Privacy Policy
1. Controller
Oppimaa Oy, Business ID 2427713-5, Mikonkatu 25 A, 00100 Helsinki, Finland. Contact: support@vergentapp.dev.
2. Children's information
Vergent is training material. You are meant to practise with imagined or general situations, and the fields are written to be filled in generally: the age is always a band (0–2, 3–5, 6–12, 13–17) and the tools ask about a type of situation, not about a person. When you accept the terms of use you agree not to enter a name or any other detail that identifies a child or a family.
Vergent is built so that information about children is not stored. What you write into the forms and tools stays in your browser while you work and disappears when you close the tab; PDFs are created in your browser. We do not store the text you write or the result you get back. The only exception is the certificate reports, which you write about an imagined child (section 3).
When you use an AI tool, the text you wrote is sent to our server. The server runs an automatic filter that removes the names and identifiers it recognises (for example names, places, phone numbers) before the text is sent to the AI model. The filter cannot catch everything — it is a safety net for mistakes, not a reason to write about an identified child. Text with identifiers removed can still be personal data in some cases, which is why this processing is described here and in section 5.
The assessment forms are for practice too: complete them for an imagined child, or describe the situation so that no one can be recognised. If you assess a real child at your workplace, do it on your employer's own forms; in that work your employer is the controller and Vergent receives none of that information.
The self-assessment and the Skills Passport are meant to be used with a child, but they work entirely in your browser: nothing entered in them is sent to us, and their PDFs are created on your device.
3. What we collect
- Account: your name, email address, a protected form (hash) of your password, and the language and country you choose for Vergent (the country decides which local support services the AI tools mention).
- Purchases and access: what you bought, when, the price, your payment plan and its payments, when you accepted the terms, and the customer and payment references from Stripe. We never see your card details.
- AI credits: how much of your AI credits you have used each month. A separate anonymous log of AI runs (the day, the tool, the cost) contains no user or content.
- Learning: your progress in Neurodivergence basics and which guides you have seen.
- Certificate: the reports you write for the certificate and their saved drafts, the assessment and feedback on them, the name you give for the certificate, and the certificate's number and date. Our team assesses the reports with the help of the AI model (section 5), and a person reads every report that needs revising.
- Public review: if you choose to leave one after you have received the certificate: the number of stars and your text, the name and role you want shown with it, your country and, if you add one, a photo of yourself. Your browser makes the photo smaller and removes its hidden details, such as the location, before sending it. With the review we receive your account email, the certificate number, your language and the time you gave your consent. The review reaches our support mailbox by email; Vergent itself keeps only the time it was sent.
- Messages: what you send us by email, and feedback you send about the learning questions.
- Technical data: our servers record requests (IP address, time and the page address without its parameters) for security and to find errors, and keep these records for 14 days. Failed sign-ins are counted per account for one day, to slow down password guessing.
- Advertising measurement: only if you allow advertising cookies: on our public front page the Meta Pixel and our server record visits and the opening of the purchase window, and our server reports a completed purchase and its price (section 10).
4. Why and on what basis
- To provide Vergent, your account, access and payments — to perform our contract with you.
- To keep accounting records of sales — a legal obligation.
- To keep Vergent secure, prevent misuse and improve it with anonymous statistics — our legitimate interest.
- To send you service emails (the welcome email, password links, access confirmations and a reminder before your access ends). We do not send marketing without your permission.
- To measure our advertising on Meta's services with the Meta Pixel and Meta's Conversions API — only with your consent, which you can withdraw at any time (section 10).
- To publish your public review with your name, role, country and photo on our website and in our marketing — only with your consent, which you give when you send the review and can withdraw at any time by emailing support@vergentapp.dev.
5. AI processing
The AI tools use a language model provided by SpaceXAI LLC (x.ai, the maker of Grok), based in the United States. Only the text of the request, with names and identifiers removed by our server, is sent to it. The model does not answer freely: it is given a set of strategy cards drawn from our interviews with practitioners and specialists, and it builds its answer from those. The answer is written by the model, and Vergent marks it as AI-generated.
SpaceXAI processes the requests on our behalf under its Data Processing Addendum, which is part of its enterprise terms, and the requests are not used to train its models. We use its zero data retention setting, so the requests and answers are not stored on its side after processing. The transfer to the United States relies on the EU standard contractual clauses included in that Data Processing Addendum.
6. Dictation
You can dictate into text fields with your browser's speech recognition. Your browser sends the audio to its maker's speech service (for example Google for Chrome, Apple for Safari) under that company's terms. Vergent does not receive or process the audio; the recognised text goes into the field like typed text. Dictation is optional.
Vergent shows this before your first dictation and asks you not to speak names. Because the audio goes to your browser's maker and not to us, we cannot filter it — the recognised text is filtered like typed text only after it is in the field and you send it to an AI tool.
7. Service providers
- Stripe (Stripe Payments Europe, Ltd., Ireland) — payments. Stripe is also a controller of payment data under its own privacy policy.
- Brevo (Sendinblue SAS, France) — sending our emails, including a public review to our support mailbox.
- SpaceXAI (SpaceXAI LLC, USA) — the AI model (section 5).
- Hetzner (Hetzner Online GmbH, Germany) — our servers, located in Helsinki, Finland, and our encrypted backups.
- Meta (Meta Platforms Ireland Limited, Ireland) — the Meta Pixel and the Conversions API, only with your consent (section 10). For the data the pixel collects on our pages, we and Meta are joint controllers; Meta's own use of it is governed by Meta's privacy policy, and Meta may transfer it to the United States under the EU–US Data Privacy Framework.
8. How long we keep data
- Account (including your language and country), AI credit balance, learning progress and certificate reports: until you delete your account.
- When you delete your account, we delete your name, email, password, language and country, credit balance, learning progress, certificate reports and certificate. Purchase records stay without your name and email for accounting, for six years from the end of the financial year, as the Finnish Accounting Act requires. Stripe keeps its own payment records. The purchase records keep Stripe's references for the payment (customer, payment and subscription numbers), which point to Stripe's own records.
- Public review: until you withdraw your consent or we stop using it. When you withdraw it, we take the review off our website, stop using it in our marketing and delete the email. Deleting your account does not remove a review you have already sent — email us and we will remove it.
- Meta Pixel cookies: up to 90 days (section 10). For a purchase, the details the purchase event needs (your IP address, browser and Meta's cookie identifiers) are kept on our server until the payment is confirmed, for at most two days.
- Password links expire after 7 days (a password reset link after 24 hours) and work only once.
- Backups: the database is copied every night, encrypted, and each copy is kept for at most 30 days. Data you delete therefore leaves the backups within 30 days. A backup is used only to restore the service after a failure.
- Feedback about the learning questions: kept to improve the questions. If you delete your account, it stays without anything that links it to you.
- Server records (section 3): 14 days.
9. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, and to receive your data in a portable form. You can delete your account yourself in Settings; for anything else, email us. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or the authority of your own country.
10. Cookies and browser storage
Vergent uses cookies that the service needs: one keeps you signed in (30 days), one remembers the language you chose (one year), and one remembers your cookie choice (180 days). Your browser's storage keeps similar settings, and the forms you are working on until you close the tab.
If you allow advertising cookies, we use the Meta Pixel on our public front page to measure our advertising on Facebook and Instagram. It sets the cookie _fbp and, when you arrive from a Meta ad, _fbc (both last 90 days). The pixel and our server (Meta's Conversions API) send Meta the same events — a visit to the front page and the opening of the purchase window — with the page address, your IP address, technical information about your browser and the two cookie identifiers. When you buy Vergent, our server reports the purchase and its price once Stripe has confirmed the payment. We never send Meta your name or email, and nothing is sent from inside Vergent, where you use the tools. Without your permission none of this happens. You can change your choice at any time with the Cookie settings link at the bottom of the front page.
11. Security
Connections and backups are encrypted, passwords are stored only in a protected (hashed) form, and access to data is limited to what is needed to run the service.
12. For organisations and their data protection officers
An organisation that buys Vergent for its staff buys training. Each professional uses Vergent with their own account, and Oppimaa Oy is the controller of that account data. Professionals practise with imagined situations, or situations from their work described so that no one can be recognised, and they agree not to enter information that identifies a child; the self-assessment and the Skills Passport work entirely in the browser. Vergent is therefore not a system for processing information about the children your organisation works with, it does not store such information, and no data processing agreement is needed: text sent to the AI is stripped of the names and identifiers our filter recognises and is not stored.
13. Changes and contact
We update this policy when the service or the law changes and tell you about significant changes. Questions: support@vergentapp.dev · Oppimaa Oy, Mikonkatu 25 A, 00100 Helsinki, Finland.
This policy is published in English and in the other languages of Vergent. All language versions are equally valid, and we keep their content the same.