Privacy Policy

Last updated: October 6, 2026

1. Data controller

The data controller for VivaLeX is:

Kevin Mark Lock 2620 Albertslund Denmark Email: kevin.lock03@gmail.com

2. Information we process

We process information needed to provide and secure VivaLeX:

  • Account data: email address and account ID from Google sign-in through Supabase Auth.
  • Documents and learning data: PDFs you upload, file names, document records, reading progress, and related timestamps. Uploaded PDFs and saved generated audio are encrypted by the application with AES-256-GCM before being stored in Supabase Storage. A per-document encryption key is derived from a server-held master secret. The service must access document contents temporarily when processing a requested feature. Saved audio is stored with its page, voice, reading order, and section coordinates so it can be replayed. OCR text, narration scripts, and reusable page analysis are processed temporarily and are not saved.
  • Feature input and output: when you request image analysis, the selected image is sent to Mathpix for OCR and the image plus OCR text are sent to OpenAI’s API using GPT-6 Luna. When you request text-to-speech, the text and selected voice are sent to our Modal-hosted Kokoro speech service. These providers process the submitted content to return the requested result.
  • Usage and cost statistics: we record a random, stable analytics ID, signup month and test/live environment, feature used, plan, outcome, credits spent, provider/model, model token counts (including reasoning and cache counts), Mathpix image-request counts, and audio text length and processing time. Historical Gemini usage counts are also retained. These records do not contain your email, account ID, document name, prompt, image, generated answer, or audio. If you delete your account, its link to the analytics ID is removed, but the pseudonymous ID and usage records are retained for product usage and cost analysis. Because the ID links a person’s activity over time, these statistics are pseudonymous personal data, not anonymous data.
  • Billing data: subscription, payment, invoice and checkout status/reference information needed to provide subscriptions, resolve payment issues, and keep required business records. Lemon Squeezy processes checkout and payment details. We do not receive or store full card numbers.
  • Technical and security data: service logs, request times, error details, and information needed to prevent abuse and troubleshoot the service.

3. Why we process information

We use this information to authenticate you, provide document storage and learning features, manage credits and subscriptions, respond to support requests, secure and troubleshoot the service, understand service usage and provider costs, and meet accounting and other legal obligations.

Our intended legal bases are performance of our contract with you for account and requested service features; legitimate interests in securing, maintaining, and improving VivaLeX and measuring its operating costs; and compliance with legal obligations for records that must be kept. Where consent is required, we will ask for it separately.

4. Service providers

We use the following providers to operate VivaLeX:

  • Google for sign-in and identity authentication.
  • Supabase for authentication, database, server-side functions, and encrypted PDF and audio storage.
  • Vercel for website hosting and privacy-focused Web Analytics. The analytics service measures page views, referrers, and general device and location information to help us understand site traffic. Vercel states that Web Analytics does not use cookies, uses an anonymous request-derived identifier that expires after 24 hours, and provides aggregated statistics.
  • Mathpix for optical character recognition of images submitted for analysis. The app sends improve_mathpix: false with image OCR requests. Mathpix documents that this prevents the image and OCR result from being persisted for later retrieval; request metadata for auditing and billing may still be retained.
  • OpenAI API to analyze the submitted image and OCR text and produce the requested narration script. API content is not used to train OpenAI models by default unless the API account opts into sharing. VivaLeX sends store: false to disable stored response history. This does not disable prompt caching or provider abuse-monitoring logs: under standard settings, these logs may contain submitted content and are normally retained for up to 30 days, with exceptions described in OpenAI’s data controls. We do not claim Zero Data Retention or EU-only OpenAI processing without verifying the API project’s eligibility and configuration.
  • Modal to run the Kokoro text-to-speech service. The text and voice choice needed to generate speech are sent to that service.
  • Lemon Squeezy for checkout, subscription management, and payment processing.

These providers process information under their applicable terms and privacy documentation. Some providers may process information outside the European Economic Area. Where that happens, the transfer relies on the transfer mechanism applicable to the provider and service, such as an adequacy decision or standard contractual clauses. Contact us if you would like information about the applicable safeguards.

5. Storage and retention

We keep account, document, and learning data while your account is active or as needed to provide the service. You can delete an individual document from its menu in the Library or use Delete All Files in Settings to delete all documents. These actions remove the document records and queue the associated encrypted PDFs and saved audio for deletion with retries; they do not delete your account. You can use Clear audio from a document menu or Clear all audio in Settings to remove saved audio while keeping PDFs and reading progress. Processing pages again uses credits.

You can request account deletion using Delete My Account in Settings. This cancels linked subscriptions to stop future renewals, removes your account and application data, and deletes uploaded files. The deletion flow retains live payment history where needed for accounting, removes test payment and credit history, and leaves limited unowned provider/checkout references needed to safely process delayed payment notifications. Lemon Squeezy retains its own provider-side customer and subscription records under its policies. Pseudonymous usage statistics remain after the account link is removed, as described above.

The application does not currently automatically delete accounts solely because they have been inactive for 12 months. Pseudonymous usage statistics have no fixed automatic deletion date at present; they are retained for service usage and cost analysis. We periodically review whether continued retention is needed.

6. Security

We use access controls and encryption in transit. PDFs are encrypted before storage using AES-256-GCM, with keys derived per document from a server-side secret. No security measure can guarantee absolute security, but we work to protect the information we process.

7. Cookies and browser storage

VivaLeX uses browser storage and authentication tokens to keep you signed in and provide the service. Supabase authentication manages the session. Vercel Web Analytics is used to measure site traffic; according to Vercel, it does not use cookies and its visitor identifier expires after 24 hours. We do not intentionally use advertising or cross-site tracking cookies. Our hosting or service providers may use strictly necessary technical mechanisms to deliver and protect the service.

8. Your rights

Subject to applicable law, you may request access to, correction of, deletion of, or a copy of your personal data, and may object to or request restriction of certain processing. To exercise these rights, contact kevin.lock03@gmail.com. You may also complain to the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.

9. Changes and contact

We may update this policy when the service or its data practices change. The latest version will be published with its update date. For privacy questions or requests, contact kevin.lock03@gmail.com.