ZahoUpZahoUp

Privacy policy

Last update: 04/11/2026

1. Data we collect

  • When you create your account: email, password, first name and country, plus the version of the terms of use you accept. Nothing else. Your first name is used to address you; your country decides which opportunities you see and which payment methods are offered.
  • Full civil identity (last name, date of birth, gender, city): requested only if you start a process that produces a document naming you, such as a certificate or a verified profile sent to a company. You can use the platform without ever providing it.
  • Profile photo (one you add, or the one from your Google account if you sign in with Google, see “Sign in with Google or Apple”)
  • City, display language and course language you enter in your preferences
  • Your goal (growing in your job, succeeding in your studies or finding an opportunity) and your occupation, if you choose to give them. Your occupation is optional, and it is never asked for a child profile.
  • Voice recordings you make yourself to answer out loud (questions, interviews, exams, tests, describing a need) or to dictate a message to the assistant: they are transcribed into text to produce your written answer and to assess it, or to write your message, never for anything else
  • CV you choose to upload (attached to your applications, file kept private)
  • Levels detected per field (from the adaptive assessment)
  • Your learning history: chapters read, interviews, exams, challenges, revision sessions and their corrections, concepts to work on, skills and badges earned. To measure your command of each concept, every answer (revision question, daily challenge, interview, level assessment) also leaves a dated trace: the concept worked on, the result and the weight it can carry. These traces are tied to an internal identifier, never to your name.
  • Your conversations with the assistant: your messages, typed or dictated, the text taken from the photos and PDFs you attach (we do not keep the file) and the outline of the course you prepare together. A dictated message you never send is erased after 24 hours. The assistant also remembers what you tell it so that your courses fit you (your available time, your connection, your preferences): you can read and erase it under “Settings” on the website, in “What ZahoUp remembers about you”.
  • Documents and photos you upload to learn (syllabus, exam paper, answer sheet, thesis, article, document attached to a course request). We keep the file of a revision syllabus or of an exam paper. The syllabus of your whole year is the exception: we keep its file only while we read it (a few hours at most when the reading waits for your 5-hour window to reopen), then the text of each subject you add. For the others, we do not keep the file, only the text taken from it or its correction.
  • If you apply to a campaign or a job, or complete a micro-task: your answers, your recordings, your photos and your deliverables
  • If you pay (session with a tutor, certification): the amount, a reference and, for Mobile Money, your phone number. If you receive money (tutor, micro-task): your payout details, stored encrypted.
  • Push notification token (if you use the mobile app and accept notifications)
  • Sign-in data: each time you sign in, the IP address received and the type of browser or device, kept with your session

2. Sign in with Google or Apple

If you choose “Continue with Google”, we keep your email address, your first name, your last name and your Google profile photo, only to create or find your ZahoUp account. If you confirm your address with Google, we keep the email address of that Google account: it becomes the address of your ZahoUp account. Your first and last name prefill your profile: you can correct them at any time. Your photo stays hosted by Google and is displayed from its servers. We access nothing else in your Google account, and we never post on your behalf.

If you choose “Sign in with Apple” in the iPhone app, we keep only your email address, or the relay address Apple offers you.

3. Purposes

Data is used only to provide the service: adapting courses to your level, tracking your progress, suggesting relevant tutors and opportunities (including based on the location you declared), producing aggregate statistics, and keeping the platform secure.

4. Sharing

No data is sold. Here is who receives what, and why.

Our artificial intelligence provider: Anthropic (Claude). Its models write your courses, the answers of the Mentor and of the assistant, corrections, interviews and exams. It receives what you write, say or upload to learn: your questions, your course requests, your answers to exercises, exams and interviews, and the photos and documents you attach, in full. The syllabus of your year is sent to it in full, without its file name, a second time at most if its reading is cut short. What you say out loud reaches it once transcribed. When you talk to the assistant, what you type or dictate, your attachments and the outline of the course you are preparing (topic, goal, what you already know, level, pace) are sent to it so that it can answer you.

So that the answer fits you, it also receives part of what ZahoUp knows about your path, only where it helps (the Mentor, the assistant, writing your courses, interviews, challenges, corrections, mock interviews and mock defenses, critical reading): your goal, your occupation, your class, your country and language, your level, your progress in the course, the concepts to work on, your revision syllabus, the exam you are preparing for, the skills you have proven, the latest feedback you received, your project, the preferences you have given (available time, format, device, connection, interests) and, for a mock interview, the skills you are missing for the campaign you are aiming for.

When you open a conversation with the assistant in one of your projects, it also receives that project: its name, its goal, its field, the target level and the courses in your path with your progress (chapters completed, next step, final exam passed or not), without any identifier or score. The project also goes with every course in your path, for the Mentor and for writing those courses.

The documents you add to a project (a photo or a PDF) are sent to Anthropic to read their text: we keep that text, never the file, and its name is never sent. In a conversation in that project, the assistant receives the text of your most recent documents under a neutral label. You can remove a document at any time: it is then deleted, and all of them are deleted with your account.

Before anything is sent, ZahoUp removes your first name, your last name, your email address, your phone number and your account ID from it, even when you write them yourself in a message. The model only sees a placeholder instead, and ZahoUp puts the real value back in the answer shown to you. Your professional profile and a company’s interview guide are written without your name, which ZahoUp adds afterwards. Of your occupation, only the job title is sent: whatever follows “at” (your employer’s name) is cut. Of your class, only the level is sent, never the name of your school. From photos and documents, ZahoUp also removes, as far as it can, the information your device adds to them (where the photo was taken, device model, date, file author).

This removal has limits. It is automatic and can miss a rare case, such as a first name that is also a common word. It protects your identity, not that of the people you mention. And what is written on the page itself (your name on an answer sheet, the cover page of a thesis) is sent as is, since the model has to read the page.

Anthropic does not use what ZahoUp sends it to train its models: its API terms of use forbid it.

The other services that work for us:

  • ElevenLabs: turns what you say out loud into text. It receives your recording as is.
  • Brevo: sends our emails. It receives your email address, your first name and the content of the message (for a parent, the report about their child).
  • Expo, then Google or Apple: deliver the app’s notifications. They receive your device identifier and the text of the notification.
  • Cloudflare: stores your files (profile photo, CV, recordings, documents, exam photos).
  • PAPI: collects payments. It receives the amount, a reference and, for Mobile Money, your phone number. You enter your payment details on its page, not ours.
  • Google: sign-in, if you choose it, and audience measurement on the website, if you accept it (pages viewed, where visits come from, type of device). The measurement script is only loaded after you consent: before that, your browser doesn’t contact Google for measurement. Page addresses are sent without their parameters or identifiers, and pages with an access key (new password, email confirmation) are never measured.
  • Apple: sign-in, if you choose it on iPhone.

What other people see:

  • A company you apply to sees your name, your results and what you hand over to it: your verified profile (validated skills, badges), your CV if you uploaded one, your answers and your photos.
  • Your employer, if your account is linked to it, sees your profile and your CV.
  • Everyone: your professional profile, only if you make it public (it starts private); the verification page of your certificates, whose document shows your name; your tutor profile if you have one; the courses you choose to share.
  • The tutor who reviews your certification sees your exam file and the supervision photos.
  • Other learners may receive revision questions drawn from a syllabus you uploaded and, after our team has checked it, an exam paper you uploaded.

5. Child profile

Creation: the parent creates their child’s profile, with their first name, last name, class and a password. No date of birth, no email address of their own: the sign-in ID is derived from the parent’s address. A high school student can add their own address, which is used only to sign in and to recover their password.

What the parent sees: every week, in their space and by email, a report with their child’s first name and class, the number of sessions, the average score, the concepts worked on and the latest sessions with their score and date. They also receive an email after the first corrected session.

What the school sees: the first and last names of the students linked to its classes, never their email address, and never how a student works. It only reads a class dashboard with no names at all, which stays empty below 5 students.

What is sent to the artificial intelligence provider: what the child writes, says or photographs to learn, including their conversations with the assistant, their class syllabus, and a summary of their path (class, country and language, level, concepts to work on, the exam they are preparing for, skills earned, project, the preferences they have given). Their goal there can only be “succeed in their studies”, and no occupation ever appears. Their first name, last name and email address are removed before sending, with the same limits as for an adult.

6. Retention

Your data is kept as long as your account exists. Nothing is erased automatically after a set time, except in the cases below. The supervision photos of a certification are erased 90 days after the tutor’s decision, or after 180 days if the exam still has no decision. The syllabus of your year that you uploaded without adding its subjects is erased after 7 days, along with what was read from it. A message you dictated but never sent is erased after 24 hours. Your sign-in sessions are erased 30 days after they end, along with the IP address and device they keep (details below).

When you delete your account, it is immediate. Your identity, your sign-in ID and your CV are erased, along with your revisions, your practice, your answers to exercises and quizzes, your conversations with the assistant and what it remembered about you, your voice recordings (except those handed over with an application or an exam) and your sign-in sessions. Your certificates are revoked, your verified profile is no longer visible, and your tutor profile leaves the catalogue. Your learning traces lose their link to you at the same moment: those recorded while you were a minor (child profile or school student account) are erased, the others become anonymous, and the titles of the personal concepts in your syllabi are replaced with a neutral label.

Some data remains, with no link to your identity: your courses, your progress, your badges, your certification exams and your payment history, which the law requires us to keep (billing: 10 years). What you shared with the community, or already handed over to a company (applications and exams, with their recordings and photos, deliverables), stays in place. Your anonymised learning traces also remain: nothing links them to you any more, and a minor’s traces are never kept.

Your sign-in data (IP address, browser or device) is kept with each session, valid for 7 days, then erased 30 days after the session ends: at most 38 days after it was recorded. It is also erased with your account. The server’s technical logs keep only the most recent entries: older ones are overwritten as they go.

7. Mobile app: access to your device

The ZahoUp app only asks for access to your device at the moment you trigger the action concerned, and never in the background:

  • Photos: only when you pick an image: your profile photo, or a photo you attach to a question, a revision, an exam answer sheet, a course request, a deliverable or an application. We never browse your gallery.
  • Camera: when you choose to take a photo to attach, and for the optional photo supervision of certification exams. No picture is taken outside a photo you take or an exam you have started.
  • Files: only the document you pick (CV, syllabus, document for a course or a deliverable).
  • Microphone: only when you press the record button yourself to answer out loud. Listening never starts on its own, does not continue after you stop, and nothing is recorded in the background.
  • Notifications: if you accept them, for your learning reminders, your sessions, your payments and the opportunities that match your profile. You can turn them off at any time in the app settings.

The app does not access your contacts or your GPS location. No data is sold or passed on to advertising brokers.

8. Your rights

Deleting your account: you do it yourself, under “Settings” on the website and in the app, with “Delete my account”. Deletion is immediate and cannot be undone: your personal data is anonymized, and the proof already issued (badges, certificates) is no longer linked to your identity.

A child’s profile: their parent deletes it, from their parent space (“My children”), before deleting their own account. A child cannot delete their profile themselves. Deleting it also erases all their learning traces, with no anonymous copy kept.

Correcting your information: you can change your photo, goal, occupation, country, city and language yourself, from your account.

Any other request: to find out what data we keep about you, or to have something corrected that you cannot change yourself (your first name, last name or date of birth, for example), write to us at contact@zahoup.com.

9. Security

Hashed passwords (argon2), signed JWT tokens, encrypted communication (HTTPS), logged administrator access.