Sapiverse Privacy Policy

Last updated: September 19, 2026 · Version: 3.0

Company being incorporated. This notice concerns sapiverse.com, its restricted areas, and its installable web application (PWA). It describes the data processed when you study, purchase a subscription, participate in Universes, or communicate with other users and support.

Reading this notice does not constitute consent to marketing. The Terms of Use govern the service; the Cookie Policy explains device use and tracking preferences.

1. Data controller and contact details

The data controller is Sapiverse S.r.l., a limited liability company being incorporated under Article 2331 of the Italian Civil Code, with its registered office in Italy and contactable at support@sapiverse.com (hereinafter “Sapiverse” or the “Company”). Before final registration in the Business Register, the founding partners act in the name and on behalf of the company being incorporated and are jointly and severally liable for the obligations undertaken.

No Data Protection Officer (DPO) has been appointed; any request or exercise of rights may be sent to the email address provided.

Controller’s provisional address: Milan (MI), postal code 20100, at the founding partners’ address. The full address is provided to data subjects on request and remains valid for formal communications until registration in the Business Register.

2. Data we process and its sources

• Registration and profile: first name, last name, email, username, password stored as a hash, email verification, and data supplied in the profile, such as date of birth, phone number, school, or educational institution. Display preferences, study area, selected Universes, and progress through the service introduction are also processed.
• Sign in with Google: identification and email verification data returned by Google for authentication. Your Google account password is not shared with Sapiverse.
• Study and results: questions viewed, answers, correctness, scores, times, interrupted or completed sessions, materials consulted, hint usage, learning path progress, levels, activity streaks, badges, challenges, leaderboards, and duels.
• Relationships and shared content: friend requests, connections between users, presence and last seen, Universe membership, owner or collaborator roles, uploaded materials, and their versions. In chat: messages, replies, attachments, display name, level, Star status, shared progress events, read receipts, blocks, and duel invitations.
• Moderation: reports, reasons, disputed content, actions, restrictions, and information needed to investigate abuse. Attachments may undergo format and security checks.
• Subscriptions: plan, trial or promotion, status, expiration dates, renewal, Stripe identifiers, and checkout, invoice, and payment events. Events returned by Stripe may contain contact and billing details and partial payment information. Card details for website purchases are entered on Stripe’s systems. For in-app purchases managed by Apple, we also process product and transaction identifiers, purchase and expiration dates, renewal or revocation status, and an identifier associated with the Sapiverse account; we verify signed transactions and subscription status with Apple. Apple handles payment without sharing full card details with Sapiverse.
• Support and feedback: requests, ratings, free text, optional cancellation reasons, and subsequent communications. A support message may be accompanied by account context, IP address, and browser information.
• Technical data and communications: IP address, browser, device, sessions, sign-in and security events, protected verification codes, email and cookie preferences, communication recipients, and delivery status.

Data comes from you, activities performed within the service, authentication and payment providers and, for friendships, chats or reports, users you interact with. Do not enter health data, identity documents, credentials or confidential information about yourself or others in free-text fields or shared spaces.

3. Why we use data

• Provide the account and requested features (GDPR Article 6(1)(b)): authentication, saving progress, learning paths, quizzes, statistics, friendships, chat, collaboration, and service-related support.
• Manage purchases (GDPR Article 6(1)(b)): plan activation, payment checks, trials, renewals, and cancellations. Tax requirements and other legal obligations are based on GDPR Article 6(1)(c).
• Protect the service and its users (GDPR Article 6(1)(f)): prevent unauthorized access, fraud, spam, and manipulation, enforce proportionate usage rules, handle reports, and protect rights in a dispute. The interests pursued are security, service integrity, and protection of the people involved.
• Evaluate and improve the service (GDPR Article 6(1)(f)): analyze faults, internal statistics, and feedback, limiting data to what is necessary. The legitimate interest is improving product quality and reliability; it does not replace the consent required for nonessential trackers.
• Send promotions and commercial follow-ups (GDPR Article 6(1)(a)): consent must be freely given, specific, and revocable. Accepting the Terms, opening an account, or a preset preference does not on its own constitute this consent.
• Enable nonessential technologies on the device: where present, they require consent under the Cookie Policy and applicable law. Cookie consent is separate from consent to promotional emails.

The data required for registration, authentication and payment enables the respective features to be provided: these features cannot be supplied without it. Optional information, feedback and promotional consent are not required to use the other available features.

4. What other users can see

The service includes social features. User searches and friendship areas may display first name, last name and username; profiles, leaderboards and duels display information about the identity shown and relevant results. Friends can see online presence and last access.

Chat messages and attachments are shared with users who access the Universe’s room; they are not private messages to support. Learning path progress events may also appear. Authorized owners and collaborators manage Universe materials according to their permissions. Avoid sharing information you do not want these recipients to see.

Deleting content from the platform does not allow you to withdraw copies or screenshots that others have already obtained. You can report unauthorized disclosures and ask for help.

5. Personalization, statistics and AI tools

Learning activities contribute to progress, exercise selection, challenges, leaderboards and performance indicators. Any pass probabilities are estimates based on available data: they are not official assessments and do not determine admissions, grades or access to educational institutions. This processing may constitute educational profiling; it is not intended to produce decisions with legal or similarly significant effects under Article 22 GDPR.

Materials may be produced and reviewed using artificial intelligence tools. The editorial workflow includes an integration with Anthropic: when used, the external service receives the source texts and instructions needed for the work. AI-assisted materials do not mean that user conversations are chats with an AI assistant. Any data included in materials remains subject to data protection rules and the rights of the people concerned.

6. Operational and promotional communications

Verification, access recovery, support, payment and relationship-management messages are operational communications. Commercial campaigns may distinguish recipients according to subscription status, trial status and previous communications, within the scope of the relevant consent.

You can withdraw marketing consent using the unsubscribe link in emails, the preferences available in your account, or by writing to support@sapiverse.com. Withdrawal does not affect processing already lawfully carried out or prevent necessary operational communications.

7. Retention and deletion

Retention depends on the purpose and category of data; closing an account does not result in blanket retention of all data for a further 24 months.

• Account, study, and relationships: retained to make the account and its history available; the deletion process removes linked application data and ends sessions, subject to the exceptions described below.
• Universes and shared materials: closing an account does not necessarily delete work shared with other members. Management may transfer to another member under the Terms; personal links are removed or updated as part of the deletion process.
• Chat: deletion removes the text from the conversation and may leave a deleted-message notice. Open reports and moderation evidence may require separate retention, with restricted access, to handle the case and protect the rights involved. Visible history is also subject to quantity limits.
• Support, feedback, and security: for as long as needed to handle the request, analyze the problem or abuse, and document the outcome; in a dispute, only as necessary to protect the relevant right and for the applicable statutory periods. Deletion in the application does not automatically delete copies of communications in support mailboxes.
• Accounting records: where legally required, for the period prescribed by law, normally ten years. This period does not automatically apply to every technical payment event.
• Marketing: until consent is withdrawn or the purpose ends; evidence of choices and information needed to honor an unsubscribe request may be retained separately for that purpose and to document the lawfulness of messages sent.
• Cookies and browser storage: according to the periods and criteria in the Cookie Policy. Deleting your account does not automatically clear all storage on your device.

Any backups and data retained by providers follow their respective deletion cycles and applicable obligations. Information retained for legal, security or dispute-related reasons must not be reused for incompatible purposes. You may request the period or criterion that applies to a specific category of data.

8. Recipients, providers and transfers

Data is accessed by authorized personnel responsible for administration, support, security, moderation and content management, within the limits of their duties. Provider categories include hosting and infrastructure, databases and storage, email delivery, authentication, payments and delivery of web resources.

The service integrates with Stripe for website payments, Apple for in-app purchases on iOS, and Google for sign-in and YouTube content; some pages request resources from Google Fonts and external CDNs. App-specific information, including authentication and notifications, is also described in the Sapiverse app privacy notice. Shared messages and attachments also require storage services. Editorial work with AI may involve Anthropic as described above. Not all these providers are involved in every visit or activity.

Providers processing data on behalf of Sapiverse must act under the agreements required by Article 28 GDPR; their own privacy notices also apply to activities they perform as independent controllers. Data may be disclosed to advisers and authorities where necessary to comply with legal obligations or protect rights.

When a service involves transfers outside the European Economic Area, the conditions set out in Articles 44 et seq. of the GDPR must be met, such as an adequacy decision applicable to the recipient or standard contractual clauses with the necessary assessments and measures. You may request details of recipients, countries involved, and information on or a copy of the applicable safeguards at support@sapiverse.com.

9. Minors

The service is intended for people aged 14 or over. Minors must use it with authorization from a person with parental responsibility, as set out in the Terms. In Italy, the ability to independently give certain privacy consents from age 14 does not confer the capacity to independently enter into any contract or subscription.

If you are a minor, avoid posting your phone number, address, documents or confidential information in chats and materials. A parent or guardian may contact us to report an underage account or request help exercising rights, respecting the minor’s rights and subject to verification of their authority.

10. Security

The service uses password hashing, authentication and authorization controls, email verification, abuse limits and security event logging. Sessions may be revoked to protect the account. No system eliminates every risk: keep your credentials safe and report suspicious access or content.

Personal data breaches are handled in accordance with the GDPR’s assessment, notification and communication obligations.

11. Your rights

In the cases provided for in Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and portability; you may object to processing based on legitimate interests on grounds relating to your situation and, at any time, to direct marketing, including related profiling. You may withdraw consent without affecting the lawfulness of earlier processing.

Write to support@sapiverse.com, stating your request. A response will be provided within one month of receipt; if necessary due to the complexity or number of requests, this period may be extended by a further two months, with notice and reasons given within the first month. Any identity checks will be proportionate.

You may lodge a complaint with the Italian Data Protection Authority or the competent supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement, and seek a judicial remedy.

12. Updates

This notice is updated when processing or the service changes. Significant changes are communicated through appropriate channels. Publishing an update does not replace obtaining new consent where required and does not retroactively authorize different processing.