Privacy Policy | Edvello

1. Introduction

At Edvello (“us”, “we”, “our” or the “Company”) we value your privacy and the importance of safeguarding your data. This Privacy Policy (the “Policy”) describes our privacy practices for the activities set out below. As per your rights, we inform you how we collect, store, access, and otherwise process information relating to individuals. In this Policy, personal data (“Personal Data”) refers to any information that on its own, or in combination with other available information, can identify an individual.

We are committed to protecting your privacy in accordance with the highest level of privacy regulation. As such, we follow the obligations under the below regulations:

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and the applicable provincial legislations
Quebec Law 25
the EU’s General Data Protection Regulation (GDPR)
Brazil’s Data Protection Legislation (LGPD)
California’s Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) and California Online Privacy Protection Act (CalOPPA)
Colorado Privacy Act (CPA)
Utah Consumer Privacy Act (UCPA)
Connecticut Data Privacy Act (CTDPA)
Virginia Consumer Data Protection Act (VCDPA)
Texas Data Privacy and Security Act (TDPSA)
Oregon Consumer Privacy Act (OCPA)
Montana Consumer Data Privacy Act
Delaware Personal Data Privacy Act
Nebraska Data Privacy Law
New Hampshire Data Privacy Act
New Jersey Data Privacy Act
Minnesota Consumer Data Privacy Act
Maryland Online Consumer Protection Act
Kentucky Consumer Data Privacy Act (KCDPA)
Tennessee Information Protection Act (TIPA)
The Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)
Indiana Consumer Data Privacy Act (INCDPA)
Iowa Consumer Data Privacy Act (ICDPA)
South Africa’s Protection of Personal Information Act (POPIA)
Switzerland’s Federal Act on Data Protection (FADP)
Saudi Arabia’s Personal Data Protection Law (PDPL)

Scope

This policy applies to the Edvello websites, domains, applications, services, and products.

This Policy does not apply to third-party applications, websites, products, services or platforms that may be accessed through (non-Edvello) links that we may provide to you. These sites are owned and operated independently from us, and they have their own separate privacy and data collection practices. Any Personal Data that you provide to these websites will be governed by the third-party’s own privacy policy. We cannot accept liability for the actions or policies of these independent sites, and we are not responsible for the content or privacy practices of such sites.

Processing Activities

This Policy applies when you interact with us by doing any of the following:

Make use of our application and services as an authorized user
Visit any of our websites that link to this Privacy Statement

2. Personal Data We Collect

What Personal Data We Collect

When you create an account, use Edvello, or contact us, we collect the Personal Data needed to provide the service. This may include:

Account information such as your name, email address, password or authentication method, organization membership, and role
Course and workspace content that you or your organization create, upload, submit, or manage in Edvello
AI feature inputs and outputs, such as prompts, chat messages, generated content, selected course context, documents you choose to reference, video audio sent for transcription, transcripts, and AI usage records
Communications, support requests, feedback, and preferences that you choose to share with us
Billing, subscription, and transaction records where you or your organization purchase paid services. Payment card details are processed by our payment providers and are not stored by Edvello.

How We Collect Your Personal Data

We collect Personal Data from the following sources:

From you. You may give us account information, content, feedback, billing details, preferences, and support information by filling in forms, using our products or services, entering information online, or corresponding with us by email or otherwise. This includes Personal Data you provide, for example, when you:

Create an account or purchase Edvello services;
Use our products or services;
Create content through our products or services;
Express interest in our products or services;
Subscribe to our newsletter;
Complete a voluntary survey or provide feedback;
Contact us with an inquiry or to report a problem;
Log in with a supported third-party authentication provider.

Automated technologies or interactions: As you interact with our website and application, we may automatically collect device, log, and usage data such as browser type, IP address, pages visited, actions taken in the product, timestamps, authentication records, and diagnostic information. We collect this data using cookies, server logs, analytics events, and similar technologies. Please see our Cookie section (below) for further details.

Third parties: We may receive Personal Data about you from various third parties, including:

Account information from your organization when it invites you to Edvello or manages your membership;
Account information from supported third-party authentication providers when you choose to sign in with them;
Billing and subscription status from our payment providers;
Device, log, and usage data from analytics and infrastructure providers; and
Information from service providers that help us deliver support, email, hosting, storage, security, and other operational services.

If you provide us, or our service providers, with any Personal Data relating to other individuals, you represent that you have the authority to do so and acknowledge that it will be used in accordance with this Policy. If you believe that your Personal Data has been provided to us improperly, or to otherwise exercise your rights relating to your Personal Data, please contact us by using the information set out in the “Contact us” section below.

Device and Usage Data

When you visit a Edvello website or use the Edvello application, we automatically collect and store some information about your visit using browser cookies or similar technology. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. The Help Feature on most browsers will provide information on how to accept cookies, disable cookies or to notify you when receiving a new cookie. If you do not accept cookies, you may not be able to use some features of our Service.

We also process information when you use our services and products. This information may include:

Device IDs
Login information
IP Address
Time stamps
Authentication records
Country or region derived from request metadata, where available, for aggregate analytics
Time zone

We do not collect precise location data from your browser or device, and we do not use location data to personalize offers or provide location-specific promotions.

Data we collect from third parties

We may receive your Personal Data from third parties such as companies subscribing to Edvello services, partners and other sources. This Personal Data is not collected by us but by a third party and is subject to the relevant third party’s own separate privacy and data collection policies. We do not have any control or input on how your Personal Data is handled by third parties. As always, you have the right to review and rectify this information. If you have any questions you should first contact the relevant third party for further information about your Personal Data. Where that third party is unresponsive to your rights, you may contact the Data Protection Officer at Edvello (contact details below).

Our websites and services may contain links to other websites, applications and services maintained by third parties. The information practices of such other services, or of social media networks that host our branded social media pages, are governed by third parties’ privacy statements, which you should review to better understand those third parties’ privacy practices.

Purpose and Legal Basis for the Processing of Personal Data

We collect and use your Personal Data to provide, maintain, secure, and improve our products and services, and where required, with your consent.

These purposes include:

Deliver, maintain, debug, and improve Edvello services
Enable you to access Edvello and manage accounts, organizations, courses, and content
Verify and authenticate your identity
Provide AI-assisted features, including course generation, content drafting, tutoring, summarization, and media transcription
Process subscriptions, billing, and payments through our payment providers
Provide technical and customer support
Send product, transactional, security, and service communications
Investigate and prevent security incidents, abuse, and unauthorized access

Where we process your Personal Data to provide a product or service, we do so because it is necessary to perform contractual obligations. We may also process Personal Data based on our legitimate interests in operating, securing, improving, and supporting Edvello. Where applicable law requires consent for a particular processing activity, we will ask for that consent.

Third Party Tools

We use third-party tools and subprocessors to operate our services and store or process information where applicable. These may include:

Hosting, database, cache, and object-storage providers
Cloudflare (hosting, CDN, security, and object storage for uploaded files, videos, and related media)
Railway and Render (application hosting and infrastructure)
Email delivery providers
Payment and subscription providers
Authentication and security providers
AI model, transcription, and content-processing providers
PostHog (product analytics where implemented in our applications)
Umami (privacy-focused website analytics on our marketing site)

This list may change as we update our vendors; material changes will be reflected in this Policy when practical.

AI Features

Edvello includes AI-assisted features that can help create and edit course content, generate titles and text, summarize conversations, provide tutoring support, and transcribe uploaded videos. When you use these features, we process the information needed to provide the requested output. This may include your prompts, chat messages, selected model, course, lesson, exercise, document or media context, uploaded audio or video-derived audio for transcription, AI outputs, transcripts, token usage, and related diagnostic information.

We may send the minimum information needed for an AI request to third-party AI model or transcription providers, including providers such as OpenAI, Anthropic, Google, and Moonshot where those providers are configured for the service. Those providers process the information to return the requested AI output and operate their services under their own applicable terms, policies, and data-processing commitments.

Edvello does not use your organization’s course content, prompts, uploaded files, or AI outputs to train a general-purpose AI model unless we tell you and obtain any consent required by applicable law. AI outputs may be inaccurate or incomplete, so you should review generated content before relying on it or publishing it to learners.

International Data Transfer and Storage

Where possible, we store and process data on servers within the general geographical region where you reside (note: this may not be within the country in which you reside). Your Personal Data may also be transferred to, and maintained on, servers residing outside of your state, province, country or other governmental jurisdiction where the data laws may differ from those in your jurisdiction. We will take appropriate steps to ensure that your Personal Data is treated securely and in accordance with this Policy as well as applicable data protection law. More information about standard contractual clauses can be found here: https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32021D0914

We will share your Personal Data with third parties only in the ways set out in this Policy or set out at the point when the Personal Data is collected.

Legal Requirement

We may use or disclose your Personal Data in order to comply with a legal obligation, in connection with a request from a public or government authority, or in connection with court or tribunal proceedings, to prevent loss of life or injury, or to protect our rights or property. Where possible and practical to do so, we will tell you in advance of such disclosure.

Service Providers and Other Third Parties

We may use a third party service provider, independent contractors, agencies, or consultants to deliver and help us improve our products and services. We may share your Personal Data with marketing agencies, database service providers, backup and disaster recovery service providers, email service providers and others but only to maintain and improve our products and services. For further information on the recipients of your Personal Data, please contact us by using the information in the “Contacting us” section below.

3. Cookies

What are Cookies?

A cookie is a small file with information that your browser stores on your device. Information in this file is typically shared with the owner of the site in addition to potential partners and third parties to that business. The collection of this information may be used in the function of the site and/or to improve your experience.

How we use cookies

We use cookies and similar technologies for the following purposes:

Essential cookies. These keep you signed in, protect sessions, support authentication flows, and enable security-sensitive parts of the service.
Preference cookies. These remember settings such as locale, theme, sidebar state, organization context, and other product preferences.
Analytics cookies. These help us understand aggregate usage and product performance where analytics are enabled.

We do not use cookies to collect precise location data, and we do not use location data to show location-specific offers.

4. Retention & Deletion

We will only retain your Personal Data for as long as necessary for the purpose for which that data was collected and to the extent required by applicable law. When we no longer need Personal Data, we will remove it from our systems and/or take steps to anonymize it.

5. Merger or Acquisition

If we are involved in a merger, acquisition or asset sale, your personal information may be transferred. We will provide notice before your personal information is transferred and becomes subject to a different Privacy Policy. Under certain circumstances, we may be required to disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

6. How We Keep Your Data Safe

We have appropriate organizational safeguards and security measures in place to protect your Personal Data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.

The communication between your browser and our website uses a secure encrypted connection wherever your Personal Data is involved.

We require any third party who is contracted to process your Personal Data on our behalf to have security measures in place to protect your data and to treat such data in accordance with the law.

In the unfortunate event of a Personal Data breach, we will notify you and any applicable regulator when we are legally required to do so.

7. Your Rights for Your Personal Data

Depending on your geographical location and citizenship, your rights are subject to local data privacy regulations. These rights may include:

Right to Access (PIPEDA, GDPR Article 15, CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA, LGPD, POPIA)
Right to Rectification (PIPEDA, GDPR Article 16, CPRA, CPA, VCDPA, CTDPA, LGPD, POPIA)
Right to be Forgotten (right to erasure) (GDPR Article 17, CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA, LGPD, POPIA)
Right to Restriction of Processing (GDPR Article 18, LGPD)
Right to Portability (PIPEDA, GDPR Article 20, LGPD)
Right to Opt Out (CPRA, CPA, VCDPA, CTDPA, UCPA)
Right to Objection (GDPR Article 21, LGPD, POPIA)
Nondiscrimination and nonretaliation (CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA)
File an Appeal (CPA, VCDPA, CTDPA)
File a Complaint (GDPR Article 77, LGPD, POPIA)

You have the right to file an appeal based on our response to you exercising any of these rights. In the event you disagree with how we resolved the appeal, you may have the right to contact your local data protection or consumer protection authority.

If you are based in the EEA, please visit this website (https://edpb.europa.eu/about-edpb/about-edpb/members_en) for a list of local data protection authorities.

You have the right to learn whether we are processing your Personal Data and to request a copy of the Personal Data we are processing about you.

You have the right to have incomplete or inaccurate Personal Data that we process about you rectified.

You have the right to request that we delete Personal Data that we process about you, unless we need to retain such data in order to comply with a legal obligation or to establish, exercise or defend legal claims.

You have the right to restrict our processing of your Personal Data under certain circumstances. In this case, we will not process your Data for any purpose other than storing it.

You have the right to obtain Personal Data we hold about you, in a structured, electronic format, and to transmit such Personal Data to another data controller, where this is (a) Personal Data which you have provided to us, and (b) if we are processing that data on the basis of your consent or to perform a contract with you or the third party that subscribes to services.

You have the right to opt out of the processing of your Personal Data for purposes of: (1) Targeted advertising; (2) The sale of Personal Data; and/or (3) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. Under CPRA, you have the right to opt out of the sharing of your Personal Data to third parties and our use and disclosure of your Sensitive Personal Data to uses necessary to provide the products and services reasonably expected by you.

Where the legal justification for our processing of your Personal Data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for processing which override your interests and rights, or if we need to continue to process the Personal Data for the establishment, exercise or defense of a legal claim.

You have the right not to be denied service or have an altered experience for exercising your rights.

If you are based in Colorado, please visit this website to file a complaint. If you are based in Virginia, please visit this website to file a complaint. If you are based in Connecticut, please visit this website to file a complaint.

If you have consented to our processing of your Personal Data, you have the right to withdraw your consent at any time, free of charge, such as where you wish to opt out from marketing messages that you receive from us. If you wish to withdraw your consent, please contact us using the information found at the bottom of this page.

How to Exercise Your Rights

You can make a request to exercise any of these rights in relation to your Personal Data by contacting our team using the contact details below.

For your own privacy and security, at our discretion, we may require you to prove your identity before providing the requested information.

8. Changes

We may modify this Policy at any time. If we make changes to this Policy then we will post an updated version of this Policy at this website. When using our services, you may be asked to review and accept our Privacy Policy. In this manner, we may record your acceptance and notify you of any future changes to this Policy.

9. Contact Us

To request a copy of your information, unsubscribe from our email list, request for your data to be deleted, or ask a question about your data privacy:

Email help@edvello.com

Last updated: July 12, 2026