1. Data Controller

2. Information We Collect

We collect the following categories of personal data:

• Account data: email address, authentication provider
• Content data: generated dialog content, flashcards
• Learning data: study sessions, vocabulary goals, performance metrics, user levels
• Financial data: credits balance, invoice details, billing address, VAT/tax ID where provided (payment details processed by Stripe)
• Technical data: IP addresses (for rate limiting), browser type
• Analytics data: page views and usage patterns (only with your consent)

3. Lawful Basis for Processing (Art. 6 GDPR)

We process your data based on the following legal grounds:

• Contract (Art. 6(1)(b)): Service delivery, payment processing, invoicing, AI-generated content
• Legal Obligation (Art. 6(1)(c)): Tax, accounting, invoice retention, and statutory record-keeping obligations
• Legitimate Interest (Art. 6(1)(f)): Rate limiting, security, responding to support inquiries
• Consent (Art. 6(1)(a)): Analytics cookies (Google Analytics) — you can withdraw consent at any time via cookie settings

4. Third-Party Processors

We share your data with the following processors, each for a specific purpose:

5. International Data Transfers

Some of our processors are based in the United States. Data transfers to the US are protected by the EU-U.S. Data Privacy Framework (where the recipient is certified) and, additionally, by Standard Contractual Clauses (SCCs) in accordance with Art. 46(2)(c) GDPR.

6. Data Retention

• Account data: Retained while your account is active; deleted upon account deletion
• IP addresses: Short-lived, sliding window for rate limiting only
• Contact messages: Retained for up to 2 years
• Payment, invoice, and accounting records: Retained as required by applicable tax and commercial law. These records may be kept after account deletion where statutory retention duties apply.

7. Your Rights (Art. 12–22 GDPR)

You have the following rights regarding your personal data:

• Access (Art. 15): Request a copy of your data via the "Download My Data" feature or by contacting us
• Rectification (Art. 16): Request correction of inaccurate data
• Erasure (Art. 17): Delete your account and associated service data via the "Delete Account" page. Statutory invoice, payment, and accounting records may be retained where we are legally required to keep them.
• Portability (Art. 20): Export your data in machine-readable JSON format
• Restriction (Art. 18): Request restriction of processing
• Object (Art. 21): Object to processing based on legitimate interest
• Withdraw consent: Withdraw analytics consent at any time via cookie settings
• Lodge a complaint: You may lodge a complaint with your local data protection authority. The competent supervisory authority for LinguaDi is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de)

To exercise any of these rights, contact us at [email protected].

8. Cookie Policy

We use the following cookies:

You can manage your cookie preferences at any time using the "Cookie Settings" link in the footer of any page.

9. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours in accordance with Art. 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly (Art. 34 GDPR).

10. Children's Data

LinguaDi is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date.

12. Contact

For any privacy-related questions or to exercise your data rights, contact us at: [email protected]