1. Who is responsible for your data
Dot eVentures Pvt Ltd, of 141 Prashasan Nagar, Jubilee Hills, Hyderabad, Telangana 500033, India, decides how and why your personal data is used. Under the EU and UK GDPR we are the controller. Under India's Digital Personal Data Protection Act 2023 we are the Data Fiduciary. Under California law we are a business.
Contacts:
| Purpose | Who | Where |
|---|---|---|
| Anything about privacy | Privacy team | support@heywobo.com |
| Data protection officer | Data protection contact | support@heywobo.com, 141 Prashasan Nagar, Jubilee Hills, Hyderabad, Telangana 500033, India |
| India: grievance officer | Grievance officer, Dot eVentures Pvt Ltd | support@heywobo.com, 141 Prashasan Nagar, Jubilee Hills, Hyderabad, Telangana 500033, India |
| EU representative (Article 27) | EU representative name and address | support@heywobo.com |
| UK representative (Article 27) | UK representative name and address | support@heywobo.com |
| Safety concerns | Safety team | support@heywobo.com |
We answer privacy requests within 30 days, and tell you if we need longer.
2. What we collect, and why
Things you give us
| What | Examples | Why we need it |
|---|---|---|
| Account | name, phone number or email, password or third-party sign-in identifier, country, language | to make an account and let you back into it |
| Age or date of birth | your age band, or your date of birth | to work out which protections apply to you, and which features can be switched on |
| Parent or guardian details, if you are under 18 | parent name, email or phone | to ask for consent, to send the weekly summary if it is switched on, and to let them exercise their rights |
| What you study | board or curriculum, class or grade, subjects, your own syllabus if you upload one | to teach the right material |
| What you say to Wobo | typed questions, voice recordings when you hold the talk control, your ink on the board, your answers and working | to answer you and mark your work |
| Photographs you attach | a page of a syllabus, a homework question, a diagram | to read the question or the syllabus |
| Preferences | voice on or off, accent, theme, reduced motion, how proactive Wobo should be, notification choices | to make Wobo behave the way you asked |
| Payment details | card or wallet details, billing address, tax identifiers | to take payment. Card numbers go straight to our payment provider and we never see or store them |
| Reports | what you tell us is wrong, in the message you send us | to fix wrong content and to keep people safe. There is no flag control in the product and we do not capture your screen; the route is an email to us. community and flags section 2 has the detail |
| Support messages | what you write to us | to help you |
Things the product produces
| What | Why |
|---|---|
| Progress and mastery: which topics you have understood, which you have not, which mistakes recur | this is the tutoring. Without it Wobo restarts from nothing every day |
| Your learning profile: pace, preferred analogies, the last several turns, recurring misconceptions | so Wobo teaches you rather than an average learner |
| Activity events: lessons opened, problems attempted, time on a topic, streaks, XP | progress pages, the weekly summary, and improving the product |
| Boards you saved, notes, exports | so you can come back to them |
Things collected automatically
| What | Why |
|---|---|
| Device and app data: device type, operating system, app version, screen size, language, time zone | to make the app work on your device and to fix crashes |
| Approximate location, from your IP address, at country or region level | pricing, tax, language, and security. We do not collect precise GPS location |
| Log and security data: IP address, timestamps, requests, error traces | to keep accounts safe, stop abuse, and debug faults |
| Cookies and similar storage | see cookies |
We do not collect precise location, contacts, photo library beyond the picture you choose, biometric identifiers, or advertising identifiers. We do not run advertising trackers inside the product.
Sensitive data
We do not ask for sensitive data such as health, religion, caste, ethnicity or sexual orientation, and Wobo is instructed not to draw it out of you. It can still arrive incidentally, if you type it into a message. When it does we treat it as ordinary conversation content, we do not build categories from it, and you can delete it.
3. Why we are allowed to use it
For the EU and UK GDPR, our legal bases are:
| What we do | Basis |
|---|---|
| Run your account, teach you, keep your progress, take payment | performance of the contract with you |
| Keep the service safe, prevent abuse and fraud, debug faults, understand which features are used, in an aggregated way | our legitimate interests, balanced against your rights. We have recorded that balancing test and you can ask to see the summary |
| Analytics and non-essential storage, marketing messages, anything beyond the ordinary running of the service, and everything a child does beyond the basic service | your consent, or a parent's consent where you are a child. You can withdraw it at any time |
| Keep tax and accounting records, answer lawful requests | legal obligation |
Under India's DPDP Act, our lawful basis is consent, and for a learner under 18 that consent is a parent's or guardian's verifiable consent. Certain legitimate uses recognised by the Act may also apply.
Where the law where you live sets a lower age at which you can consent for yourself, we follow it.
4. Automated decisions and profiling
Wobo profiles you in one narrow sense: it forms a picture of what you understand, so it can choose what to teach next, when to offer a hint, and when a topic is ready. That picture is visible to you on the memory page and you can correct or clear it.
Wobo does not make decisions with a legal or similarly significant effect on you. It does not grade you for a school, decide admissions, set a price, or restrict access to anything outside the app. Where you want a human to look at something Wobo concluded about your learning, write to support@heywobo.com.
For learners under 18 we do not carry out behavioural advertising, tracking, or monitoring beyond what the tutoring itself requires and what safety requires.
5. Who we share it with
We do not sell personal data, and we do not share it for cross-context behavioural advertising, as those terms are used in California law.
We use service providers who process data only on our instructions, under contract, with confidentiality and security obligations, and who may not use it for their own purposes. By category:
| Category | What they do |
|---|---|
| Third-party AI and infrastructure providers | generate and check Wobo's explanations, convert speech to text and text to speech, read photographs you attach, and host the servers, databases, storage and content delivery the product runs on. One of them is a public code delivery network: when you run a piece of Python in a computer-science exercise, your browser fetches the language runtime from it directly, which means your device's address reaches that network |
| Payment and billing providers | take payment, handle renewals, tax and invoices, and detect payment fraud |
| Communication providers | send email, push notifications and messages you have asked for |
| Analytics and crash reporting | tell us which parts of the product are used and what is breaking, in an aggregated form wherever possible |
| Customer support tooling | manage the messages you send us |
| Security and abuse prevention | protect the service from attack and abuse |
| Professional advisers, auditors, insurers | advise us, under professional duties of confidence |
We name the categories and not the companies. This is deliberate: which providers sit behind Wobo is our engineering choice and changes over time. A named list is available to regulators, to schools carrying out procurement, and to any user who asks at support@heywobo.com.
We also share:
- with a parent or guardian, where you are under 18 and they exercise their rights, or where they have turned on the weekly summary;
- if we are legally required to, and we push back on requests that are too broad, and tell you unless the law forbids it;
- to protect someone from serious harm, including where a learner appears to be at risk of immediate danger, as described in safety and content;
- if the business is sold or reorganised, in which case the buyer is bound by this policy until it gives you notice of any change, and we will tell you first.
6. Where your data goes
We store data in regions, and our providers may process it in other countries, including outside the country you live in.
- For transfers out of the EEA and the UK we rely on the European Commission's standard contractual clauses, the UK addendum or the international data transfer agreement, and we carry out transfer risk assessments.
- For India we comply with any restriction on transfers to countries the government has restricted.
- You can ask us for a copy of the safeguards at support@heywobo.com.
7. How long we keep it
| Data | How long |
|---|---|
| Account and profile | while your account is open |
| Learning data: progress, mastery, saved boards, notes | while your account is open, so Wobo can carry on teaching you |
| Conversations with Wobo | while your account is open, unless you clear them, which you can do at any time on the memory page. |
| Voice | relayed live to the speech provider while you hold the talk control and never written to our storage at all, so there is nothing to keep and nothing to delete. What you said becomes part of the conversation, and the conversation is kept as the row above says. |
| Photographs you attach | sent to the model that reads the page and never written to our storage. What we keep is the text we read out of it and a fingerprint of the document, not the picture. |
| Payment and tax records | as long as tax and accounting law requires, which we take as 8 years in India and 6 years in the UK and much of the EU. |
| Security and access logs | 90 days, longer where an incident is being investigated |
| Support messages | 24 months |
| Parental consent records | for as long as the account exists, plus 3 years, because we have to be able to show consent was given. |
| Data after you ask us to delete your account | there is no delete-my-account button yet. Ask us at support@heywobo.com and we do it by hand. |
Anything kept beyond deletion is kept in a locked-down form, used only for the reason it was kept, and then deleted.
8. Your rights
Wherever you live, the law gives you the rights below and we honour every one of them. Most of them are an email to us and not a control in the product, and we would rather say so here than let you go looking for a button that is not there.
- See what we hold about you. The memory page in settings lists what Wobo remembers, in plain sentences, item by item. That part is real and it is in the product. Everything else we hold, write to us for.
- Correct anything wrong. The same page, item by item, plus your name, class and board.
- Delete it. "Erase and start over", in settings under your data, is the one button on this list. It clears what Wobo remembers, the conversation, your profile row, your mastery and progress record, your mail choices and the parent link, on the device and on our servers. It does not clear your individual answers to practice questions, your ink on the board, your session records, or a syllabus you uploaded and the curriculum built from it. Write to us for those.
- Close the account. There is no control in the product that does this. Write to us and we do it by hand.
- Have a copy to take away. There is no way to take a copy away yourself: no button, no file, no route. Write to us and we assemble one by hand, and we are building the real thing.
- Object to, or restrict, some uses. By email. There is no control for either.
- Withdraw consent at any time, which does not undo what was done before you withdrew it. For mail, every message carries a one-tap stop and settings carries the dials. For memory, voice and photographs there is nothing to withdraw, because nothing was ever asked: see childrens privacy section 3.
- Complain to us first, and then to a regulator.
Additional rights by place:
European Union and United Kingdom. The rights above are Articles 15 to 22 of the GDPR. You can complain to your national supervisory authority, or, in the UK, to the Information Commissioner's Office.
India. You have the right to access a summary of your data and of the processing, to correction and completion, to erasure, to nominate someone to exercise your rights if you die or become incapacitated, and to grievance redressal. Write first to our grievance officer, and then, if you are not satisfied, to the Data Protection Board of India. You also have a duty under the Act not to file a false or frivolous complaint.
California. You have the right to know what we collect, use, disclose and share, to delete, to correct, to opt out of sale or sharing, and to limit the use of sensitive personal information. We do not sell or share personal information, and we do not use sensitive personal information for anything beyond providing the service, so there is nothing to opt out of. We do not discriminate against anyone who exercises a right. An authorised agent can act for you with proof. Californians under 18 who have posted something in the service can ask us to remove it.
Other US states. Where your state gives you similar rights, we honour them and use the same forms.
To use any of these rights, write to support@heywobo.com, or use the buttons in settings. We will ask for enough information to be sure it is you, and we will not charge, unless a request is repetitive or excessive. If you are under 18, your parent or guardian can make a request for you, and, depending on your age and the law where you live, we may ask you too.
9. Children
Children's privacy has its own document, childrens privacy, and the consent flow has another, parental consent. Both form part of this policy. In short: age decides which features exist, a parent's verifiable consent unlocks the rest, the parent can see and delete everything, and we never make consent to extra processing a condition of learning.
10. Security
These are the controls that are in place today, each of them checked against the code rather than intended:
- Isolation between accounts is enforced by the database, not only by our application. Every table that holds a learner's rows carries a policy tying each row to the signed-in learner's own identity.
- Every request goes through one authentication door. No route reads who you are from the body of a request, the token signature is checked against a closed list of algorithms, and the development shortcut that lets an engineer act as a test learner is refused outright in production.
- Transport is encrypted, with strict transport security, a content security policy, framing forbidden, and camera and location denied at the browser level.
- Your IP address is fingerprinted before it reaches a log line, so the logs carry a salted digest rather than the address.
- Payment card details never touch our servers.
- There is no advertising or analytics code in the product at all, so there is nothing in it reporting on you to anyone.
These are not in place, and we would rather name them than imply them:
- Access to personal data is not logged. Our own server holds a key that can read any learner's rows, and nothing records when it is used or why. Until that logging exists we cannot honestly claim least privilege for staff.
- Encryption at rest and key rotation are the hosting provider's, and we have not read the project's settings and written the answer down, so we make no claim of our own about them.
- No penetration test has been done, no security certification has been obtained, and no backup has ever been restored as a rehearsal.
No system is perfectly secure. If a breach happens and it puts your rights at risk, we will tell you and the relevant regulators without undue delay, and within the time limits the law sets.
11. Marketing and messages
Service messages, such as a receipt, a security alert or a change to these terms, are part of having an account.
Anything else, such as tips, streak nudges, or news, is optional, needs consent where the law requires it, and has an off switch in settings and in every message. For a learner under 18, marketing consent sits with the parent or guardian, and we do not send promotional messages to a child who has not been through that flow. We do not use pressure tactics or countdowns aimed at children.
12. Changes to this policy
If we change anything that matters, we will tell you in the app and by email at least 30 days before it takes effect. We do not yet keep old versions available: this page renders whatever the current document says, and there is no archive to compare against. Until there is, ask us at support@heywobo.com and we will send you the previous wording. Where a change needs fresh consent, we will ask.
13. Talking to us
support@heywobo.com, or 141 Prashasan Nagar, Jubilee Hills, Hyderabad, Telangana 500033, India, marked for the attention of the privacy team. A person reads it.