Privacy Notice
Effective: 13 July 2026 · Last updated: 17 September 2026 · Magyar
This is an English translation provided for information only. The legally binding text is the Hungarian version; in case of any discrepancy, the Hungarian version prevails.
This notice describes what personal data the Platytutor learning game (jatek.platytutor.hu) processes, for what purposes, and what rights you have in relation to it. The service is intended for a small circle of acquaintances, and we aim to process as little data as possible.
1. The data controller
- Name: Zoiros Ventures Kft.
- Address: 1125 Budapest, Zsolna utca 12. A. ép. Fsz. 3. ajtó
- E-mail (data protection matters): info@platytutor.hu
You can contact us with your data protection questions and requests at the e-mail address above. We have not appointed a separate data protection officer, as the size of the service does not make this mandatory.
2. What data we process
2.1. When you sign in (with a Google or Microsoft account)
You sign in with your Google or Microsoft account. When you sign in, we receive the following data from the provider you choose:
| Data | Example / description |
|---|---|
| Name | the display name shown in your account |
| E-mail address | the e-mail address associated with the account |
| Profile picture | for Google, a link to the account's public profile picture; for Microsoft, the account's profile picture (we receive and store the image file itself) |
| Account identifier | a technical identifier assigned by the provider |
| Age band | the age category indicated by the provider (e.g. whether the account holder is a minor), if the provider supplies one |
From these we create a user account on our server (name, e-mail address, profile picture link, account identifier, the time of registration and of your last sign-in, and the time you accepted this notice), and we also issue a sign-in credential (a so-called token) that is stored in your browser. We do not store the age band on the server; we use it solely to decide whether parental consent is required (see section 8).
2.2. While you play (data stored on our server)
- Game activity: which task you started and finished and when, the steps and result of your solution (correct/incorrect answers, timings), and badges earned.
- Chosen profile picture: if you choose a profile picture for yourself in the app.
- Submitted comments and bug reports: the text of your message and the time it was submitted, linked to your account.
- Voice message (voluntary feedback): if you share your opinion in a voice message at the end of a learning path, we record it and store it securely (to record, your browser asks for microphone access, which you may refuse at any time — feedback can also be sent in writing). Our aim is to convert the recording into text using automatic speech recognition (speech-to-text, STT), after which we keep only the text transcript and delete the audio file. Until we introduce this processing, we store the recording itself for no more than 30 days (see section 6).
Your game activity is used to produce the Statistics page (your own results and anonymous, aggregated data) and — where a parent link has been accepted — the progress report visible to your parent.
2.3. When a parent sends an invitation
When a parent invites their child, we store the data provided by the parent: the child's e-mail address, name/nickname, year of birth and school year (grade), together with the status of the invitation and the times consent was given (the parent's declaration and the child's acceptance). The parent can see the child's progress only after the child has accepted the invitation.
2.4. Data stored on your device (browser)
The game uses your browser's local storage (localStorage) for the following:
- Sign-in token: so that you do not have to sign in again every time you open the game. It contains the name, e-mail address and picture described in section 2.1, the role of your account (e.g. student, parent) and — if the account used to sign in supplied one — the age indicator.
- Session settings: e.g. which profile is currently playing on a shared device.
- Summary of recent game sessions: we also store a short performance summary of the last few tasks played in your browser, so that the game can give feedback more quickly; this is not separately uploaded to the server.
You can delete these at any time by signing out or by clearing your browser's storage for this site. You can request the deletion of your data stored on the server at the e-mail address given in section 1 (see also: Deleting your data).
2.5. Contact (partnership enquiries)
If you fill in the partnership/institutional enquiry form on our website, we receive the name, e-mail address, organisation name and message text you provide by e-mail, and we use them to get in touch with you. We do not store this data in a separate database, only in our correspondence.
Providing certain data is essential for using the service: you cannot sign in without a Google or Microsoft account; if the account used to sign in does not supply an age indicator, the system currently treats the account as an adult; a minor's account may play only with an accepted parent link (see section 8). If you do not provide the necessary data, or the conditions above are not met, we cannot provide the service, or part of it, to you.
3. What we use the data for and on what legal basis
| Purpose | Data processed | Legal basis (GDPR) |
|---|---|---|
| Signing in, maintaining the user account, showing the signed-in state | name, e-mail, profile picture, account identifier | necessary for providing the service — Article 6(1)(b) |
| Providing the learning experience, progress feedback, statistics | game activity (section 2.2) | necessary for providing the service — Article 6(1)(b) |
| Parental supervision: invitation, showing the child's progress to the parent | data provided with the invitation (section 2.3), the child's game activity | consent — Article 6(1)(a); for a child under 16, the parent's consent — Article 8 |
| Collecting voluntary written and spoken feedback to improve the learning experience | the text and/or voice message of the feedback (section 2.2) | consent — Article 6(1)(a); for a child under 16, the parent's consent — Article 8 |
| Producing a learning summary (AI analysis) of progress (see section 4, Anthropic) | a pseudonymised extract of game activity passed to the AI (this extract contains no name or e-mail — it is distinct from the game activity log under section 2.2, which is stored identifiably against your account) | consent — Article 6(1)(a); for a child under 16, the parent's consent — Article 8 |
| Sending invitation and system notification e-mails | e-mail address, name | necessary for providing the service — Article 6(1)(b) |
| Responding to partnership/institutional enquiries (section 2.5) | name, e-mail, organisation name, message text | legitimate interest in responding to your enquiry — Article 6(1)(f) |
| Anonymous visitor statistics (page views) | page view, referring page, device type — not linkable to your account | legitimate interest in understanding how the service is used — Article 6(1)(f) |
We do not carry out marketing, we do not display advertising, and we do not sell data. Producing the learning summary from your game activity qualifies as profiling, but it does not involve any automated decision that has legal effects on you (there is no automated decision-making within the meaning of Article 22) — the summary is for information only.
4. Who has access to the data (processors)
The data may be accessed by a few employees of Zoiros Ventures Kft. who are bound by confidentiality, solely to the extent necessary for operating the service and developing the learning content. In addition, we use the following external service providers for operation. They process data solely to the extent necessary for providing the service:
| Provider | Role |
|---|---|
| Google (Google Ireland Ltd.) | sign-in with a Google account |
| Microsoft (Microsoft Ireland Operations Ltd.) | sign-in with a Microsoft account |
| SMTP2GO | sending invitation, system notification and partnership enquiry e-mails |
| Anthropic | producing the learning summaries; receives only a pseudonymised extract of game activity, never names or e-mail addresses |
| Hosting server (own, on-site) | we currently operate the service on our own on-site server, on encrypted disks; the database and media storage also run here; technical logs (e.g. IP addresses) may be generated |
| Amazon Web Services (AWS) | not currently used; if in the future we move hosting partly or wholly to AWS, we will update this notice in advance |
5. Data transfers outside the European Union
Some of the providers above (Google, Microsoft, SMTP2GO, Anthropic) may also process data in the United States. These companies ensure an adequate level of protection on the basis of the EU–US Data Privacy Framework or the standard contractual clauses (SCCs) approved by the European Commission. We currently operate our server on our own on-site machine, on encrypted disks — this currently involves no data transfer outside the EU. If in the future we also use Amazon Web Services (AWS) for hosting, this section will be supplemented accordingly.
6. How long we keep the data
- Account data and game activity (on the server): for as long as your account exists — this data is the basis of the learning statistics and progress analysis, so we keep it until the account is deleted. You can request deletion at any time at the e-mail address given in section 1.
- Parent links: for as long as the accounts concerned exist, or until you request their deletion.
- Voice recordings (voluntary feedback): stored for no more than 30 days, then deleted (once the planned text transcription is introduced, only the transcript will be kept; see section 2.2).
- Inactive accounts: if you do not sign in to an account for 24 months, we delete the account and the data associated with it.
- Sign-in token and session settings: remain in your browser until you sign out or clear the storage.
- Application and technical logs (on the server and at the hosting provider): for no more than 30 days, for operational and security purposes.
7. Cookies and local storage
We do not use traditional third-party tracking (analytics or advertising) cookies. We monitor site traffic with a self-hosted, cookie-free measurement tool (Umami); it does not place cookies on your device, does not assign you a unique identifier, and we do not share its data with third parties. For signing in and for the game to work, we use your browser's local storage (localStorage), as described in section 2.4. In addition, when sign-in starts we set a short-lived (10 minute), technically necessary cookie for security purposes (to protect the sign-in against forgery) — under the law this does not require consent.
8. Children's data
Platytutor is primarily designed for children under 16. Under Hungarian rules, processing the personal data of a child under 16 requires the consent of a parent (guardian). The system helps enforce this as follows:
- if the Google or Microsoft account used to sign in indicates that its holder is under 18, sign-in is possible only with a parental invitation (to be on the safe side, we apply an age limit of 18, stricter than the statutory 16);
- when sending the invitation, the parent declares that they are the child's guardian and consents to the processing of the child's data — we record the time of this;
- the link is created (and the parent can see the child's progress) only if the child also accepts the invitation.
This protection depends on whether the account used to sign in supplies an age indicator: if the provider does not supply one, we cannot yet automatically identify the account as belonging to a minor, and we treat it as an adult. We are currently working to close this gap, so that we can ask for the year of birth ourselves where necessary.
If you believe that a child has provided data without your consent, please write to us and we will delete it without delay.
9. Your rights
You have the following rights in relation to your data:
- information about and access to the data processed,
- rectification (correction of inaccurate data),
- erasure (the “right to be forgotten”),
- restriction of processing,
- objection to processing based on legitimate interest,
- data portability,
- withdrawal of consent at any time (this does not affect the lawfulness of earlier processing).
You can manage the data stored on your device yourself: signing out and clearing your browser's storage removes it. You can also revoke Platytutor's access in the account settings of your Google or Microsoft account. You can request the deletion of your data stored on the server (account, game activity, parent links) at the e-mail address given in section 1. Detailed step-by-step guide: Deleting your data.
You can submit your requests to info@platytutor.hu. If you feel that the processing infringes your rights, you may lodge a complaint with the supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
(Hungarian National Authority for Data Protection and Freedom of Information)
1055 Budapest, Falk Miksa utca 9–11.
Postal address: 1363 Budapest, Pf. 9.
E-mail: ugyfelszolgalat@naih.hu ·
Web: naih.hu
10. Changes to this notice
We update this notice when necessary. Changes are published on this page, with the “Last updated” date above amended accordingly.
← Back to the home page