ONE AND A PRIVACY

VERSION 1.3 · EFFECTIVE 27 JULY 2026

This notice covers the public beta waitlist and the one&a beta practice app.

1. Who controls your data

Controller: GoSchool-AI Kft.
Registered office: 1121 Budapest, Ordas köz 2., Hungary
Company registration: 01-09-433985, registered by the Company Court of the Metropolitan Court
Tax number: 32622922-2-43
Privacy contact: arpad.tamasi@gmail.com

2. Beta waitlist

When you join, we store your email, phone platform, practice focus, experience level, whether you have a practice pad, and your current and target daily practice time. We also store the source, the Privacy Policy and Beta Terms versions you accepted, your 16+ confirmation, decision timestamps, the last update and the expiry date. We do not ask for your birth date or identity document.

We use these details to operate the waitlist, understand platform demand, select suitable beta testers and send the beta invitation you asked for. The legal basis is taking steps at your request before entering into the beta agreement (GDPR Article 6(1)(b)). The audit fields are kept for accountability and legal claims (our legitimate interest, Article 6(1)(f)). The form cannot be submitted without the required details.

Optional updates

Product news and general beta updates are separate and optional. We send them only if you tick the marketing box (consent, Article 6(1)(a)). The box is not pre-selected and saying no does not affect your waitlist place. You can withdraw at any time by emailing us or using the unsubscribe route provided with a message. Withdrawal does not affect earlier lawful processing. We may retain only a one-way hash of an opted-out address so it is not added to marketing again.

Optional landing analytics

If you accept Analytics on the landing page, Google Analytics for Firebase / GA4 measures waitlist-funnel events such as page view, call-to-action clicks, form start, validation error, submit attempt, success or failure, demo interaction and FAQ product-link clicks. We send only controlled event metadata: UTM fields, referrer origin, sanitized page path, device platform, selected form categories and the analytics-consent version, time and id. We do not send your email address, your free-text practice answer or advertising identifiers. The legal basis is your consent (Article 6(1)(a)). Rejecting Analytics does not affect the site or waitlist.

3. Beta app

If you receive access, we process the account details supplied through Firebase Authentication; your practice plans, sessions, takes, hit timing and dynamics, scores, coach/developer feedback and related technical records. During a take, the microphone records only while the take is running. We keep the raw WAV with the measured take during the beta so measurement issues can be diagnosed. This is necessary to provide the service you requested (Article 6(1)(b)); reliable measurement and security diagnostics are also our legitimate interests (Article 6(1)(f)).

If you use voice control, the short command audio and text are sent to the OpenAI API for speech recognition, command interpretation and speech output. API business data is not used to train OpenAI models by default. We do not use your waitlist answers with OpenAI.

We keep two technical logs tied to your account. The AI usage log records the cost signals of each AI call (kind of call, model, tokens, seconds or characters) so we can track and cap beta spend. The assistant call log records the calls your AI coach makes to our server: which tool, its arguments, whether the call succeeded, a one-line excerpt of the reply, and a one-sentence summary the assistant itself writes of what you asked for and what it was trying to achieve. Your conversation with the assistant does not reach our server — only the assistant's own summary of it. We use these to run the beta within budget and to see which requests the product fails to serve (Article 6(1)(f)). They are stored in Firebase in the EU region and are not used for advertising or profiling.

4. Processors and international transfers

Google Cloud / Firebase provides Hosting, Firestore, Storage and Authentication, and Google Analytics for Firebase / GA4 if you consent to landing analytics. Our Firestore database is in the eur3 EU multi-region and the storage bucket is in the EU. Some Firebase support, analytics and global services may also process data outside the EEA under Google's data processing terms and transfer safeguards.
Google (Firebase Crashlytics) receives a crash report if the beta app crashes: the error and stack trace, device model, OS version, free memory and storage, a Crashlytics install identifier and the client IP. We do not deliberately tag reports with your account id, but a report can contain a pseudonymous user identifier: your account id is part of the storage path of your take recordings, so it may appear inside an error message that is sent with the report — for example when a take upload fails. Crashlytics offers no EU region, so this data is processed outside the EEA under Google's data processing terms and transfer safeguards. Legal basis: legitimate interest (Article 6(1)(f)) in keeping the beta working. It is collected only in release builds and is never used for profiling or advertising.
OpenAI Ireland Ltd. and its subprocessors process only beta-app voice commands. Processing outside the EEA may occur under the OpenAI Data Processing Addendum, Standard Contractual Clauses and other applicable safeguards.
Resend delivers the waitlist confirmation email to you and an internal notification of your signup to us. It processes your email address, and — for the internal notification — the answers you gave on the form, only to send these messages. Resend processes this data in the EU (Ireland). Legal basis: performing the beta signup you requested (Article 6(1)(b)) for the confirmation email, and our legitimate interest (Article 6(1)(f)) in managing beta invitations for the internal notification.

Current provider details are available in the Firebase privacy information, the OpenAI subprocessor list and Resend's legal terms. We do not sell personal data.

5. How long we keep data

Waitlist records expire 12 months after the latest submission or update and are then automatically deleted, normally within 24 hours. We delete sooner if you ask or the waitlist closes and the record is no longer needed.
GA4 event-level data retention is configured to 2 months. We keep Google signals, advertising personalization and ad-user-data features off.
Account and practice data are kept while your beta account is active and needed to provide and diagnose the beta, or until you ask us to delete it, subject to a legal retention duty.
OpenAI may retain API inputs and outputs for abuse monitoring for up to 30 days unless a different approved retention control applies.

6. Your choices and rights

You can ask for access, a copy, correction, deletion, restriction or portability of your data; object to processing based on legitimate interest; and withdraw marketing or analytics consent. Email arpad.tamasi@gmail.com from the registered address or complete our reply verification. You can also withdraw landing analytics from the Analytics settings control on the site. We normally respond within one month and do not routinely ask for identity documents.

You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9-11.; naih.hu) or another competent supervisory authority. There is no decision based solely on automated processing that produces legal or similarly significant effects for waitlist applicants.

7. Security, cookies and changes

We restrict production access, use encryption in transit and provider encryption at rest, and keep operational access logs. Firebase Hosting may process ordinary request metadata needed to deliver and protect the site. The landing does not load Google Analytics before you accept Analytics. If you accept, GA4 may set analytics cookies such as _ga; advertising storage, ad user data and ad personalization stay denied. If you reject or withdraw, the site remains usable and we stop further analytics measurement.

If we materially change the purposes, providers or your choices, we will publish a new dated version before the change takes effect and, where required, ask again for consent.