Privacy Policy

1. General Provisions

1.1. This Privacy Policy (hereinafter — the "Policy") explains how personal data of users of the Linglass service (hereinafter — the "Service") is collected, processed, stored, and protected.

1.2. The data controller is Furtaev Ilia, Individual Entrepreneur registered in the Republic of Armenia, Taxpayer Identification Number (TIN) 20354437, state registration number 286.1599034 (hereinafter — the "Controller"). Contact: [email protected].

1.3. This Policy is made in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the UK GDPR, and applicable data protection law of the Republic of Armenia.

1.4. By using the Service, the User agrees to the processing of their personal data as described in this Policy. Where processing is based on consent, the User may withdraw consent at any time. If the User does not agree with this Policy, the User must stop using the Service.

1.5. The Controller may amend this Policy. The current version is published at https://linglass.app/privacy. The Controller notifies Users of material changes by email or through the Service interface.

2. Legal Bases for Processing (Article 6 GDPR)

2.1. Personal data is processed on the following legal bases:

• performance of a contract (Art. 6(1)(b) GDPR) — processing necessary to provide the Service under the Terms of Service (account, translation, text-to-speech, spaced repetition, subscriptions);
• consent of the data subject (Art. 6(1)(a) GDPR) — optional features and analytics/diagnostics, in particular in the mobile applications;
• legitimate interests of the Controller (Art. 6(1)(f) GDPR) — ensuring security, preventing fraud and abuse, and improving the Service, where such interests are not overridden by the User's rights and freedoms;
• compliance with a legal obligation (Art. 6(1)(c) GDPR) — where retention or disclosure is required by applicable law (e.g. transaction records).

3. Purposes of Processing

3.1. The Controller processes personal data for the following purposes:

• registration and authentication of the User in the Service;
• provision of the Service's functionality (translation, text-to-speech, spaced repetition);
• storage of the User's personal dictionary and learning materials;
• account security and authentication;
• management of subscription plans and payment processing;
• technical operation of the Service (monitoring, error logging);
• sending service notifications relating to the account, payments and the operation of the Service;
• sending product communications (news about features, usage tips and offers), which the User may decline at any time via the link in any such message or in the Service settings — declining does not affect the service notifications above;
• analysis of Service usage for improvement purposes.

4. Categories of Personal Data Processed

4.1. Data provided by the User upon registration

4.2. Data received via third-party authentication services (OAuth)

Apple Sign In may provide a private relay (forwarding) email address instead of the User's real email, according to the User's Apple settings. The name is provided only on the first sign-in.

4.3. Service usage data (learning data)

4.4. Learning activity data

4.5. Payment and subscription data

The Controller does not receive or store the User's bank card details (card number, expiry date, CVV/CVC code). Card data is entered by the User on the secure page of a PCI DSS–certified payment provider and is not stored by the Controller.

Depending on the platform, payments are processed by:

• Polar Software Inc. (Polar) — the merchant of record for card payments on the web: Polar processes the payment, handles applicable sales taxes, and issues billing documents; the Controller receives only the transaction and subscription identifiers and status required to activate the Premium plan;
• Robokassa — a PCI DSS–certified payment aggregator, for historical one-time card payments made on the web before Polar was introduced;
• Apple (App Store In-App Purchase) — for purchases made in the iOS application; the Controller receives only the transaction identifier and the subscription status required to activate the Premium plan;
• Google (Google Play Billing) — for purchases made in the Android application; the Controller receives only the transaction identifier and the subscription status.

Data on each transaction (date, amount, currency, payment status) is stored to provide the User with a payment history and to comply with legal requirements. Apple's and Google's processing of payment data is governed by their respective privacy policies.

When the User asks Apple or Google for a refund of an in-app purchase, the store may ask the Controller whether the purchased features were used. In that case the Controller sends the store a summary of the User's use of the Service since the purchase (for example, the number of days and the amount of use of the paid features, and the dates of that use) together with the Controller's view on the refund; no content of the User's activity is sent. The store makes the refund decision. By making an in-app purchase the User consents to this transfer.

4.6. Technical data

During use of the Service, technical data is automatically processed: IP address, browser type, and server request information. This data is used to ensure the security and operability of the Service, is not stored in association with the User's account, and is deleted in accordance with the log rotation policy.

4.7. Session and authentication data

To ensure account security and maintain an active session, the Service processes session data (encrypted authentication tokens, email confirmation codes). Session data is stored for a limited time and is automatically deleted upon expiration.

5. Cookies and Analytics

5.1. The Service uses strictly necessary cookies for authentication and session management. Without these cookies, the Service cannot be used. The Service does not use advertising cookies.

5.2. To analyze traffic sources and improve the Service, we use Google Analytics 4 (operated by Google LLC), which sets its own cookies and collects pseudonymized visit data (referral source, pages, session duration, device type, approximate IP-based location) on the basis of the User's consent where required. Google's processing is governed by policies.google.com/privacy. Users may opt out via tools.google.com/dlpage/gaoptout.

5.3. The User may manage cookies through browser settings. Disabling strictly necessary cookies may prevent use of the Service.

5.4. Marketing attribution. When the User first arrives at the Service from an external source, the Service stores a first-touch attribution cookie (linglass_attribution) containing UTM parameters from the URL and the host of the referring page (no full URL, no query string). On registration, this cookie is stored alongside the User account to analyze marketing channel effectiveness. The data is not transferred to any third party. The cookie is cleared after successful registration.

5.5. Mobile applications. In the mobile applications, the Controller uses Firebase Analytics (Google LLC) for aggregated usage analytics and Sentry for crash and error diagnostics. Analytics and diagnostic data in the mobile applications are collected only after the User grants consent on the in-app consent screen; nothing is sent before consent, and the User may decline.

6. Recipients and Processors

6.1. To provide its functionality, the Service relies on third-party processors and services. The following describes the categories of recipients and the data disclosed to them.

Services to which no personal data is disclosed: the Service sends pseudonymized requests (individual words, language pairs, contextual sentences with no link to the user) to third-party machine translation and text-to-speech services. These requests do not contain User identifiers.

Recipients to which personal data is disclosed:

6.2. The Controller does not sell or share personal data for cross-context behavioral advertising, and does not transfer personal data to third parties for their own marketing purposes.

6.3. The Controller may disclose personal data where required by a lawful request from a competent authority.

7. International Data Transfers

7.1. Personal data is stored on servers located within the European Union (see Section 8). Where personal data is transferred to processors located outside the European Economic Area (for example, authentication, analytics, and diagnostics providers and card payment processing via Polar in the United States, and historical card payment processing via Robokassa in Russia), such transfers are made under appropriate safeguards within the meaning of Chapter V GDPR — in particular the European Commission's Standard Contractual Clauses — or, where applicable, on the basis of the User's explicit consent.

8. Storage and Protection of Personal Data

8.1. Storage location

Personal data is stored on servers located within the European Union. Media files (screenshots, audio clips) are stored in cloud storage within the European Union. Access to media files is provided via signed URLs with a limited validity period (1 hour).

8.2. Retention periods

8.3. Protection measures

The Controller applies organizational and technical measures to protect personal data, including: encryption of data during storage and transmission, isolation of user data, protection against unauthorized access, restriction of the number of persons with access to personal data, and regular security reviews.

9. Your Rights (GDPR / UK GDPR)

9.1. Subject to applicable law, the User has the right:

• of access — to obtain confirmation of, and access to, their personal data and information about the processing;
• to rectification — to have inaccurate or incomplete personal data corrected;
• to erasure ("right to be forgotten") — to have their personal data deleted where there is no lawful ground for continued processing;
• to restriction of processing and to object to processing based on legitimate interests;
• to data portability — to receive their data in a structured, commonly used, machine-readable format;
• to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• to lodge a complaint with a data protection supervisory authority in the User's country of residence.

9.2. To exercise these rights, the User may:

• delete individual records (words, cards) through the Service interface;
• delete the account entirely through the "Settings" section — all personal data, including learning data and media files, will be permanently deleted;
• contact the Controller at [email protected].

9.3. The Controller responds to requests without undue delay and in any event within one (1) month of receipt. That period may be extended by up to two further months where necessary, taking into account the complexity and number of requests, with notice to the User.

10. Children's Personal Data

10.1. The Service is not intended for children below the age of digital consent applicable in their country (16 in the EEA, unless a lower age, no younger than 13, is set by national law). The Controller does not knowingly collect personal data from such children without appropriate parental consent.

10.2. If the Controller becomes aware that personal data was provided by a child in breach of this Section, the Controller will take measures to delete such data.

11. Personal Data Breach Notification

11.1. In the event of a personal data breach, the Controller will, without undue delay and where feasible within 72 hours of becoming aware of it, notify the competent supervisory authority in accordance with Article 33 GDPR, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

11.2. Where the breach is likely to result in a high risk to individuals, the Controller will notify affected Users without undue delay, describing the nature of the breach, the measures taken, and recommendations for Users (Article 34 GDPR).

12. Automated Processing

12.1. The Service uses a spaced repetition algorithm to automatically generate a repetition schedule based on the User's grades. This processing does not produce legal or similarly significant effects and is aimed solely at optimizing the learning process.

12.2. The Controller does not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on the User within the meaning of Article 22 GDPR.

13. Contact Information

Data controller: Furtaev Ilia, Individual Entrepreneur (Republic of Armenia)

TIN: 20354437 · State registration number: 286.1599034

Email: [email protected]

14. Governing Law and Final Provisions

14.1. This Policy is an integral part of the Terms of Service of the Linglass service.

14.2. This Policy is governed by the law of the Republic of Armenia, without prejudice to the mandatory data protection rights available to Users under the GDPR, the UK GDPR, and other applicable local law.

14.3. All questions and requests regarding the processing of personal data should be directed to [email protected].

15. California Residents (CCPA / CPRA)

15.1. The Controller does not sell or share personal information as defined by the CCPA/CPRA. California residents have the right to know, delete, and correct their personal information, and the right not to be discriminated against for exercising these rights. To exercise these rights, contact [email protected].