Privacy Policy

This policy explains what personal data we handle when you use eLang, why we handle it, and what you can do about it. It is written to be read, not to be survived.

The short version. You can browse our site without an account. If you create one, we store your email and what you learn so the Service works across your devices. Your account data lives on servers in the European Union. We do not sell your personal data for money. Analytics and advertising cookies only run if you accept them, and you can change that decision at any time from the Cookie settings link in the footer. You can delete your account, and the data attached to it, from your account settings at any time.

The rest of this page is the detail behind those statements.

1. Who we are and what this covers

The company named in the box above is the controller of the personal data described here. In this policy we call it "we", "us" or "the Company", and we call you "you".

This policy covers the products we publish under the eLang brand (together, the "Service"):

• the eLang website at elang.app, including your account area;
• the eLang browser extension for Chrome, Edge, Opera and other Chromium browsers;
• the eLang teaching platform;
• our mobile apps and language games distributed through the App Store, Google Play and other app stores.

It does not cover other companies' websites, apps or services that we link to. When you follow a link out of the Service, the privacy policy of the destination applies.

If you use the Service on behalf of a school or an employer, that organisation may have its own agreement with us. Where that agreement says the organisation decides how your data is used, the organisation is the controller and you should also read its privacy notice.

2. What personal data we collect

We collect only what a given feature needs. Depending on which parts of the Service you use, that can include:

We do not ask you for, and do not want, special category data — health, biometric, political, religious or similar information. Please do not put it into support messages or study material you save.

Payment cards. We never receive or store your full card number. Card details go directly to our payment providers (see section 5).

3. Why we use it, and our legal basis

Under the GDPR every use of personal data needs a lawful basis. Ours are set out below. Where the basis is consent, you can withdraw it at any time and we stop; withdrawal does not undo what we lawfully did before.

Where we rely on legitimate interests, we have weighed our interest against your rights and concluded that the processing is limited to what you would reasonably expect. You can ask us for that assessment, and you can object (section 8).

4. Cookies and similar technologies

Nothing beyond what is strictly necessary runs before you choose. Analytics and advertising tags stay switched off until you accept them, and switch back off if you withdraw.

You can change your decision at any time using the Cookie settings link in the footer of every page. Our full Cookie Policy lists each category and the providers inside it.

We also treat a browser's Global Privacy Control signal as a valid objection to advertising cookies where the law recognises it.

5. Who we share data with

We do not sell your personal data for money. We share it only with the providers below, only for the purposes listed, and only under a written contract that requires them to protect it and to act on our instructions.

We may also disclose personal data:

• to professional advisers — lawyers, accountants, auditors — bound by confidentiality;
• to a public authority, court or regulator where the law requires it, after checking that the request is valid and limited;
• to a buyer or investor if we sell or reorganise the business, under confidentiality, with notice to you if the controller changes.

6. Sending data outside the EEA

Your account and learning data is stored in the European Union. Some of the providers above are based in, or support their services from, the United States and other countries outside the European Economic Area.

Where that happens, the transfer is covered by one or more of:

• an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for providers certified under it;
• the European Commission's Standard Contractual Clauses, together with additional technical and organisational measures where our assessment shows they are needed;
• your explicit consent, or the necessity of the transfer to perform a contract with you, in the narrow cases where those apply.

You can ask us which mechanism covers a specific provider, and we will tell you.

7. How long we keep data

The retention column in section 3 is the rule. Two things sit on top of it:

• Deleting your account. You can delete your account from your account settings. When you do, we remove your profile and learning data from our live systems. Encrypted backups roll over within 30 days.
• What survives deletion. We keep payment and invoice records for the period Polish tax law requires, a minimal suppression record if you unsubscribed from marketing, and anything we need for a live legal claim. Nothing in that residue is used to profile you or to market to you.

8. Your rights

If the GDPR applies to you, you have the right to:

• know what we hold and get a copy of it;
• correct data that is wrong or incomplete;
• erase your data, where we no longer have grounds to keep it;
• restrict how we use it while a dispute about it is resolved;
• port the data you gave us to another provider in a machine-readable format;
• object to processing based on legitimate interests, and — with no need for a reason — to direct marketing, which we then stop;
• withdraw consent at any time, including through the cookie settings;
• not be subject to a decision made solely by automated means that produces a legal or similarly significant effect on you. We do not make such decisions.

How to use them. Write to the email address in the box at the top of this page. We answer within one month. If a request is unusually complex we may take up to two further months, and we will tell you why within the first month. We do not charge for this. We will ask you to confirm you control the account email before we act — that check protects you, not us, and we will not demand more identification than the request needs.

If we get it wrong. You can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl, or to the authority where you live or work. We would rather you told us first, but that is your choice, not a condition.

9. If you are in the United States

We handle personal information the same way everywhere. This section adds what US state privacy laws require us to state plainly.

What we collect and why is set out in sections 2 and 3. We collect the categories that those laws call identifiers, commercial information, internet activity, approximate geolocation and inferences. We disclose them to the service providers in section 5.

Selling and sharing. We do not sell your personal information for money. When you accept marketing cookies, advertising providers may receive identifiers in a way that some US state laws classify as "selling" or as "sharing for cross-context behavioural advertising". Rejecting marketing cookies, or leaving them off, is your opt-out. Our banner and the Cookie settings link are the opt-out mechanism, and we honour the Global Privacy Control signal as an opt-out request.

Sensitive personal information. We do not collect it and do not use it to infer characteristics about you.

Your rights. Depending on your state, you can ask us to disclose, correct, delete or provide a portable copy of your personal information, and appeal a refusal. Contact us at the email above. We will not discriminate against you for exercising these rights: no worse price, no degraded Service.

Minors. We do not knowingly sell or share the personal information of anyone under 16.

10. If you are elsewhere

• United Kingdom. The UK GDPR gives you the same rights as section 8. Your regulator is the Information Commissioner's Office, https://ico.org.uk.
• Switzerland. The revised Federal Act on Data Protection gives you equivalent rights; your regulator is the FDPIC.
• Brazil. Under the LGPD you have rights of confirmation, access, correction, anonymisation, portability, deletion and information about sharing.
• Canada, Australia, Japan, South Korea, Türkiye and other countries with general privacy laws: the rights in section 8 are available to you as a matter of our policy, whatever your local law requires as a minimum.

If your local law gives you more than this policy does, your local law wins.

11. Children

The Service is for people aged 16 and over. We do not knowingly create accounts for children below that age.

Some countries set the age of consent for online services lower, at 13, 14 or 15. Where the law where you live allows it and your parent or guardian consents, a younger user may use the Service — but we do not have a mechanism to verify parental consent today, so we ask younger users not to register.

If you believe a child has given us personal data, write to us at the address above and we will delete the account and its data.

12. The browser extension

The extension exists to translate what is on the page you are reading and to save words you want to learn. That means it reads page content, and we want to be exact about what happens to it.

• It reads the text, subtitles or captions of the page only on the pages where you use it, and only the part needed for the feature you triggered.
• Text sent for translation is processed to return the translation and is not stored by us afterwards and not used to build a profile of your browsing.
• Words, phrases and sets you choose to save are stored against your account so they appear on your other devices.
• The extension does not collect your browsing history, does not read pages in the background, and does not sell anything to anyone.
• It needs broad site permissions for a simple reason: it cannot know in advance which page you will want to translate. The permission is broad; the reading is not.

We publish the extension's data handling in the Chrome Web Store listing as well. If the listing and this policy ever disagree, tell us — one of them is wrong and we will fix it.

13. Mobile apps and purchases

Our apps use the same account as the website. Purchases made inside an app go through Apple or Google, who are the merchant for those transactions and who apply their own privacy policies to the payment itself. We receive from them, through RevenueCat, the fact and status of your purchase, not your payment details.

Each app's store listing carries a privacy label describing the same processing as this policy. If you find a discrepancy, this policy is the one we will correct the listing against.

14. Microphone and speech

Some features ask for microphone access to check pronunciation. Speech is converted to text by the speech recognition built into your operating system or browser. We do not record, store or transmit audio. We may store the resulting text and score as part of your learning data. You can withdraw microphone permission in your device settings at any time; only the pronunciation features stop working.

15. How we protect data

We use measures appropriate to the risk, including:

• encryption in transit (HTTPS/TLS) across the Service, and encryption at rest for stored account data;
• passwords stored only as salted hashes — we cannot read your password, and neither can anyone who steals the database;
• access to production data restricted to the small number of people who need it for their work, with individual accounts and multi-factor authentication;
• separate development and production environments, so real data is not used for testing;
• logging and monitoring of access to production systems;
• written data-processing agreements with every provider in section 5.

No system is perfectly secure, and anyone who tells you otherwise is selling something. What we commit to is proportionate protection and honest handling when something goes wrong.

16. If there is a data breach

If personal data is breached and the breach is likely to result in a risk to your rights, we notify UODO within 72 hours of becoming aware of it. If the risk to you is high, we also tell you directly and without undue delay, in plain language: what happened, what data was involved, what we are doing, and what you should do.

If you think you have found a security vulnerability in the Service, please write to us at the address above before disclosing it publicly. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

17. Automated decision-making

We do not make decisions about you by purely automated means that produce legal effects or similarly significant effects. Our systems adapt the difficulty of exercises and suggest content based on your progress; that is personalisation of a learning product, and you can change or ignore any of it.

If you accept marketing cookies, advertising providers may build profiles for the purpose of showing ads. Section 4 tells you how to stop that.

18. Changes to this policy

We update this policy when what we do changes. The date the current version took effect is in the box at the top.

If a change materially affects how we use your data, we tell you before it takes effect — by email or by a notice in the Service — and, where the change needs your consent, we ask for it rather than assuming it. We do not make material changes retroactive.

Earlier versions are available on request.

19. Contact

Write to the email address at the top of this page, or use the contact form at elang.app/contacts, for anything in this policy — a rights request, a question, a correction, or a complaint. A person reads it.

We have not appointed a Data Protection Officer, because our processing does not meet the threshold in Article 37 of the GDPR. The contact above reaches the people responsible for data protection.

20. Language

This policy is published in several languages. The English version is the authoritative one: if a translation and the English text disagree, the English text applies, except where the law where you live requires otherwise.