Privacy Policy

Linguenta ("we," "our," or "us") is operated by Linguenta, registered in the Netherlands. We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights regarding your personal data. By using Linguenta, you agree to the practices described in this policy. If you have questions about this policy, contact us at support@linguenta.com.

Data Controller: Linguenta Registered Address: Eindhoven, The Netherlands Contact Email: support@linguenta.com Data Protection Contact: support@linguenta.com We operate Linguenta at https://www.linguenta.com and are responsible for your personal data as described in this policy.

We collect the following categories of personal data: Account Data: Your name, email address, and password (hashed) when you register. Learning Data: Your CEFR level, XP, streaks, grammar scores, vocabulary progress, pronunciation scores, writing feedback, assessment results, and daily activity. Usage Data: Features used, session duration, AI Coach interactions, and module engagement — collected to improve the product. Subscription & Billing Data: Your subscription plan, billing status, and transaction history. Payment details are processed and stored by Stripe (our Merchant of Record) — we do not store raw payment card numbers. AI Interaction Data: Text you submit to AI features (conversation, grammar, writing, vocabulary, AI Coach) is sent to third-party AI providers to generate responses. Full conversation text is not permanently stored by us. Voice & Audio Data: Audio recordings submitted for pronunciation analysis are temporarily processed by Deepgram and deleted after scoring. Technical Data: IP address, browser type, device type, and error logs collected for security and debugging. Voluntary Data: Support tickets, bug reports, feature requests, and creator submissions you choose to submit.

We process your personal data under the following legal bases (GDPR Article 6): Contract Performance (Article 6(1)(b)): Processing necessary to provide you with the service — account creation, AI tutoring, progress tracking, and subscription management. Legitimate Interests (Article 6(1)(f)): Security monitoring, fraud prevention, product analytics (anonymized), and improving our AI learning features. Consent (Article 6(1)(a)): Optional analytics and marketing communications, where you have opted in. You may withdraw consent at any time. Legal Obligation (Article 6(1)(c)): Retaining billing records as required by tax law and applicable regulations.

We use your data to: — Provide and maintain the Linguenta learning platform — Personalise your learning path based on your level, goals, and performance — Process subscription payments via Stripe — Send transactional emails (account confirmation, subscription updates) — Send marketing and product updates (only if you have opted in) — Monitor platform usage to improve features and fix bugs — Respond to support tickets and bug reports — Comply with legal and regulatory obligations — Detect and prevent fraud, abuse, and security incidents

We share data with the following categories of third-party processors: AI Providers — OpenAI: Text submitted to AI learning features is processed to generate educational responses. We have a Data Processing Agreement with this provider. Data is not used to train their models on your behalf. Speech-to-Text — Deepgram: Audio submitted for pronunciation practice is transcribed and analysed. Audio is not permanently retained. Payments — Stripe: Stripe is our Merchant of Record and processes all payment transactions. They collect billing data under their own privacy policy. Error Monitoring — Sentry: Anonymised error and performance data is sent to Sentry for debugging. Personal identifiers are stripped. Hosting & Database — Supabase: Your account and learning data is stored on Supabase-hosted PostgreSQL infrastructure with Row Level Security enabled. Email Services — Supabase Auth and configured email delivery providers: Used to send transactional and marketing emails. We do not sell your personal data to third parties.

Linguenta uses AI to generate educational content, feedback, and scoring. This constitutes automated processing but does not constitute automated decision-making that produces legal or similarly significant effects on you under GDPR Article 22. AI outputs (grammar corrections, writing feedback, pronunciation scores, conversation responses) are for educational purposes only and may be inaccurate. You should not rely on AI outputs for legal, medical, or financial decisions. We do not use your personal data to train our own AI models. Text sent to third-party AI providers is processed under our agreements with those providers.

We retain data for the following periods: Account data (name, email): Retained until you delete your account. Learning progress data: Retained until you delete your account. Billing records: Retained for 7 years as required by applicable tax law. Support tickets: Retained for 3 years for audit and support purposes. Security and admin audit logs: Retained for 6–12 months. Voice recordings: Deleted immediately after processing (not permanently stored). Full AI conversation text: Not permanently stored — only scores and summaries are retained. Anonymous aggregated analytics: Retained indefinitely as they contain no personal identifiers. When your account is deleted, all personal data is deleted from our systems within 30 days, except where retention is required by law.

Your data may be processed by third-party providers in countries outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, including: — Standard Contractual Clauses (SCCs) approved by the European Commission — Adequacy decisions recognised by the European Commission — Other transfer mechanisms as required under applicable data protection law For details of specific transfer mechanisms used by our processors, contact us at support@linguenta.com.

If you are located in the EEA or UK, you have the following rights under the GDPR: Right of Access: Request a copy of your personal data. Right to Rectification: Correct inaccurate data. Right to Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention obligations). Right to Restriction: Restrict how we process your data in certain circumstances. Right to Data Portability: Receive your data in a structured, machine-readable format. Right to Object: Object to processing based on legitimate interests or for marketing purposes. Right to Withdraw Consent: Withdraw consent for optional analytics or marketing emails at any time. To exercise any of these rights, contact us at support@linguenta.com or use the data management tools in your Privacy tab. You also have the right to lodge a complaint with your local data protection authority.

Linguenta is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided personal data, we will delete it promptly. If you believe a child has registered on our platform, please contact us at support@linguenta.com.

We use cookies and similar technologies to operate the platform and (with your consent) for analytics and marketing. For full details, see our Cookie Policy at https://www.linguenta.com/legal/cookies. You can manage your cookie preferences at any time in the Privacy tab of your profile or via the cookie consent banner.

We implement appropriate technical and organisational security measures to protect your personal data, including: — Encrypted data storage and transmission (TLS/HTTPS) — Hashed passwords (bcrypt) — Row Level Security on our database — Access controls limiting who can access personal data — Security monitoring and audit logging No method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously work to protect your data.

You may delete your account at any time from the Privacy tab of your profile. Account deletion will permanently remove: — Your account information (name, email) — All learning progress, scores, XP, and streaks — Grammar, vocabulary, pronunciation, and assessment test data — AI Coach interaction summaries — Support tickets and bug reports — Feature requests and community votes Billing records may be retained as required by law. Anonymised, non-identifiable analytics data may be retained. Account deletion is permanent and cannot be undone.

We may update this Privacy Policy from time to time. When we make material changes, we will: — Update the "Last Updated" date at the top of this page — Notify you by email if you have an active account and the changes significantly affect your rights — Post a notice on the platform Your continued use of Linguenta after changes are posted constitutes your acceptance of the updated policy.

If you are located in the EEA, you have the right to lodge a complaint with the data protection authority in your country of residence. A list of EU data protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. Our lead supervisory authority is: [PLACEHOLDER — the DPA in your country of registration, e.g., "the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)" if registered in the Netherlands].

For any questions, requests, or complaints regarding this Privacy Policy or our data practices, contact us at: Email: support@linguenta.com Company: Linguenta Address: Eindhoven, The Netherlands We aim to respond to all enquiries within 30 days.