Privacy Policy

Last updated: 13 June 2026

This policy explains what personal data Bolo (“we”, “us”) collects when you use heybolo.de, why we collect it, the legal basis under the EU General Data Protection Regulation (GDPR), and the rights you have. The data controller is the operator named in our Impressum.

1. Data we collect

• Account data: your name and email address, provided when you sign in with Google.
• Booking & session data: sessions you book, times, and which partner you are paired with.
• Speaking-exam data: audio from your practice sessions and AI mock tests, and the resulting transcripts and scores, used to generate your feedback report.
• Payment data: processed by our payment provider. We receive a record that a payment succeeded; we do not store your full card number.
• Usage & device data: basic analytics (pages viewed, actions taken, approximate device/browser) to improve the product.

2. Why we use it & legal basis

• To provide the service you signed up for — Art. 6(1)(b) GDPR (contract).
• To process payments and prevent fraud — Art. 6(1)(b) and (f) GDPR.
• To generate AI scoring and feedback on your speaking — Art. 6(1)(b) GDPR.
• To analyse and improve the product — Art. 6(1)(f) GDPR (legitimate interest).
• Where we ask for consent (e.g. some analytics) — Art. 6(1)(a) GDPR.

3. Service providers (processors)

We share data only with providers that help us run Bolo, under data-processing agreements:

• Stripe Payments Europe, Ltd. (payment processing)
• Google (Sign in with Google / OAuth)
• ElevenLabs & OpenAI (AI examiner voice and scoring)
• PostHog (product analytics)
• Vercel & Supabase (hosting and database)

Some providers may process data outside the EU/EEA; where they do, transfers are covered by Standard Contractual Clauses or an equivalent safeguard. We do not sell your personal data.

4. How long we keep it

We keep account and booking data for as long as you have an account. Practice audio and transcripts are retained for up to 30 days so you can re-review your feedback, and are then deleted automatically. Payment records are kept as required by tax and accounting law (generally up to 10 years in Germany).

5. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, or port your data, and to object to certain processing. To exercise any of these, email hello@heybolo.de. You also have the right to lodge a complaint with a data-protection supervisory authority.

6. Cookies & analytics

We use cookies that are strictly necessary to keep you signed in, and analytics to understand how the product is used. You can control non-essential cookies through your browser settings.

7. Changes

We may update this policy as the product evolves. The “last updated” date above always reflects the current version. Questions? Contact us at hello@heybolo.de.