Privacy Policy
This Privacy Policy describes how Vivoki Inc. ("Vivoki", "we", "us", or "our") collects, processes, stores, and protects personal information when you use the Vivoki Platform.
Effective Date: November 9, 2026 · Version 2.0
1. Overview
Vivoki is an AI readiness and workforce diagnostic platform operated by Vivoki Inc. Our platform is designed exclusively for professional educational and workforce development purposes. We are committed to handling personal data with transparency, accountability, and integrity, consistent with globally recognised data protection frameworks including the General Data Protection Regulation (GDPR), Canada's PIPEDA, Quebec Law 25, and other applicable national data protection statutes.
We do not engage in the sale of personal data. We do not engage in unlawful profiling, discrimination, or data practices that would contravene applicable law. All data collected exists solely to deliver, improve, and secure the educational service you access through this platform.
2. Data We Collect
We collect only the data necessary to provide and improve the Vivoki platform, adhering strictly to the data minimization principles of Canada's PIPEDA. This includes:
Account Information
Your name, email address, and encrypted password credentials. If you choose to sign in using the Google button, we receive your name and email address from your Google profile with your explicit permission. We never access, handle, or store your Google password.
Assessment & Learning Data
Your responses to assessment questions, score achievements, competency classifications, and progress across learning modules. This data is essential to generate your personalized AI readiness profile, track completion status, and award credentials.
Open-Ended Response Text
Certain assessment questions invite a written text explanation. These responses are evaluated by automated Artificial Intelligence educational engines against standardized scoring rubrics. Your written text is processed solely for scoring and educational feedback.
Voice Interaction Data (Educational Assistant)
If you choose to use the interactive voice feature, speech processing is handled locally within your web browser. Audio recordings are not permanently stored on our servers. Only the transcribed text of your question is used to generate instructional responses.
Technical & Security Logs
Device category, browser family, operational timestamps, and encrypted network session identifiers used exclusively for security monitoring, fraud prevention, and session stability. We never build individual behavioral profiles for advertising or commercial resale.
3. How We Use Your Data
We process collected data only for specific, identified educational purposes in accordance with Canadian fair information principles:
- 1To authenticate your identity and maintain secure access to your account.
- 2To administer assessments and calculate your AI readiness competency scores.
- 3To generate personalized learning paths and module recommendations.
- 4To issue, verify, and digitally validate certificates of completion.
- 5To provide interactive AI-assisted tutoring and instructional support.
- 6To safeguard the security, confidentiality, and integrity of the platform.
- 7To fulfill compliance, auditing, and Canadian legal requirements.
- 8To communicate critical educational notifications and account notices in compliance with CASL.
We do not use your assessment responses, scores, or learning records for any commercial marketing purposes.
4. AI Educational & Evaluation Services
Transparency Disclosure on Automated Evaluation
In accordance with Canadian privacy guidelines on automated systems, portions of this platform utilize automated Artificial Intelligence tools to assist in scoring written assessment responses and delivering real-time tutoring guidance.
When you submit an open-ended assessment response or interact with the educational assistant, the written text of your response is securely analyzed by our automated evaluation service to generate constructive feedback and score alignment against pre-established rubrics.
We never transmit your personal contact details, password credentials, account numbers, or private profile information to external analysis engines. Only the educational text you directly submit in the prompt box is processed.
All automated evaluation providers operate under strict enterprise confidentiality and data privacy agreements. These agreements strictly prohibit our educational partners from using your text inputs to train public or commercial AI models.
Human-Governed Evaluation Criteria
In accordance with Canadian governance expectations, all scoring thresholds, competence tiers, certificate requirements, and badge recognitions are governed by deterministic application rules established by human educators. Automated tools evaluate written responses against fixed rubrics, and no autonomous decision is made without transparent, predefined scoring guidelines.
5. Data Retention
We retain personal information only as long as necessary to fulfill the purposes for which it was collected, adhering to Canadian data retention standards:
| Information Category | Retention Period |
|---|---|
| Account credentials & profile | Retained while account remains active; deleted upon verified request |
| Assessment responses and competency scores | Retained for the lifetime of your account to maintain retake history and credential validity |
| Educational assistant dialogue logs | Temporary session duration only; not stored in persistent learning records |
| Interactive speech audio | Processed in browser; zero persistent server audio storage |
| Security access logs | Up to 90 days for operational safety and fraud prevention |
| Digital Certificates & Verified Badges | Permanently associated with your verified credential ID for third-party verification |
Upon an account closure request, your personal identifiers are removed from active production systems within 30 days. De-identified, aggregated benchmark statistics may be retained for longitudinal research and educational standard benchmarking.
6. Your Rights Under Canadian & Global Privacy Laws
Under Canadian federal legislation (PIPEDA), provincial acts (Quebec Law 25, Alberta PIPA, BC PIPA), and international frameworks, you possess comprehensive rights over your personal data:
Right of Access
Request a copy of the personal information we hold about you and how it is processed.
Right to Rectification
Request correction or updating of any inaccurate or incomplete personal records.
Right to Erasure & Deletion
Request permanent deletion of your account and associated personal data.
Right to Withdraw Consent
Withdraw your consent for optional communications, cookies, or processing at any time without penalty.
Right to Automated Decision Transparency
Request explanations regarding any automated scoring or evaluation criteria used in assessments.
Right to Recourse
Lodge an inquiry or complaint with the Office of the Privacy Commissioner of Canada (OPC) or your provincial authority.
To exercise any of these rights, contact our Privacy Officer at privacy@vivoki.ai. We respond to all verified requests within 30 days at zero charge.
7. Security & Safeguards
We maintain comprehensive physical, organizational, and technological safeguards proportional to the sensitivity of educational records, meeting Canadian public sector expectations:
- End-to-end transport layer encryption for all web sessions using modern high-grade TLS protocols.
- Account passwords protected using salted, one-way cryptographic hashing algorithms — plaintext passwords are never stored.
- Strict role-based access controls ensuring only authorized personnel have access to administrative tools on a need-to-know basis.
- Certified cloud hosting facilities equipped with 24/7 security monitoring, automated firewalls, and encrypted backups.
- Formal data processing agreements with all supporting service providers enforcing strict confidentiality.
In the unlikely event of a security incident affecting your personal information, we will notify you and relevant privacy commissioners in full compliance with Canadian mandatory breach notification requirements.
8. Supporting Service Providers
We collaborate with carefully selected infrastructure and service partners to operate the platform securely. Each partner is bound by binding confidentiality agreements and data protection standards:
| Sub-Processor & Provider | Operational Purpose | Data Categories Handled |
|---|---|---|
| Supabase Inc. (USA / AWS) | Authentication, encrypted credential storage, relational database & secure progress records | Work email, encrypted password hash, unique account UUID, evaluation scores |
| Google LLC (USA) | Single Sign-On (Google OAuth) identity verification for users choosing this sign-in option | Account display name and verified email address (read-only with your explicit consent) |
| Groq Inc. (USA) / Local Piper TTS | AI support assistant conversational reasoning and localized voice synthesis | User support chat messages only; zero contact details or assessment records |
| DigitalOcean LLC (USA / Canada) | High-availability application infrastructure hosting, compute, and encrypted backups | Encrypted application payloads and TLS network connections |
We do not sell, rent, or share personal information with third-party advertisers, data aggregators, or marketing networks under any circumstances.
10. Children's Privacy
The Vivoki platform is intended exclusively for professional users aged 18 and above. We do not knowingly collect or process personal data from individuals under the age of 18. If you believe a minor has registered on this platform, please contact us immediately at privacy@vivoki.ai and we will take prompt action to remove that data.
11. International Data Transfers
Your data may be processed in countries outside your home jurisdiction, including the United States, where our infrastructure and LLM service providers are based. We ensure that such transfers are conducted under appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable.
- Adequacy decisions where they exist.
- Binding data processing agreements with all international service providers.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. When we make material changes, we will notify registered users by email and update the "Effective Date" at the top of this document. Your continued use of the platform after the effective date of a revised policy constitutes your acceptance of the updated terms.
13. Contact
For any privacy-related queries, requests, or concerns, please contact our data team:
If you are located in the European Economic Area and believe we are not handling your data in compliance with GDPR, you have the right to lodge a complaint with your national supervisory authority.