Privacy policy

1. Data controller

The data controller is DEBORA LANGUAGES SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Kolejowa 2, 58-240 Piława Górna, NIP: 8822145792. Contact: kontakt@deboralanguages.com.

2. What data we process

• Account data: email address, password (only as a protected hash), user ID, account language, first and last name if provided and, when signing in with Google, your profile picture.
• Content and learning: the words, examples and sets added by the User and their progress, including review history and next review dates.
• School: if the Debora Languages school invited the User, the name and email in the invitation, school membership and assigned sets.
• Level tests: the name given before the test, the answers and the score. No account is needed to take a test.
• Subscription: plan, status, billing period and the Google Play purchase ID or Stripe customer ID. We do not receive card details.
• Technical data: sign-up and last sign-in dates, IP address and request information in server logs, needed to run and secure the service.

Invitation data comes from the Debora Languages school, and Google sign-in data from Google. The rest is provided by the User or generated by using the App.

Providing data is voluntary but necessary to use the service: without an email and password or Google sign-in you cannot create an account, and without a name you cannot submit a level test.

The mobile app stores your session on the device in the system's encrypted storage, along with a copy of your words, progress and settings for studying offline.

The App shows no ads and contains no analytics or advertising tools, and the mobile app has no access to location, contacts, camera or microphone. We do not sell personal data.

3. Signing in with Google

If you sign in with Google, we receive your email address, your first and last name and your profile picture from Google. We use them only to create your account and sign you in. We do not sell this data or use it for advertising, and we keep it until the account is deleted.

4. Purposes and legal bases

• Running the account, providing the learning service and level tests, and managing the subscription: Article 6(1)(b) GDPR.
• Billing and tax obligations: Article 6(1)(c) GDPR.
• Service security, abuse prevention and establishing, exercising or defending legal claims: Article 6(1)(f) GDPR.

Emails about the account and subscription are sent as part of the service.

We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the User. An algorithm calculates review dates, but they are only used to organise study.

5. Who receives the data

The App's database and files are stored on servers in the European Economic Area (Frankfurt, Germany). We work with providers acting on our behalf:

• Supabase: database, sign-in and file storage;
• Amazon Web Services: hosting and audio generation (Amazon Polly), which receives the text of words and examples, including those added by the User if their plan includes audio;
• Resend: sending emails;
• Google: Google Play payments and subscriptions, and signing in with Google;
• Stripe: payments on the website.

If the User belongs to the Debora Languages school, people authorised by the school can see their name, email and assigned sets and, for a level test, the name, answers and score of the person who took it. The school is run by the Controller. This data is not shared with other schools.

For payments, Google and Stripe also act as independent controllers. Google's privacy policy: https://policies.google.com/privacy. Some providers, in particular Resend, Google and Stripe, may process data outside the European Economic Area, including in the United States. This is based on an adequacy decision or standard contractual clauses. You can request a copy of these safeguards at kontakt@deboralanguages.com.

6. Subscription

Subscriptions bought in the mobile app are handled by Google Play, and those bought on the website by Stripe. They renew automatically each billing period until the User cancels.

7. Data retention and account deletion

We keep data for as long as the account exists. The User can delete the account at any time in the mobile app (Account → Delete account) or ask us to do so by writing to kontakt@deboralanguages.com from the account's email address.

Deletion is irreversible. It covers the account, words, examples, sets, progress, subscription data and school invitations. Audio recordings of the words and examples that exist when the account is deleted are removed within 24 hours. Recordings of words and examples deleted earlier may remain in file storage: they contain no name or email address and are no longer linked to the account. Any active subscription is cancelled before the account is deleted, with no refund for the current period.

After deleting the account we keep:

• accounting documents, for the period required by tax law;
• payment event records with no name or email address, until claims expire;
• backups, from which data disappears automatically within 30 days;
• security logs, for up to 7 days in Supabase and up to 30 days in Amazon Web Services;
• sign-in logs, which may include the email address and IP address, for as long as needed to keep the service secure.

Level test results are kept until the school deletes the result or the test. You can ask for them to be deleted at kontakt@deboralanguages.com. Google keeps Google Play transaction data under its own privacy policy. Providers may keep technical data in their logs and information about sent messages for a limited time.

8. Cookies and browser storage

The website only uses what it needs to work and to remember the settings you choose, so we do not ask for cookie consent. We do not use cookies or similar technologies for analytics, marketing or advertising. Fonts are served from our own server.

You can clear this data in your browser settings. Without it, signing in may stop working.

9. Security

Data travels over an encrypted HTTPS connection, and access is limited to the people and services that need it.

10. Children

The App is not intended for children under 13. If we learn that a child under 13 has an account, we will delete it. A minor may only buy a subscription with the consent of their legal guardian. The level test of a child under 13 is taken by their legal guardian, or by the child with the guardian's consent.

11. Your rights

You have the right to access, rectify and erase your data, to restrict its processing and to data portability, and to object to processing based on legitimate interest. To exercise these rights, write to kontakt@deboralanguages.com. We will reply within one month.

You can also lodge a complaint with the Polish data protection authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw.

12. Changes and languages

We will announce significant changes by publishing the new version on this page. The policy is available in Polish, Spanish and English. If the versions differ, the Polish version prevails.