Privacy Policy

Last updated: 2026-07-07 (v2.10) — see Changelog at the end of this document.

Data Controller

This Privacy Policy describes how the data controller listed below collects, uses, and protects personal data when you use the AI Language Tutor mobile application and the website at ailanguagetutor.app (collectively, the "Service").

• Legal entity: Individual Entrepreneur Snisar Viktoriia (ФОП Снісар Вікторія)
• Latin transliteration (for banking and platform records): PE SNISAR VIKTORIIA
• Trading as: AI Language Tutor
• Registered location: Dnipro, Ukraine
• Ukrainian taxpayer ID (РНОКПП): 3174519508
• Apple Developer Team ID: 7V4KG9VG58
• Contact email: support@ailanguagetutor.app

EU Representative (GDPR Art. 27)

We are established outside the EU/EEA. Under GDPR Art. 27 we have designated, in writing, a representative in the Union.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the European Union. Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). To contact us via our representative Prighter, or to exercise your data-subject rights, please visit: https://app.prighter.com/portal/19285443777.

• EU Representative (legal entity): Prighter EU Rep GmbH (operated by Maetzler Rechtsanwalts OG, Austria)
• Registered address (EU/EEA): Schellinggasse 3/10, 1010 Vienna, Austria
• Data-subject request portal: app.prighter.com/portal/19285443777

You may contact our EU representative via the portal above for any data-protection matter, or reach us directly at support@ailanguagetutor.app; we will respond within 30 days as required by GDPR Art. 12(3).

1. Data We Collect

We collect the following categories of personal data, each for a specific purpose:

• Account data — email address, display name, native language. Purpose: authentication and personalization of the Service.
• Learning data — conversation transcripts, vocabulary entries, scenario progress, drill results. Purpose: delivering the core tutoring service and tracking your progress.
• Audio recordings — pronunciation samples streamed through our infrastructure for real-time speech-to-text and pronunciation assessment. Audio is processed in-memory only (typically <2 seconds end-to-end) and is never persisted on our servers. Word-level pronunciation scores are computed at the moment of recording and stored as text in the database. A short rolling history of your completed-session recordings is kept on your device only (last 3 for Free, 10 for Pro, 20 for Premium tier — automatically rotated via first-in-first-out). Purpose: speech-to-text transcription, pronunciation assessment, and feedback generation.
• Usage data — session timestamps, in-app events, screen views, feature usage. Purpose: product analytics and improvement.
• Subscription data — subscription tier, renewal state, in-app purchase receipts (processed via RevenueCat). Purpose: managing your paid entitlements.
• Phone number — collected during free-trial activation via SMS verification (Twilio). Purpose: trial-fraud prevention.
• Push notification token — device push token issued by Firebase Cloud Messaging (FCM). Purpose: delivering reminders and account notifications.
• Telegram account data (optional) — Telegram numeric user ID, chat ID, and (where set) public username. Collected only if you connect your Telegram account in Profile → Settings to receive the daily phrase, vocabulary reminders, or learning nudges via our Telegram bot. Purpose: delivering reminder messages through Telegram as an alternative or complement to push notifications. You can disconnect at any time in Profile → Settings; disconnect deletes the stored Telegram identifiers.
• Approximate country (IP & approximate location) — ISO 3166-1 alpha-2 two-letter country code derived from your IP address by Cloudflare (via the CF-IPCountry request header) at sign-up and sign-in. Purpose limitation: legal and consent display only — for example, to surface the appropriate supervisory-authority reference (see §6) and the right consent text for your jurisdiction. The country code is NOT used to route AI provider traffic or to gate features. Our LLM/STT/TTS cascade resolves identically for all users regardless of country (see app/core/geo.py — _COUNTRY_SPLIT_ROLES = {}); feedback routing is tier-based (Free/Pro vs Premium), not country-based. We do not store the IP address itself; only the country code is persisted on your profile, and it is deleted when you delete your account.
• Technical telemetry — crash reports, performance traces, anonymized device and OS information (via Sentry). Purpose: diagnosing errors and maintaining stability.

2. Data We Do NOT Collect

• Payment card details. All payments are handled by Apple App Store and Google Play in-app-purchase systems. We never see or store your card number or CVV.
• Voice biometric identity. We transcribe your speech to text. We do not extract or store voice patterns for the purpose of identifying or authenticating you. See "Voice biometrics determination" below.

3. Third-Party Processors (Sub-processors)

To deliver the Service we engage the service providers listed below. Where required by applicable law, we put in place data-processing terms and international-transfer safeguards, such as the European Commission's Standard Contractual Clauses (SCCs), Data Privacy Framework certifications, or another valid transfer mechanism. Maintenance of these contractual arrangements is an ongoing process; copies of relevant agreements are available on request.

4. Legal Basis for Processing (GDPR Art. 6 and Art. 9)

• Account creation and core service delivery — Art. 6(1)(b), performance of a contract.
• Voice processing (STT, TTS, pronunciation assessment) — Art. 6(1)(a), explicit consent. You are asked to confirm consent before your first voice session, and you can withdraw it at any time in the app under Profile → Settings → Voice.
• Analytics (PostHog) — Art. 6(1)(a), explicit opt-in consent. In the mobile app, the PostHog SDK is initialised only after you accept the consent dialog shown on first launch (default: off). The native SDK auto-initialisation is disabled via the com.posthog.posthog.AUTO_INIT=false manifest flag, so no analytics events, session-replay snapshots, or /decide network calls occur before you consent. You can withdraw consent at any time under Profile → Privacy. On the public website, the same applies via the cookie banner.
• Marketing emails — Art. 6(1)(a), explicit opt-in consent with a checkbox at signup and an unsubscribe link in every message.
• Phone verification — Art. 6(1)(b), contract performance and trial-fraud prevention.
• Crash and error tracking — Art. 6(1)(f), our legitimate interest in service stability and security.

We do not process special-category data under Art. 9. See "Voice biometrics determination" below.

5. Retention Periods (Art. 13(2)(a))

6. Your Rights Under GDPR (Arts. 15–22)

You have the following rights with respect to your personal data:

• Right to access (Art. 15). Export your data in JSON via Profile → Settings → Export, or by contacting support@ailanguagetutor.app.
• Right to rectification (Art. 16). Edit your profile data at any time in the app.
• Right to erasure / "to be forgotten" (Art. 17). Delete your account from Profile → Settings → Delete Account, or by contacting support@ailanguagetutor.app. Data is hard-deleted within 30 days, subject to lawful retention obligations.
• Right to restrict processing (Art. 18). Contact support@ailanguagetutor.app.
• Right to data portability (Art. 20). The export above is provided in machine-readable JSON.
• Right to object (Art. 21). You may object at any time to processing based on legitimate interest (in particular, analytics).
• Right not to be subject to automated decision-making (Art. 22). We do not make consequential automated decisions about you. Tier-based feature gating (Free / Pro / Premium) is contractual, not algorithmic profiling.
• Right to withdraw consent (Art. 7(3)). Voice consent can be withdrawn under Profile → Settings; marketing-email consent can be withdrawn via the one-click unsubscribe link (RFC 8058 / List-Unsubscribe header) included in every commercial email; the Telegram bot integration can be disconnected at any time under Profile → Settings, which deletes your stored Telegram identifiers.
• Right to lodge a complaint (Art. 77). You may contact your local supervisory authority. Examples for our target markets:
  • Ukraine: Ombudsman of Ukraine — ombudsman.gov.ua
  • Poland: UODO — uodo.gov.pl
  • Czech Republic: ÚOOÚ — uoou.cz
  • Romania: ANSPDCP — dataprotection.ro
  • Hungary: NAIH — naih.hu
  • Germany: BfDI — bfdi.bund.de
  • Spain: AEPD — aepd.es
  • Or your local supervisory authority.

7. International Data Transfers (Art. 13(1)(f))

Some of our service providers are located outside the EU/EEA (primarily the United States). Where personal data is transferred outside the EU/EEA, we use an applicable transfer mechanism where required, such as an adequacy decision (where granted by the European Commission), the EU-U.S. Data Privacy Framework for certified providers, the European Commission's Standard Contractual Clauses (SCCs), or another valid safeguard. Details of the applicable safeguards for a specific provider are available on request at support@ailanguagetutor.app.

8. Sign in with Apple (App Store Guideline 5.1.1)

The Service supports Sign in with Apple. When you use Sign in with Apple, you may choose to share either your real email address or an Apple-relayed private email (e.g. <random>@privaterelay.appleid.com). We store whichever email Apple returns to us. You can revoke our access at any time from your Apple device: Settings → Apple ID → Sign-In & Security → Apps Using Your Apple ID.

9. Sign in with Google

Sign in with Google requests the OAuth scopes openid, email, and profile only. We do not request access to Google Drive, Google Calendar, Gmail, or any other Google service.

10. Children

AI Language Tutor is not intended for users under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact support@ailanguagetutor.app and we will delete the data promptly.

11. Voice Biometrics Determination (Art. 9 explanation)

Our voice processing is limited to speech-to-text transcription, text-to-speech synthesis, and pronunciation assessment against a reference text. We do not create, store, or compare voice prints for the purpose of identifying or authenticating you. For this reason, voice recordings are processed as ordinary personal data under Art. 6, not as biometric special-category data under Art. 9.

12. Cookies and Tracking

On the public website (ailanguagetutor.app), we use PostHog (EU-hosted) for product analytics. PostHog activates only after you accept analytics cookies via our cookie banner. We do not use advertising or cross-site tracking cookies. In the mobile app, PostHog telemetry is opt-in by default: the SDK is not initialised at all until you accept the consent dialog on first launch (native auto-initialisation is disabled via the AUTO_INIT=false manifest flag on both Android and iOS). Firebase Cloud Messaging is used solely for push-notification delivery and does not capture analytics. You can withdraw or grant analytics consent at any time under Profile → Privacy.

13. Data Processing Agreement (DPA)

If you use AI Language Tutor on behalf of a company, school, or other organization and require a signed Data Processing Agreement, contact support@ailanguagetutor.app. We provide a standard GDPR-compliant DPA on request.

14. Required vs Optional Data (Art. 13(2)(e))

Some data is necessary to provide the Service; other data is optional.

• Required: account data (email, display name, native language) to create your account; subscription data to manage paid access; voice and audio data when you use voice-based features (you can use text-only features without granting voice consent).
• Optional: marketing emails (opt-in checkbox at signup), product analytics (opt-out via cookie banner on web and Profile → Privacy in app), and push notifications (opt-out via device or in-app settings).

If you do not provide required data, the corresponding features will not be available, but you may still use the parts of the Service that do not require that data (for example, text-only practice without voice features).

15. Security Measures

We use technical and organizational measures designed to protect personal data. These include transport encryption (TLS for all client–server traffic), encryption at rest for sensitive credentials, access controls with least-privilege principles for administrative access, environment-separated production credentials, audit logging for sensitive operations, automated retention enforcement (transcript purge worker and export-bundle cleanup worker; session audio is not stored on our servers and so has no cleanup worker — see §1 and §5), pseudonymisation of identifiers in observability tooling (Sentry user context carries only the user UUID with send_default_pii=False; cleartext email addresses in logger.* messages are masked via app/core/logging.py::mask_email before reaching the structured-log / Sentry-breadcrumb pipeline; a regression test in tests/core/test_mask_email.py guards against new leaks), bounded web-server log retention (nginx access / error logs are rotated daily with 7 retained generations; see §5), and restricted backend administrative access. No online service can guarantee absolute security. We will notify affected users and relevant supervisory authorities of any personal-data breach in accordance with GDPR Art. 33 and Art. 34.

16. AI Provider Configuration and Training

We do not use your conversation transcripts, voice recordings, or any personal content to train our own AI models. We only send personal content to third-party AI providers (Anthropic, OpenAI, Google Gemini, ElevenLabs, Deepgram, Azure Speech) where our account settings, the provider's published terms, or our data-processing agreement with that provider prohibit use of API submissions for provider-side model training, unless we disclose otherwise in this Policy before using that provider for personal content. Feedback-generation traffic is routed by subscription tier (Free/Pro to OpenAI primary, Premium to Anthropic primary, with Google Gemini as the shared fallback) rather than by country. If a provider's training posture is uncertain or changes, we will either stop sending personal content to that provider or update this section before continuing.

17. User-Provided Content in Conversations (Your Responsibility for Data Minimization)

The Service is designed for language practice. Conversation scenarios, prompts, vocabulary entries, written replies, spoken turns, and any other free-form content you choose to provide are sent in real time to our third-party AI providers (see §3 and §16) and retained for the periods set out in §5 (conversation transcripts for up to 30 days; session audio is not retained on our servers, only a short rolling copy on your device — see §1 and §5).

To protect your privacy, we ask you to use fictional names and made-up scenarios for practice. Please do not include real personal data in your conversations, uploads, or vocabulary entries, in particular:

• Government-issued identifiers — passport numbers, national ID, tax IDs, driver's-licence numbers, social-security numbers.
• Payment information — card numbers, CVV, bank account or IBAN, payment-app credentials.
• Account credentials — passwords, API keys, recovery codes, multi-factor codes, security-question answers.
• Health, medical, or treatment information about yourself or anyone else, and any other special-category data under GDPR Art. 9 (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, sex life or sexual orientation).
• Personal data of third parties — real names, phone numbers, email addresses, postal addresses, photographs — without their consent. This includes colleagues, family members, customers, students, and patients.
• Confidential business information you are not authorized to disclose, including trade secrets, internal documents, customer lists, and source code subject to an NDA.

This guidance reflects the data-minimization principle of GDPR Art. 5(1)(c): the safest data is the data we never receive. We apply automated safeguards on our side — PII masking in error logs, transport encryption, least-privilege access controls (see §15) — and we configure third-party AI providers not to use API submissions for provider-side model training (see §16). However, no automated filter can detect every form of personal data, and once you submit content it has already been transmitted to our AI providers. You remain responsible for the content you choose to share with the Service.

This section does not limit our obligations as data controller under GDPR. Your rights under Arts. 15–22 (see §6) continue to apply to any personal data you provide, including the right to erasure: deleting your account removes your transcripts and vocabulary entries within 30 days, subject to lawful retention obligations. If you realize you have submitted sensitive personal data and want it removed sooner, contact dpo@ailanguagetutor.app (or support@ailanguagetutor.app with subject prefix [GDPR]) and we will process the erasure request without undue delay.

18. Changes to This Policy

We will notify you of material changes to this Privacy Policy at least 14 days before they take effect, via in-app notification and — if you have given marketing-email consent — by email. Older versions are archived and available on request.

19. Contact

• General inquiries: support@ailanguagetutor.app
• Data-protection / DSR: dpo@ailanguagetutor.app (or use support@ with subject prefix [GDPR])
• Legal / DPA / B2B: legal@ailanguagetutor.app

20. Changelog