Privacy Policy

1. Data Controller

Note on third-country transfer: The controller is based in the USA. Processing of data of EU-based users is subject to the GDPR based on the market location principle (Art. 3 Para. 2 GDPR), as Langsi offers services to users in the EU.

2. Data Protection Contact

A formally appointed Data Protection Officer (DPO) is not legally required at the current company size. For all data protection inquiries, please contact: info@data-informed-decisions.com

3. Legal Bases for Processing (GDPR)

We process personal data on the following legal bases under GDPR:

• Art. 6(1)(a) GDPRConsent – e.g. for optional analytics (Google Analytics) and email notifications
• Art. 6(1)(b) GDPRContract performance – providing the platform, learning features and subscription management
• Art. 6(1)(c) GDPRLegal obligation – e.g. tax and accounting retention requirements
• Art. 6(1)(f) GDPRLegitimate interests – e.g. platform security, abuse prevention, system analytics

4. Hosting (Base44)

The Langsi platform is hosted via Base44. Server infrastructure, authentication services and database services are provided by Base44 Inc. Legal basis: Art. 6(1)(b) and (f) GDPR.

5. Server Log Files

When accessing our platform, the following data is automatically stored in server log files:

• IP address of the requesting device
• Date and time of the request
• Requested URL
• Browser type and version
• Operating system
• HTTP status code

Retention period: 30 days, then automatic deletion. Legal basis: Art. 6(1)(f) GDPR.

6. User Accounts and Registration

Registration is required to use Langsi. We process:

• Email address
• Password (stored encrypted, no plaintext)
• Full name (optional, transmitted via Google login)
• Login timestamp and method (email/Google)
• User role (standard user or administrator)

Legal basis: Art. 6(1)(b) GDPR. For Google login: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (privacy policy: policies.google.com/privacy).

7. Learning Progress Data

To provide the core service, we store learning progress data, in particular:

• Learned and reviewed vocabulary (Leitner box system)
• Day-based learning sessions (date, goals, progress)
• Response times and error rates per vocabulary item
• Learning streak and overall statistics
• Preferred learning modes and settings
• Selected learning languages and daily learning goals

Legal basis: Art. 6(1)(b) GDPR. Retention: until account deletion.

9. Cookies and Local Storage

10. Payment Processing (Stripe)

Paid services are processed via Stripe, Inc. · 510 Townsend Street, San Francisco, CA 94103, USA / Stripe Payments Europe, Ltd. · 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Payment data (credit card details, billing address etc.) is transmitted directly to Stripe. Langsi does not receive or store complete payment instrument information. Stripe may process data in the USA. Legal basis for transfer: EU Standard Contractual Clauses (SCC) and EU-US Data Privacy Framework. We store internally: Stripe customer ID, subscription ID, plan, status and term data – solely for subscription management. Stripe privacy policy: stripe.com/privacy. Legal basis: Art. 6(1)(b) GDPR.

11. Analytics (Google Analytics 4)

We use Google Analytics 4 to analyze platform usage, provided you have consented. Google Ireland Limited · Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is only loaded after your consent via the cookie banner. IP anonymization is enabled (anonymize_ip: true). Pseudonymous usage data may be transmitted to Google servers in the USA. Legal basis for transfer: EU Standard Contractual Clauses (SCC). Google privacy policy: policies.google.com/privacy. Legal basis: Art. 6(1)(a) GDPR.

Revoke consent: Privacy Settings

12. Email Dispatch (Resend)

For sending emails (welcome emails, daily learning summaries, OTP verification codes) we use Resend Inc. · 2261 Market Street #5137, San Francisco, CA 94114, USA. Email address and message content are transmitted to Resend. Resend processes data in the USA. Legal basis for transfer: EU SCC. Legal basis: Art. 6(1)(b) GDPR (transactional) / Art. 6(1)(a) GDPR (optional summaries after consent in profile settings).

13. AI Services (Language Models)

To generate vocabulary, example sentences, personalized learning content and AI coaching messages, we use AI language models. Requests contain exclusively language-related content (words, learning context) and no directly personal user data. Services used via the Base44 platform include Google Gemini (Google LLC). Legal basis: Art. 6(1)(b) and (f) GDPR.

14. Text-to-Speech Services (TTS)

For vocabulary pronunciation, we use text-to-speech services. Vocabulary and example sentences (no personal data) are transmitted to external TTS providers. Primary service: Web Speech API (browser-native, Google Chrome TTS) – data processing in the user's browser; for cloud services: Google LLC. Legal basis: Art. 6(1)(b) GDPR.

15. International Data Transfers

As the controller (Data Informed Decisions LLC) is based in the USA and various US service providers are used, data is regularly transferred to the USA. We ensure appropriate safeguards exist:

• EU-US Data Privacy Framework – for certified US providers (Stripe, Google)
• EU Standard Contractual Clauses (SCC) – Art. 46(2)(c) GDPR – for non-certified providers

16. Retention Periods

17. Your Rights as a Data Subject

You have the following rights under GDPR:

• Art. 15 GDPRRight of access to stored data
• Art. 16 GDPRRight to rectification of inaccurate data
• Art. 17 GDPRRight to erasure ('right to be forgotten')
• Art. 18 GDPRRight to restriction of processing
• Art. 20 GDPRRight to data portability
• Art. 21 GDPRRight to object to processing

To exercise your rights, contact: info@data-informed-decisions.com

18. Right to Withdraw Consent

Where processing of your data is based on consent (Art. 6(1)(a) GDPR), you have the right to withdraw it at any time with effect for the future. Withdrawal possible via:

• Privacy Settings in the App
• Profile page > Notification settings (for email summaries)
• By email: info@data-informed-decisions.com
• Request Account Deletion

19. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). As the operator is based in the USA, EU users may contact the data protection authority of their country of residence. For German users: Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI) or the competent state authority. www.bfdi.bund.de

www.bfdi.bund.de

20. Account Deletion and Data Erasure

You can delete your account and all associated data at any time via: Profile > Account Information > Delete Account. Deletion covers: learning progress data, daily sessions, UserSettings and all personal configurations. Billing data is retained as required by law. Alternatively by email: info@data-informed-decisions.com – processed within 30 days.

Submit a verified deletion request