Privacy policy

1. Controller

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

Melih Firat, email: melihfiratapps@gmail.com

For questions about data protection or to exercise your rights, please write to melihfiratapps@gmail.com. We are not required to appoint a data protection officer.

2. Overview

We only process the data we need to run Lingotivo:

• technical access data when you visit the website (e.g. your IP address),
• your account data if you sign up,
• your learning data when you use the app,
• payment and subscription data if you buy a Pro package.

We use no analytics, advertising or tracking services and do not sell any data. Fonts are served from our own server; no Google Fonts are loaded.

3. Hosting, delivery and security (Cloudflare)

The website, the server logic (Cloudflare Workers), the database (Cloudflare D1) and our files (Cloudflare R2) run on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare acts as our processor (Art. 28 GDPR).

With every request, Cloudflare processes technically necessary data, in particular your IP address, date and time, the requested address, your browser type (user agent) and, where applicable, the previously visited page. This is needed to deliver the site, fend off attacks and find errors. To prevent abuse, we also limit the number of sign-in, sign-up and password-reset attempts per IP address.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is operating the website securely and reliably. If you have an account, the processing also serves to perform the user agreement (Art. 6(1)(b) GDPR).

More information: Cloudflare's privacy policy.

4. User account

You need a free account to use the learning features. For it we process:

• your name and email address,
• your password – only as a cryptographic hash, never in plain text,
• whether your email address is confirmed,
• your chosen exam level (A1, A2 or B1) and your display language,
• for each active sign-in (session): IP address, browser type (user agent) and expiry time.

We use the session data to keep you signed in and to protect your account from unauthorised access. A session ends when you sign out or when it expires; resetting your password ends all sessions.

The legal basis is Art. 6(1)(b) GDPR (providing the account and the agreed services); for the security data, also Art. 6(1)(f) GDPR (protection against misuse).

5. Sign-in with Google or Apple

Instead of an email address and password, you can sign in with your Google or Apple account. The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA), and Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland (parent company: Apple Inc., USA).

If you choose this option, you are redirected to the provider and sign in there. We then receive your name, your email address, the identifier of your account with the provider, where applicable the address of your profile picture, and the tokens technically required for the sign-in. With Apple you can hide your email address; we then receive a relay address generated by Apple. If an account with the same confirmed email address already exists, the sign-in is linked to that account.

The legal basis is Art. 6(1)(b) GDPR. Using this option is voluntary; signing in with email and password is always available. Processing by Google and Apple is governed by their privacy policies: Google, Apple.

6. Bot protection (Cloudflare Turnstile)

When you sign up and when you request a new password, we use Cloudflare Turnstile to prevent automated sign-ups and abuse. Cloudflare processes data from your browser and device (e.g. IP address, browser and system characteristics) to check whether the request comes from a human.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our service and our users from spam, fraud and automated attacks. The access to your device this requires is strictly necessary under § 25(2) no. 2 TDDDG to provide the service you requested securely.

7. Learning data

So that you can see your progress and pick up where you left off, we store with your account:

• the status of each word (e.g. “learning”, “learned”),
• daily activity totals (e.g. words learned, tests and exercises completed),
• vocabulary test results,
• mock exam attempts, including your answers and the texts you write,
• your grammar progress and your review cards.

We use this data solely to provide the learning features, statistics and reviews. The legal basis is Art. 6(1)(b) GDPR.

Please do not enter sensitive information about yourself or others in free writing tasks; the texts are stored with your account.

8. Emails (Resend)

We only send emails that your account requires, e.g. to confirm your email address, to reset your password or to confirm a cancellation. We do not send newsletters or marketing emails.

We use Resend (Plus Five Five, Inc., USA) as our processor for sending them. Resend processes your email address, your name, the content of the email and technical delivery data (e.g. time and delivery status). The legal basis is Art. 6(1)(b) GDPR. More information: Resend's privacy policy.

9. Pro subscriptions and payments (Stripe)

Besides the free account, we offer paid Pro packages as monthly or yearly subscriptions. Payments are handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland; affiliated companies including in the USA). Checkout, the customer portal (change payment method, cancel, download invoices) and invoices run on Stripe's pages.

We pass your name, your email address, an internal customer identifier and the chosen package to Stripe. You enter your payment details (e.g. card number), your billing address and, where applicable, your VAT ID directly with Stripe; we do not receive full card details. We store your Stripe customer ID and the package, status, term, billing interval and whether the subscription has been cancelled.

Stripe processes some payment data as an independent controller, e.g. for fraud prevention and to meet legal obligations. More information: Stripe's privacy policy.

Legal bases: Art. 6(1)(b) GDPR (performing the contract), Art. 6(1)(c) GDPR (tax and commercial law obligations, e.g. invoicing and record keeping) and Art. 6(1)(f) GDPR (preventing payment fraud).

10. Cookies and browser storage

We only store information on your device that is strictly necessary for the service (§ 25(2) no. 2 TDDDG). No consent is required for this:

• Session cookie: keeps you signed in after you sign in; it becomes invalid when you sign out or the session expires.
• Local storage (localStorage): your language choice, your cookie choice and unsent answers in mock exams and grammar exercises, so they are not lost if the page reloads. Drafts are deleted once you submit them.

This data stays in your browser; you can delete it at any time in your browser settings.

Optional cookies: Our cookie banner includes an “Analytics” category. We currently use no analytics services. Should we introduce one in the future, it will only load after you have given your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), and we will update this privacy policy accordingly. You can change or withdraw your choice at any time via the “Cookie settings” link.

11. Recipients and transfers to third countries

Your data is only received by the service providers named in this policy, to the extent they need it for their task: Cloudflare (hosting, security, bot protection), Resend (sending emails), Stripe (payments) and – only if you choose that sign-in – Google or Apple. We also disclose data where we are legally obliged to (e.g. to tax authorities or on an official order).

Some of these providers are based in the USA or process data there. For the USA, the European Commission has adopted an adequacy decision (EU-U.S. Data Privacy Framework), which applies to companies certified under that framework. Where a provider is not certified or this is not sufficient, we base the transfer on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the safeguards from us.

12. Retention and deleting your account

We keep personal data only as long as the respective purpose requires:

• Account and learning data: until you delete your account.
• Session data: until you sign out or the session expires.
• Confirmation and password links: expire after one hour.
• Technical access data at Cloudflare: only briefly, within Cloudflare's retention periods.
• Invoices and accounting records: as long as commercial and tax law requires – usually six or ten years (§ 257 HGB, § 147 AO). These records are kept by Stripe or by us.

You can delete your account yourself at any time in Settings. This deletes your profile and all learning data; any active subscription is cancelled. Data we must keep for legal reasons (in particular invoices at Stripe) is restricted until the end of the retention period and then deleted.

13. Your rights

You have the following rights regarding your personal data:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing (Art. 21 GDPR, see section 14),
• withdrawal of any consent you have given, with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, simply write to melihfiratapps@gmail.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.

14. Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can send your objection informally to melihfiratapps@gmail.com.

15. Obligation to provide data and automated decisions

You are not required by law or contract to provide your data. Without a name, email address and password (or a sign-in with Google or Apple), however, we cannot create an account for you, and without payment details at Stripe you cannot take out a Pro subscription. Technical access data is required to load the website.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

16. iPhone apps and changes to this policy

This privacy policy applies to the web app at dutch.lingotivo.com. Our iPhone and iPad apps have their own privacy policies, which you can find in each app and on its page, e.g. Deutsch A1.

We update this privacy policy when our service or the law changes. The version published here applies.