, notes and reviews. Minimal allowance-usage and deletion-handling records may remain without the deleted content to avoid restoring used allowance or resurrecting the material. Recovery after an outage must take deletion requests into account.
8. Retaining operational records
Sign-in: an email code is valid for 10 minutes. Expired proof and protected retry data becomes eligible for cleanup one day after expiry or 2 minutes after use. This is not a deadline for erasing every security record.
Purchases: minimal information needed to determine Premium and event order remains linked to the account until deletion. Purchase events that do not affect access become eligible for deletion 168 hours after receipt, or earlier upon account deletion. Stores and payment providers keep separate records.
Support form: minimal hashed delivery and status metadata becomes eligible for deletion after 30 days. The message body and reply address are not saved in that table but are delivered to the support mailbox. The 30-day period is not a promise to delete the email from that mailbox.
Consent and communication: registration evidence, settings and communication statuses support accountability, carrying out your choice and preventing repeated or unwanted messages; account-related data is removed in connection with account deletion. Cleanup is periodic; an eligibility deadline does not guarantee erasure of every copy at the same second.
Server logs: the system journal has a configured 7-day age limit and a size limit; web-server logs rotate daily and retain 14 rotations. App-process logs retain 14 rotations with a 20 MB size threshold, which is not a guarantee of 14 days. Retained copies or evidence of a particular incident have a separate purpose. The authentication audit trail is protected against ordinary deletion; account deletion removes its account and session links but does not mean every remaining audit event is erased.
App usage statistics: events are deleted 400 days after they occurred (section 15).
9. Other retention, backups and account deletion
Support and complaint correspondence is kept while handling the matter and afterwards as needed to document its resolution and related claims, until the applicable limitation period expires or ongoing proceedings end. Data subject to tax or accounting obligations is retained for the applicable statutory period; this does not automatically cover all learning content. Diagnostics and security data is needed to investigate and resolve an error or incident; further retention requires a separate need relating to that incident or a claim.
Backups allow systems to be restored after an outage and are separate from the active database. Removing data from active systems does not instantly erase existing backups; the data remains until the relevant backup is replaced or deleted in its maintenance cycle. This does not make it available for ordinary continued learning. We do not state an unverified uniform retention period for all providers.
Account deletion covers the shared OLD and NEXT account and data in Naukado's active systems. Acceptance starts a process; files and necessary provider actions can take additional time. It does not delete Apple or Google accounts or separate store records or cancel subscriptions. A duty to retain particular evidence under law or for an ongoing dispute may limit erasure of that evidence; it does not justify retaining every material. The active Neon database has a 24-hour recovery-history window. Separate server backups and historical database and file copies also exist, including a separate source database after migration. The 24-hour window does not determine retention of those copies. After account deletion they do not serve ongoing account use; before resuming service after a restore, deletion requests and records preventing resurrection of deleted content must be applied.
Deleting data in Naukado does not instantly erase content already processed by AI providers. Their periods and exceptions described in section 4 apply. We accept requests concerning this data at info@x1technologies.pl and assess them under the applicable rights and actions available from the provider.
10. Email, push and voluntary consent
Optional NEXT emails helping you return to learning may include a welcome, messages after completing lessons and reminders. They require voluntary consent and active settings for that communication. A consent choice recorded at registration documents your choice; it does not promise to activate every type of delivery. Withdraw consent in app settings or using the unsubscribe link in a message. Withdrawal does not affect earlier lawful processing or prevent learning. Unsubscription and non-delivery or complaint information help stop further unwanted messages.
Sign-in codes and messages necessary for security or contract administration do not require marketing consent. Push notifications use a device token and require the relevant app setting and system permission. Push and email settings are separate. A system permission for the camera or notifications is not consent to all data-processing purposes. Optional emails are offered only to people declaring they are at least 16. This does not mean age has been verified. There is a limit of one message per 24 hours and 3 in a rolling 7-day period.
11. Your device and security
The app stores session data and limited data and operation records on the device to continue work, synchronise and safely recover results. Private storage is separated by account; signing out and changing accounts cut off the previous session's access. Not all content is necessarily stored locally. Uninstalling does not remove your account's server data or subscription.
The camera and photo or file selection are used only for the function you choose. We use access controls, usage restrictions and session safeguards; service connections use transport safeguards. No system guarantees zero risk. Do not share codes or send support passwords or card details. Sentry receives error diagnostics and technical information; a setting limiting default identifying data does not guarantee that every error message is free of personal data.
12. Personalisation and automated decisions
Your selected language, preferences, topic, material and progress help adapt learning, exercises and suggested next topics. Answer checking and content generation are partly automated. You can edit a suggested topic before creating a lesson.
These features do not determine school admission, a formal grade, employment or a similarly significant right. We do not use them to make decisions with legal or similarly significant effects under Article 22 GDPR. Any later introduction of such a use would require separate information and an appropriate basis; this policy does not authorise it.
13. Your rights
Within the conditions provided by law, you can request access and a copy, rectification, erasure or restriction. Automatically processed data based on a contract or consent may qualify for portability. You may object to legitimate-interest processing on grounds relating to your situation; you can object to direct marketing at any time. You can also object to app usage statistics with the switch described in section 15. You can withdraw consent at any time without affecting earlier processing.
Write to info@x1technologies.pl. We normally respond within one month; where the law permits an extension because of complexity or the number of requests, we will explain the reason and timing within that month, with at most 2 further months. If identity confirmation is necessary, we request only proportionate information. Rights are not unconditional: for example, a particular legal duty or defence of claims may limit erasure of a specific record. We will explain any refusal.
You can complain to Poland's President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl, or the competent authority in your EEA country, and seek a judicial remedy.
You can delete your account in the app, under Profile in the Account section, or request it at the email address above; reinstalling the app is not needed to email a request. You can request rectification, a copy or data portability by email — we do not promise a separate automatic export button.
14. Required data and minors
Data needed to create and authenticate an account is required for that service. Without material, a question or an answer, we cannot perform a function requiring it. Selected preferences, additional content, email consent and push permission are voluntary; withholding an unnecessary consent must not block the basic service. Do not supply unnecessary data about other people.
Minors should involve a guardian where required for the contract and consent. In Poland, where processing for an online service offered directly to a child relies on consent, a child under 16 needs a guardian's consent or authorisation; another country may have a different threshold. This does not mean all learning functions rely on consent or that accepting the terms verifies a guardian's authority. For concerns about a child's data, contact info@x1technologies.pl.
15. App usage statistics
The app sends Naukado statistics about how it is used: which screens and functions are opened, the steps of the introduction and sign-up, views of the Premium offer and the purchase outcome (started, completed, cancelled, failed), error messages shown in the app (as a short code), and the device platform (iOS or Android) and app build number. An event contains only its name, a few fixed values (for example a lesson’s length in minutes or whether an exercise was answered correctly) and its time. Events never contain lesson content, topics, questions and answers, messages to the Tutor, file names or your email address.
Events are linked to a random identifier of the app installation and a session identifier and, once you are signed in, to your account; before sign-in only to the installation identifier. They show us how learning goes, where people give up and what to improve. The purpose is improving the app and the offer; the legal basis is our legitimate interest — Article 6(1)(f) GDPR. We collect them ourselves, without third-party analytics tools. We do not sell them or use them for advertising or to track you across other apps and websites. They are stored in our database with the providers listed in section 5 (Neon, Hostinger).
You can object at any time: turn off the “Help improve Naukado” switch in the app’s Profile. The app immediately stops sending statistics from that device and deletes those waiting to be sent. We keep events for 400 days from when they occurred and then delete them; events linked to an account are also deleted in connection with deleting the account.
16. Version and information changes
This version dated 2026-11-03 describes processing in Naukado NEXT, including version 4.0.8 (209), and clarifies information about external AI. It does not change recorded acceptances, constitute new consent or state that a user gave separate AI permission. Links in existing app versions may still lead to the document dated 2026-11-01; earlier documents and acceptance evidence remain preserved. If an important purpose, recipient or processing method changes, we provide the appropriate information before the new processing starts and request separate consent where required. Continuing to use the app alone is not consent to every new purpose.
Controller details and contact
The controller for data processed by Naukado is Łukasz Szczepocki (X1 Technologies), NIP 1251792192, REGON 542436628, ul. Tulipanowa 3, 05-091 Ząbki, Poland. Contact info@x1technologies.pl about data and your rights. App support is available at contact@naukado.com.