Privacy Policy / Политика конфиденциальности

Controller / Ответственный

AstroLingua is operated by MATTALNET GRUPP OÜ, Tuukri tn 19-315, 10120 Tallinn, Estonia. Requests related to your data can be sent to kontakt@mattalnet.com.

Data we collect

• Account data: email address, optional display name, hashed password.
• Learning data: vocabulary progress, session results, study plans — stored to power spaced repetition and statistics.
• Technical data: logs (IP address, timestamp, route) kept for up to 30 days for security purposes.
• What you send to the exercises: your written answers, and — if you use dictation — the recording of what you said, for as long as it takes to grade or transcribe it.
• Push tokens: if you allow reminders in the app, the device token your phone's push service issues.

We do not sell, share or rent your personal data to third parties.

Legal basis (GDPR Art. 6)

• Performance of a contract (Art. 6(1)(b)) — processing account and learning data to deliver the service.
• Legitimate interests (Art. 6(1)(f)) — security logging.

Your rights

Under GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to processing. Contact us at the address above to exercise these rights. You may also delete your account directly in Settings → Account.

Data retention

Account and learning data is retained until you delete your account. You can request deletion at any time.

Hosting

The service is hosted by IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) on a dedicated server in Germany. Everything you learn with — your account, your progress, your texts — lives on that server.

Processors we use / Kто обрабатывает данные по нашему поручению

Four things leave our own server, each for one purpose and none of them to advertise to you. We name them because a policy that says “selected partners” says nothing.

• Google Ireland Ltd. — the language model that grades free answers and writes feedback (Gemini API): the text of that one exercise and your answer are sent, no account data. Also Google Sign-In, if you choose it, and Firebase Cloud Messaging for push reminders.
• Microsoft Ireland Operations Ltd. — Azure Speech: the sentence to be spoken, or the recording you dictated, for synthesis or transcription.
• one.com A/S (Denmark) — the mail server that sends sign-in, password and reminder e-mails.
• Apple and Google app stores — if you install the app from them, they process the purchase and the subscription; we never see your payment details.

Each of them acts on our instructions under a data processing agreement (Art. 28 GDPR).

Transfers outside the EU

Google and Microsoft are contracted in Ireland, but both may process data in the United States. That happens on the basis of the EU-US Data Privacy Framework, to which both are certified, and the EU standard contractual clauses. Everything else stays on the German server.

Cookies and local storage

We set no advertising or analytics cookies. Your browser keeps a sign-in token and your language and theme choice; the app keeps your lessons for offline use. All of it is needed for the service to work, and none of it follows you to other sites.

Right to object (Art. 21 GDPR)

Where we process data on the basis of our legitimate interest — security logging — you may object at any time, giving reasons arising from your particular situation. Write to the address above.

Supervisory authority

You have the right to lodge a complaint with a supervisory authority. Ours, as an Estonian company, is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee). You may also complain to the authority of the country you live in — in Germany, the one of your federal state.

Data protection officer

We have not appointed a data protection officer: we are a small company, and our processing does not meet the thresholds of Art. 37 GDPR. Data protection questions go to the address above and are answered by us.