1. What data we process
Account data may include your email address, display name, profile settings and authentication identifiers. Learning data may include Study Packs, answers, progress, streaks, rewards, exam attempts and content you submit to AI features. In Nelo Teach, a teacher you are connected with can keep a register about you (attendance, lesson topics, homework and whether it was done); only that teacher sees it, and it is removed from all registers when you delete your account. If you accept a link from a parent, that parent sees your level, streak and daily exercise counts, your progress in Study Packs, Exams and Learning paths (scores and progress only), your homework status, results and teachers’ general comments, attendance from registers and teachers’ sacks, but not the text of your work or AI conversations; either of you can end the link. When a connected teacher picks a Study Pack or an Exams task for homework, they see whether you have already practised it on your own and your latest score (for writing, the AI score), never your answers. A teacher can also note lesson payments in the register and add calendar entries for you or your group; overdue payments are shown to your linked parent, or to you if no parent is linked. A teacher may share a public link to their own calendar that shows only their name and free or busy hours, never entry names or students. If you fill in an optional beta survey, we store your answers with your profile to improve Nelo; they are deleted with your account. When the app hits a technical error, we record the error message, the page, your browser type and your profile id so we can fix it. Technical data may include security and service logs generated by our hosting and infrastructure providers.
2. Why we use it and legal bases
We process data needed to create and operate your account, save learning progress and provide features you request on the basis of performing the service/contract or taking steps at your request. We may process limited technical and security data for our legitimate interests in protecting Nelo, preventing abuse and maintaining reliability. Where law requires consent for an optional feature, analytics or marketing, that processing will only start after consent. Optional gameplay analytics uses PostHog EU only after your permission in Analytics settings. We send a pseudonymous account/profile identifier and selected gameplay statistics (skills, garden, kitchen, ranch, purchases, game and boss results), without emails, names, question or answer text, recordings or page URLs. Advertising tracking is not enabled.
3. AI features
When you explicitly use AI import, AI writing assessment or AI speaking assessment, the material you submit and the prompt needed to perform the task are sent to Google Gemini API. Do not submit health data, passwords, financial information or other sensitive personal data. AI output can be inaccurate and should not be treated as a guaranteed educational or official exam result. In the oral exam practice, speech is turned into text by your browser’s built-in speech recognition (for example Google in Chrome or Apple in Safari), under that provider’s terms; the audio recording stays on your device and is not uploaded to Nelo. The transcript is sent to Google Gemini API only when you explicitly request an AI grade. Speaking activities in Study Packs and Learning Paths work differently: when you submit an answer for assessment, the audio is sent through Nelo to Google Gemini API. Nelo does not retain the audio file; it stores the transcript and assessment with your learning progress. In Nelo Teach+, a teacher can ask for an AI check of a student’s written homework: only the task, the teacher’s criteria and the text of the work are sent to Google Gemini API, without the student’s name or account details, and the AI suggestions are visible only to that teacher.
4. Service providers
Nelo currently uses Supabase for authentication and online application data, Vercel for application hosting and delivery, Google for Google sign-in and Gemini AI functionality, PostHog EU for optional gameplay analytics, and infrastructure providers used by those services. These providers may process data on our behalf under their own data-processing and security arrangements.
5. International transfers
Some providers may process data outside the European Economic Area. Where required, transfers are handled using an applicable adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism provided by the relevant service provider.
6. Retention
Account and learning data is normally kept while your account remains active and is deleted or anonymised when it is no longer needed, subject to technical backups and legal obligations. The refresh authentication cookie can last up to 30 days. Provider security logs may be retained according to the provider’s documented retention periods. Analytics retention follows the PostHog project settings (the free plan supports up to one year); withdrawing consent stops future collection but does not automatically erase events already sent. Contact the operator to request their deletion. Written homework submitted to a teacher in Nelo Teach is kept for 90 days from when it was written; after that the text, the comments anchored in it and any AI analysis are deleted, while the points and the teacher’s general comment remain in the results.
7. Your rights
Subject to applicable law, you may request access, rectification, erasure, restriction, portability and object to certain processing. Where processing is based on consent, you may withdraw consent at any time. You also have the right to lodge a complaint with your competent data protection authority.
8. Children and teenagers
Nelo is designed for learning and may be attractive to minors. A user should create an account independently only if they are old enough to do so under the law that applies to them. If you are below the age at which you can lawfully create and use the account on your own under the rules that apply in your country, a parent or guardian should be involved. Age thresholds for consent-based processing differ between countries, so Nelo may introduce country-specific age or parental-consent checks as the service expands.
9. Security
We use technical and organisational safeguards appropriate to the service, including secure HTTP-only authentication cookies and access controls. No online service can guarantee absolute security.
10. Changes
We may update this notice when Nelo changes, new providers are added or legal requirements change. The date and version shown on this page identify the current notice.