Viademy
Try for free

Company & Legal

Privacy policy

Last updated:

This policy explains how Mapnook s.r.o. handles personal data for the Viademy website, staff app and related support. For data processed on a school’s instructions, see our GDPR overview.

Mapnook s.r.o. is the controller for website enquiries, account administration and our own service-security activities. Contact hello@viademy.com about this policy or your data. Where we process personal data on a school’s behalf, the school’s instructions and the applicable processing agreement govern that processing.

We collect information needed to answer enquiries and provide, support and secure the service. Required contact-form fields are your name, email and message; school, city and phone are optional. Without the required fields, we cannot reply through the form.

  • Enquiries and support: contact details, the message and information you choose to provide. We use our legitimate interest in answering business enquiries, or take steps towards a contract where you request them.
  • Staff accounts and schools: names, email addresses, authentication information, school details, memberships and roles. We use these to provide the agreed service and manage access; where a school contracts with us, staff administration also relies on our legitimate interests in operating that relationship.
  • Lessons and devices: teacher identity, device/team identifiers and labels, chapter progress, activity and timestamps. These support lesson delivery and school history. Where this is personal data processed for a school, the school determines the legal basis.
  • Technical and security information: IP addresses, browser/device information, sessions, request metadata and error diagnostics. We use our legitimate interests in preventing abuse and keeping the service reliable.
  • Legal records: information necessary to meet applicable accounting or other legal obligations, or to establish, exercise or defend legal claims.

The current classroom workflow does not require individual pupil accounts, names, dates of birth or pupil email addresses. It records activity by lesson, team and device. A school may be able to link these records to a pupil, and names entered in device labels or messages may identify someone, so we do not treat all lesson data as anonymous.

Where a school or authorised staff member provides pupil information, we may receive and store it as necessary for the requested teaching or support purpose. This may include names, display names or school-issued identifiers where the relevant feature supports them. We handle the information under the applicable school instructions, lawful basis, processing arrangements and retention policy for the relevant record.

Use neutral team/device labels where identification is unnecessary and avoid sensitive information in free-text fields. Pupils participate under the school’s supervision. Headset manufacturers may process data independently under their own policies.

We use AWS for the app and database in Frankfurt, Germany; Cloudflare for the public website, delivery and security; Resend for enquiry and account emails; Better Stack for app diagnostics; and Slack for internal notifications about enquiries, completed staff registrations and new schools. These notifications contain staff/contact names, email addresses and limited school details, not enquiry message bodies, passwords or pupil records. Support correspondence is also held in our email service. These providers receive the information needed for their functions. We do not sell personal data.

Frankfurt hosting does not mean every processing activity stays in the EU. Cloudflare operates globally, Resend processes email in the United States, and our Better Stack Errors project uses a US region. Slack may also process notification data outside the EEA. International processing must have an applicable legal basis and safeguards, such as an adequacy decision or standard contractual clauses where required. Contact us for the arrangements relevant to your school.

We keep personal data only while needed for its stated purpose. Our review schedule below is not a minimum retention period or a reason to refuse an earlier valid deletion request. Reviews and deletion requests are handled by our team; account and lesson records are not automatically deleted merely because these intervals have elapsed.

  • Enquiries that do not develop into an ongoing relationship: review after 12 months from the last substantive contact; delete when no longer needed.
  • Staff accounts and school records: retain while the service is in use, then review for deletion or irreversible anonymisation within 90 days of confirmed closure.
  • Lesson, team and device history: review after 24 months and when a school closes its account; remove or irreversibly anonymise records no longer needed. Schools can request a shorter period.
  • Operational app server logs: the configured AWS retention is 14 days. Internal Slack notifications follow the retention and deletion policy of the relevant enquiry, account or school record; workspace copies must also be reviewed and removed when no longer needed. Provider security data and app error reports are kept only while needed for security, investigation and support, subject to the relevant provider’s settings.
  • Automated database backups: the configured rolling retention is 7 days. Copies are restricted to recovery; separately retained recovery snapshots require their own review and do not justify indefinite storage.
  • Records required by law or for a specific dispute: retain only the necessary subset for the applicable legal period, restrict its use, then delete it.

The public website uses necessary Cloudflare security cookies when required, including cf_clearance when a security check is completed. Cloudflare may also run browser checks to distinguish people from automated traffic. The staff app additionally uses authentication cookies and a viademy_locale cookie for the language you select.

We currently enable no optional advertising or analytics cookies on the public website. Cookie preferences in the footer explains the current setup; it does not record consent or offer switches for categories we do not use. Security-cookie expiry depends on the configured protection, and app cookies follow the relevant session or preference expiry. You can inspect, remove or block cookies in your browser, although blocking necessary cookies may prevent security checks or sign-in.

Depending on the processing and legal basis, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. We do not use personal data for solely automated decisions with legal or similarly significant effects.

Email hello@viademy.com. We may ask for proportionate identity verification and normally respond within one month; any lawful extension will be explained. For school-controlled classroom records, contact the school first; we assist with requests where we act on its behalf. You may complain to the Czech Office for Personal Data Protection or another competent supervisory authority.

We update this notice when the service or its processing changes. The date above identifies this version. New purposes or optional tracking require a fresh assessment and any notice or consent required by law.