Privacy Policy

Last updated: 2026-04-21

This policy tells you what personal data we collect when you use Appreso, why, who we share it with, and what you can do about it. We've tried to write it the way we'd want to read it — in plain English, without lawyerly padding.

1. Who we are

Appreso is run by Tumbric Ltd (company number 16113823), with its registered office at C/O Accounts and Legal, 81 King Street, Manchester, M2 4AH, United Kingdom. We are the data controller of your personal data. Our ICO registration reference is ZC129223.

Email: privacy@tumbric.com.

2. What personal data we hold

We keep what we need to run Appreso for you, and not more:

Account data — your email address, your name if you've given us one, the identifier your sign-in provider returns (for example, your Google user ID), your country of residence, and a record of which Terms and consents you accepted and when.
Your content — anything you create, type, record, upload, or otherwise submit while using Appreso, and any edits you make to it.
Usage data — events we log while you use Appreso, along with basic device and browser information and your IP address, for security, analytics, and troubleshooting.
Billing data — none right now; there are no paid tiers. When we add them, a third-party payments provider (the "seller of record") will handle your payment details and pass us limited information such as country and tax status.
Support correspondence — anything you send us through in-app feedback or by email.
Cookies and local storage — essential items used to keep you signed in and the service working.

3. How we collect it

Directly from you when you sign up, use the service, change your settings, or contact us.
From your sign-in provider — currently Google Sign-In; we may add others.
Automatically as you use Appreso — the usage data described above.

4. Why we use it, and our legal basis

We process the data above for the following purposes, relying on the following legal bases (UK/EU GDPR terminology):

Running the service — signing you in, and operating Appreso's features for you. Contract performance.
Managing your account. Contract performance.
Payments, once paid tiers exist, and keeping required records of them. Contract performance, and legal obligations such as HMRC tax records.
Product analytics and reliability monitoring, including event logs and basic technical diagnostics to spot bugs and quality issues. Our legitimate interest in keeping the product working well. You can object.
Using data from your use of Appreso to improve the product and its AI systems, including content you create, study conversations, voice transcripts, voice recordings, feedback, and technical diagnostics, as examples, evaluation data, synthetic-data sources, or training/fine-tuning inputs. Your consent, opt-in in Settings, which you can withdraw at any time.
Research invitations for optional interviews, surveys, or usage studies. Your consent — off by default.
Sending product updates or promotional emails. Your consent — off by default.
Automated experience capture to spot confusing, slow, or broken app experiences. Your consent — off by default.
Keeping the service secure and preventing abuse. Our legitimate interest in a safe service.
Complying with the law. Legal obligation.

You are interacting with an AI system when you use Appreso's AI-powered features. The EU AI Act asks us to tell you that. The AI is not making any legally significant decisions about you.

5. Who we share it with

We use third-party processors to run Appreso. They act on our instructions under a contract with data-protection terms. The current list is below; we will update it from time to time, and the live list is always here.

Google — Authentication and database hosting (Firebase), AI generation (Gemini API), and server-side tracing (Cloud Trace). Processed in US. Privacy policy.
OpenAI — AI generation and grading, voice (Realtime API), and speech-to-text transcription. Processed in US. Privacy policy.
Anthropic — AI generation and grading via the Claude API. Processed in US. Privacy policy.
Vercel — Application hosting. Processed in US. Privacy policy.
PostHog — Product analytics events and, if you opt in, automated experience capture including session replay. Processed in US. Privacy policy.

We do not sell personal data and will not. We may share information if we are legally required to (for example, a valid court order or request from an authority), or to protect the service, our rights, or users' safety.

6. International transfers

Most of Appreso's processors are in the United States. When your data leaves the UK or EEA, we rely on legal safeguards — the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, the UK-US Data Bridge, or adequacy decisions — depending on the destination and the processor. We can't promise UK/EU-only processing; the AI models we use are hosted in the US.

7. How long we keep things

Your content, and records of how you used Appreso, is kept while your account is open. When you delete your account, we queue the data for deletion within 30 days and then remove it.
Account and consent records — which Terms you accepted, which consents you toggled, and when — are kept for longer, at least six years after your account closes, so we can show we had the right legal basis for everything we did.
Security and usage logs are kept for around 90 days, then purged.
Billing records, once paid tiers exist, will be kept for at least six years (HMRC requirement).

8. Your optional data controls

You control the following from Settings at any time. Turning one off means we stop using your data for that purpose going forward.

Help improve Appreso

Share data from your use of Appreso so we can evaluate, debug, and improve the product and its AI systems. This can include content you create, study conversations, voice transcripts, voice recordings, feedback, and technical diagnostics. For example, transcripts help us test answer quality and conversation behavior; audio helps us test the voice experience in real-world conditions like noisy microphones, interruptions, and latency. Turn this off at any time to stop new data being used for improvement, training, and evaluation.

Research invitations

Let us occasionally contact you to invite you to optional interviews, surveys, or usability studies. These help us understand what is working, what is confusing, and why people continue or stop using Appreso. Turn this off at any time and we will not contact you for research invitations.

Product updates and offers

Let us email you about new features, product changes, beta updates, and occasional offers. Turn this off at any time and we will only email you for necessary account, security, and service messages.

Automated experience capture

Share automated captures of how Appreso behaves while you use it, linked to your account, so we can find confusing, slow, or broken experiences. This can include session replay, clicks, scrolling, page views, on-screen interactions, UI event logs, and device, browser, and network diagnostics. It does not include voice recordings. Turn this off at any time to stop new automated experience captures.

9. Your rights

Wherever you live, you can:

See your data — sign in; most of what we hold about you is visible in the app.
Export your data — from Settings.
Delete your account — from Settings.
Email us at privacy@tumbric.com for anything that isn't in the app.

If you are in the UK or EEA, the UK GDPR / GDPR gives you additional rights: access, correction, erasure, restriction, portability, objection to processing based on our legitimate interests, and the right to withdraw consent at any time. Withdrawing consent doesn't make previous processing unlawful.

We don't make automated decisions about you that produce legal or similarly significant effects. AI powers parts of the service, but it isn't deciding anything consequential about your rights, finances, or access to services.

Complaints. If you think we are mishandling your data, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint (address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF). If you are elsewhere in the EU/EEA, you can complain to your local data-protection authority.

10. Cookies and tracking

Essential cookies keep you signed in and the service working. We can't run Appreso without these, so they're always on.
Product analytics may be collected without cookies or local storage to understand reliability and feature usage. You can object to this at any time by emailing us.
Automated experience capture, including session replay, is optional, off by default, and controlled from Settings.

11. Children

Appreso is for adults (18 and over). We do not knowingly collect data from anyone under 18. If you believe a child has created an account, email us at privacy@tumbric.com and we will remove it.

12. If we are sold or merged

If Tumbric Ltd is acquired, merged, or restructured, your data may move to the acquirer or successor, subject to the same privacy protections this policy describes. We will tell you in advance if this happens.

13. Changes to this policy

For material changes we will notify you in-app or by email before they take effect. For minor changes we will update the document and record it in the changelog at /legal/changelog. Version history lives there.