1. Who we are
Hanivo is a Chinese-language learning application and related website operated by Williams Caballero - CABALLERO WORKS, Software & Digital Products, a sole proprietorship based in Graz, Austria. Our full legal address is available in the Impressum.
Email: support@hanivo.app
Legal Notice: https://hanivo.app/imprint
This policy explains what personal data we process, the purposes and legal grounds, who may receive it, how long we retain it, and your rights. It covers the Hanivo app and related website and account services. Our Terms of Service deal with contractual use of the service; this notice is not a request for blanket consent.
2. Categories of information
Depending on how you use Hanivo, we may process:
- Account and authentication data: email address, Supabase authentication identifier, password authentication records managed by our authentication provider, login and session tokens, and necessary account security information. We do not need to store your plaintext password.
- Learning and account data: account-linked vocabulary and spaced-repetition progress, review/synchronization metadata, mock-exam attempts/results and history, applicable account settings and premium-content entitlements.
- Local device data: a separate Guest profile, downloaded content, local progress, some settings, dictionary history and authentication-session storage where applicable.
- Purchase and subscription data, once enabled: Stripe customer and transaction identifiers, products purchased, prices and currencies, payment/fulfillment status, subscription period, refunds and limited billing/accounting information. Stripe collects payment-card information directly in a hosted or otherwise properly configured payment flow; we do not intentionally collect full payment-card numbers or CVV/CVC on Hanivo servers.
- Legal and account-deletion records: the version and time of accepted Terms, and limited account-deletion request identifiers, states and timestamps.
- Technical and support data: IP addresses and request timestamps that may be processed by infrastructure providers for security, delivery and troubleshooting, and information you send to support@hanivo.app.
3. Guest mode and device storage
Hanivo permits supported learning without registration. Guest learning progress is primarily held in a device-local SQLite database. Some device preferences, dictionary history, installed-content information and sessions are kept in local application storage. Uninstalling the app or clearing its data can erase local progress.
Guest mode is not necessarily free of all network processing: requesting remote content, updates or legal pages may expose technical request information such as an IP address to service infrastructure. We do not describe Guest data as automatically backed up to a Hanivo account.
4. Registered accounts and synchronization
When you register, our authentication provider processes account credentials and identifiers necessary to create and secure your account. Hanivo uses Supabase services to store user-related cloud data and manage authenticated access.
For signed-in accounts, supported learning progress, exam records, authorization and synchronization state may be associated with the account and exchanged with Hanivo's backend. The Guest profile is kept separate from registered-account profiles. Some data remains local and is not necessarily synchronized.
5. Why we process data and our legal bases
The applicable legal basis depends on the operation:
| Processing purpose | Typical GDPR legal basis |
|---|---|
| Create and maintain a requested account; synchronize supported learning records; supply purchased features | Article 6(1)(b), performance of a contract |
| Secure authentication, prevent abuse, troubleshoot failures and protect services | Article 6(1)(f), legitimate interests in security and reliable operation, subject to balancing |
| Process orders, manage subscriptions, payments, refunds and entitlements | Article 6(1)(b); Article 6(1)(c) where mandatory records apply |
| Retain qualifying tax, invoice and other statutory records | Article 6(1)(c), legal obligation |
| Record agreement to contractual Terms and manage deletion requests | Article 6(1)(b), Article 6(1)(c) and/or Article 6(1)(f), as appropriate to the specific record and applicable law |
| Optional marketing, analytics or nonessential cookies, if introduced | Consent under Article 6(1)(a) where required, or another verified lawful basis where legally appropriate |
Providing data required for an account, subscription or purchase is necessary to deliver that requested service; without it, some features cannot be offered. Free Guest learning remains available without requiring account registration. We do not use contractual Terms acceptance as consent to unrelated processing.
6. Text-to-speech and pronunciation
Hanivo uses the device operating system's text-to-speech functionality for Chinese pronunciation, with a requested Chinese voice. Hanivo does not directly send pronunciation text to its own backend or a separate cloud speech API. The tested Android device successfully spoke Chinese without internet access. Other devices and installed speech engines may behave differently, including whether a selected operating-system voice needs a network connection.
7. Payment processing
Hanivo plans to use Stripe to process website purchases and subscriptions when paid checkout is enabled. Payment data may be processed by Stripe under its own privacy information at https://stripe.com/privacy. Hanivo may receive and retain the limited order, billing, transaction and subscription information needed to verify payment, grant access, support customers, refund purchases, prevent fraud and meet legal obligations.
We do not intentionally receive or store complete card numbers or card verification codes in our own application database. We will update this notice if Apple In-App Purchase, Google Play Billing or another provider is introduced.
8. Service providers and recipients
We use Supabase for authentication, database services, cloud synchronization, authorization, content delivery and related backend functions. Our primary Supabase project/database has been configured in Germany; this alone does not establish that every provider, log or subprocessor remains within the EEA.
We may share necessary information with payment processors, infrastructure and hosting providers, email/support providers and professional advisers where relevant; data may also be disclosed where legally required. Providers acting as processors must be subject to appropriate contractual protections.
We do not plan to sell learning profiles to data brokers or use advertising trackers in the initial app; any such material change would need a separate review and appropriate notices and controls.
9. Cookies, analytics and website storage
The mobile app uses device storage for functional purposes as described above. The Hanivo website may use strictly necessary technologies for essential functions such as sessions or secure checkout. Optional analytics, advertising cookies or similar tracking require an appropriate legal assessment and, where necessary, prior consent and a way to withdraw it.
10. Retention and deletion
We keep personal data only for as long as necessary for the purposes described or required by law, applying the following intended categories:
- Account and synchronized learning data: while the account is active, subject to applicable retention and deletion processes; normal confirmed account deletion initiates removal of the authentication account and associated personal cloud learning records.
- Device-local Guest data: generally remains until the user clears it, removes the app or resets the device; separately stored Guest progress is not deliberately deleted by the account-deletion workflow.
- Legal acceptance records: account-linked acceptance receipts normally follow the account deletion lifecycle; historical published legal texts are retained independently.
- Deletion request records: limited account identifiers, request status and timestamps are retained for as long as necessary to complete and document account deletion, then deleted when no longer required.
- Billing and tax documents: Austrian accounting and tax documents are generally retained for seven years from the end of the relevant calendar year. A ten-year retention period may apply to records subject to EU VAT One Stop Shop rules. Records may be retained longer where required for pending proceedings.
- Support requests and technical records: retained for the period necessary to resolve the request, protect the service or comply with legal duties, and then deleted or anonymized. Details depend on the relevant processing purpose and provider.
Deletion is available to registered users at Settings → Account → Delete account. The deployed workflow removes the account and associated cloud records, deletes the account-specific local profile and history, and returns the app to Guest when successful. It uses a deletion-request record to block stale synchronization. Where deletion is incomplete, administrative completion may be required. Data in backups and on offline devices may remain until the relevant storage or synchronization lifecycle permits its removal.
Account deletion does not by itself guarantee cancellation of a Stripe subscription; users must receive clear cancellation guidance and the operational workflow must be verified before paid launch. Limited legally required accounting records may remain after account deletion.
11. Security and international transfers
We use appropriate technical and organizational measures to protect personal data.
Our primary Supabase database is hosted in Germany. Some service providers may process personal data outside the European Economic Area (EEA). Where such transfers occur, we rely on the lawful transfer arrangements applicable to the provider and transfer, such as an adequacy decision or appropriate contractual safeguards. Information about the applicable safeguards can be requested at support@hanivo.app.
12. Your GDPR rights
Subject to the applicable conditions, you can request access, rectification, erasure, restriction, data portability and objection; you can withdraw consent for processing based on consent at any time without affecting past lawful processing. You may also have rights concerning decisions based solely on automated processing where applicable. We will not assume that every request can be refused merely because an account is active or previously purchased content exists.
Contact support@hanivo.app to exercise your rights. We may need reasonable identity verification. We respond within applicable GDPR time limits, normally without charge except where law permits otherwise. You may complain to a competent supervisory authority, including the Austrian Data Protection Authority, https://www.dsb.gv.at. You do not need to contact Hanivo first to lodge a complaint.
13. Children's privacy
Hanivo's supported Guest learning features can be used by younger learners without creating an account. The first-release product policy does not support account registration by children under 14. Users aged 14–17 may register only subject to applicable local law and age-appropriate safeguards. Purchases by minors may require parental or guardian involvement under separate rules governing contractual capacity.
Austria's GDPR age of 14 relates to consent for online services where consent is the legal basis; it does not automatically authorize every child account or purchase.
14. Changes to this notice
We may revise this Privacy Policy to reflect actual processing changes or legal requirements. We display the version and effective date, maintain relevant historical versions and provide appropriate notice for material changes. Privacy notices explain processing; simply continuing to use Hanivo is not a substitute for any consent the law separately requires.