LingoVik · Legal
Privacy Policy
What personal data LingoVik collects, why we use it, who receives it, how long we keep it, and your rights.
In short
- We collect what we need to run your account and your learning — for example your name, email address, language choices and progress.
- No advertising, no analytics, no tracking cookies — and we never sell your data.
- Your data is stored on your device and in Google Firebase. A few trusted providers help us run LingoVik.
- Paddle handles payments as our reseller. We never see your card number.
- You can download or delete your data, and you can complain to Datatilsynet.
This summary helps you read the document. The full text below is what applies.
1.Who is responsible for your data
[YOUR FULL NAME OR COMPANY NAME] (“we”) is the controller of the personal data described in this policy. This means that we decide why and how your data is used. You can reach us here:
- Name: [YOUR FULL NAME OR COMPANY NAME]
- Address: [POSTAL ADDRESS], Norway
- Organisation number: [ORGANISATION NUMBER, if any]
- VAT (MVA) number: [MVA NUMBER, if registered for VAT]
- Email: support@lingovik.com (privacy questions: privacy@lingovik.com)
- Website: lingovik.com
We have not appointed a data protection officer, because the law does not require one for a service like ours. [LAWYER: confirm that no data protection officer is required]
This policy covers the LingoVik web app at lingovik.com and the emails we send. When you pay for a subscription, Paddle is responsible for the payment data it collects — see Who receives your data.
2.What data we collect
| Type of data | What it includes | Where it comes from |
|---|---|---|
| Account data | Your name, email address and sign-in method, and whether your email address is confirmed. If you sign in with Google: the address (URL) of your Google profile photo. Your password is handled by Firebase Authentication — we never see it. | You, or Google when you sign in with Google |
| Profile and settings | Your avatar (a preset avatar you choose, or your Google photo), your main language, the language you know best, the language you learn and your levels, the app language, and settings such as sounds, theme and reminders. | You |
| Learning progress | Your cards and reviews, spaced-repetition scheduling data, XP, streaks, grammar progress, game scores, and likes and dislikes in the video feed. | Created when you use the app |
| Content you add | Cards you create or import, YouTube videos you add for shadowing, and the words or text you type into AI features. | You |
| Friends [CONFIRM: part of the launch?] | Who your friends are, your friends' names and email addresses, shared streaks, and cheers you send and receive. | You and your friends |
| Notifications | If you turn on notifications: a push subscription (a technical address for your browser's push service) and your notification settings. | Your browser |
| Consent records | Which version of the terms you accepted and when, and your choices about marketing emails, push notifications and YouTube videos. | You |
| Subscription data | Your plan and subscription status, country, amounts, tax and discounts, and Paddle's customer and subscription IDs. We do not receive your card number. | Paddle |
| Bug reports | Your description, the page and item, the app version, your device type and browser (for example “mobile · Android · Chrome 129”), screen size, online status, app and learning language, the last few error messages (with email addresses and codes removed) and your user ID. | You, when you send a report |
| Messages | Emails you send to us, and our replies. | You |
| Technical data | IP address, browser information and the time of requests, in the security logs of our hosting providers. | Your browser, automatically |
What we do not collect
We do not collect your phone number, photos (you cannot upload photos), your precise location, or data for advertising. We do not use analytics or tracking cookies, we do not show ads, and we never sell your data.
Please do not put sensitive information — for example about your health, religion or political views — into cards, AI features or bug reports.
3.Why we use your data, and our legal basis
The General Data Protection Regulation (GDPR) says that we need a legal basis for each use of personal data. This table shows what we use your data for, and on which basis.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create your account, sign you in and keep your account safe | Account data, profile | Contract — GDPR Art. 6(1)(b) |
| Provide the courses, and save and sync your progress between your devices | Profile and settings, learning progress, content you add | Contract — Art. 6(1)(b) |
| AI features that you ask for: Quick add, card exercises, grammar videos and audio overviews, the Persian voice | The words or text you enter for these features | Contract — Art. 6(1)(b) |
| Subscriptions and the free trial: give you access, show your plan, handle changes | Subscription data, account data | Contract — Art. 6(1)(b) |
| Service emails: account and sign-in emails, the reminder before your trial ends, billing notices, answers to your questions, and important messages about the service | Name, email address, subscription data | Contract — Art. 6(1)(b); for important service messages also legitimate interests — Art. 6(1)(f) |
| Friends features: show your progress to your friends and pass on cheers [CONFIRM: part of the launch?] | Name, avatar or Google photo, level, learning language, streak, XP, review counts, game scores | Contract, when you choose to use the feature — Art. 6(1)(b) [LAWYER: or consent?] |
| Push notifications: study reminders, goal messages, cheers and streak reminders from friends | Push subscription, notification settings | Consent — Art. 6(1)(a) and ekomloven § 3-15 |
| Newsletters and marketing emails | Name, email address, app language | Consent — Art. 6(1)(a) and markedsføringsloven § 15 |
| Show YouTube videos | YouTube receives your IP address and device data | Consent — Art. 6(1)(a) and ekomloven § 3-15 |
| Find and fix bugs and wrong content | Bug reports, technical data | Legitimate interests — Art. 6(1)(f): to keep the app working |
| Security, and preventing abuse and fraud — for example misuse of free trials | Account data, subscription data, technical data | Legitimate interests — Art. 6(1)(f): to protect LingoVik and its users |
| Improve the service in a minimal way — for example by seeing which content is often reported or disliked | Bug reports, likes and dislikes, counts | Legitimate interests — Art. 6(1)(f): to improve the course content |
| Bookkeeping and other legal duties | Subscription and payment records | Legal obligation — Art. 6(1)(c): the Norwegian Bookkeeping Act (bokføringsloven) |
| Handle your requests, and legal claims | Messages, consent records, other relevant data | Legal obligation — Art. 6(1)(c); legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have checked that our interests do not override your rights. You can object — see Your rights.
To create an account, you must give an email address and [CONFIRM: a name]. Without them, we cannot provide the service. Everything else is optional, but some features need it.
We do not make decisions about you that are based only on automatic processing and that have legal or similarly significant effects for you. The app uses automatic rules to plan your reviews (spaced repetition) and to choose practice for you — this only affects your learning in the app.
4.Where your data is stored
- On your device. The app stores your progress, your settings and a copy of the course in your browser (IndexedDB and local storage), so that it is fast and works offline. See the Cookie and Storage Policy.
- In Google Firebase. When you are signed in, your data is synced to Cloud Firestore, Google's cloud database. Location: [CONFIRM: Firestore location]. Reminders are sent by Firebase Cloud Functions. [CONFIRM: Cloud Functions region — the default is us-central1, USA]
- At Cloudflare. Our website runs on Cloudflare's network, which also stores shared audio and pictures (Cloudflare R2) and protects the service against attacks.
- At Vercel. A small number of invited users still use an older copy of the app, which is hosted by Vercel.
5.What other learners can see
- Friends [CONFIRM: Friends feature at launch — see README]: if you and another learner are friends in LingoVik, they can see your display name, your avatar or Google profile photo, your level and learning language, your streak and XP, how many cards you reviewed today and this week, and your best game scores. They can also see the email address that was used to add you. Friends can send you cheers, which can arrive as push notifications. So that friends can find you, your email address and name are stored in a lookup list that is connected to your account.
- Shared content [CONFIRM: keep for the launch?]: cards you add with Quick add or by CSV import, and YouTube videos you add for shadowing, are shared with other learners. Do not put personal information in them.
- Other learners cannot see your settings, your bug reports or your payment information.
6.Who receives your data
We share personal data only when it is needed for the purposes above. These service providers (processors) help us run LingoVik. They may use your data only to help us, under a data processing agreement:
| Provider | What they do for us | Data | Location and safeguard |
|---|---|---|---|
| Google — Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging | Sign-in, database and sync, reminders | Account data, profile and settings, learning progress, content you add, consent records, push subscriptions, bug reports | [CONFIRM: Firestore location]; Google may also process data in the USA — EU–U.S. Data Privacy Framework and Standard Contractual Clauses |
| Google — Gemini API | AI features: Quick add, card exercises, grammar videos and audio overviews, the Persian voice | The words or text you enter for these features — not your account data | USA and other countries — Data Privacy Framework and Standard Contractual Clauses [CONFIRM: paid Gemini tier, so that Google does not use the data to improve its products] |
| Cloudflare | Hosting, content delivery, storage of shared audio and pictures (R2), protection against attacks | IP address, browser information, requests, security logs | Global network, USA — Data Privacy Framework and Standard Contractual Clauses |
| Resend | Sending emails | Name, email address, the content of the email, delivery status | USA — Data Privacy Framework and Standard Contractual Clauses |
| Vercel | Hosting of an older copy of the app that a few invited users still use | IP address, requests, and the data those users sync | USA and other countries — Data Privacy Framework and Standard Contractual Clauses |
These companies receive some data as independent controllers. They decide themselves how they use it, and their own privacy policies apply:
| Company | When and why | Data | Their policy |
|---|---|---|---|
| Paddle.com Market Limited (United Kingdom) | When you buy or manage a subscription: Paddle is the Merchant of Record and handles payment, tax, invoices, refunds and fraud checks | Name, email address, payment details, country and address, IP address, purchase history | Paddle Privacy Notice (opens in a new tab) |
| Google — Google sign-in | When you sign in with Google | Information about the sign-in | Google Privacy Policy (opens in a new tab) |
| YouTube (Google) | Only after you agree to load YouTube videos | IP address, device and browser data; YouTube may store cookies | Google Privacy Policy (opens in a new tab) |
| Your browser's push service — for example Google, Mozilla, Apple or Microsoft | When you have turned on notifications: it delivers them to your device | The push subscription and the notification (encrypted) | The privacy policy of your browser's maker |
These services provide content for the app. LingoVik sends them text or requests, but not your account data:
| Service | What it does | What it receives |
|---|---|---|
| Google Cloud Text-to-Speech | Pre-made audio for the course | Course text only — no personal data |
| Microsoft — Edge read-aloud service | A backup voice for text that has no pre-made audio | The text to be read aloud. [CONFIRM: our server sends the request, so Microsoft normally sees our server's IP address, not yours] |
| Google Translate and MyMemory (Translated srl, Italy) | Translation of some content | The text to translate. [CONFIRM: does this ever include text that users type?] |
| Pexels, Unsplash and Pixabay | Photos for cards | Course words as search terms. Your browser may load the photos from their servers, which then see your IP address. |
| Pollinations | AI pictures made from course words | Course words. Your browser loads the picture from Pollinations' server, which sees your IP address. |
| GIPHY | Reward GIFs | Search words. Your browser loads the GIFs from GIPHY's servers, which see your IP address. |
| YouTube image server | Preview pictures of videos | Your browser loads them from YouTube (i.ytimg.com), which sees your IP address. [CONFIRM: load previews only after consent, or keep as now] |
| Supadata | Fetches the transcript of a YouTube video when it is added for shadowing | The video's address |
We may also share data when the law requires it (for example with the police or other authorities), with our advisers (such as a lawyer or an accountant) who must keep it confidential, or with a buyer if LingoVik is sold — and then we tell you first.
7.Transfers outside the EU/EEA
Some providers are in the USA or the UK, or use staff and servers there. When your data goes outside the EU/EEA, we make sure that it is protected:
- USA: the provider is certified under the EU–U.S. Data Privacy Framework, and/or we have signed the EU's Standard Contractual Clauses with them.
- United Kingdom (Paddle): the European Commission has decided that the UK protects personal data well enough (an “adequacy decision”).
You can ask us for more information about these safeguards at privacy@lingovik.com. [LAWYER: verify each provider]
8.How long we keep your data
Proposal
These periods are a proposal and still need to be confirmed. [CONFIRM: retention periods]
| Data | How long we keep it |
|---|---|
| Account data, profile, learning progress and content you add | Until you delete your account. After that, it is removed from our backups within 30 days. |
| Data on your device | Until you delete it — for example with Reset everything in Settings, or by clearing the site data in your browser. |
| Bug reports | 12 months. |
| Consent records | As long as we need to be able to show that you gave your consent — normally while your account exists, and for [CONFIRM: e.g. 3] years after that. |
| That you unsubscribed from marketing emails | We keep a note of it, so that we do not email you again. |
| Subscription and payment records | 5 years after the end of the financial year (Norwegian Bookkeeping Act § 13). Most of these records are held by Paddle; we keep a copy of the subscription data. |
| Emails to and from support | [CONFIRM: e.g. 2 years after your question is answered] |
| Push subscriptions | Until you turn off notifications, the subscription expires, or you delete your account. |
| Security logs | As long as our providers keep them — usually from a few days to a few months. |
| Shared content (cards and videos you added) | [CONFIRM: deleted with your account, or kept for other learners without any link to you?] |
9.Your rights
Under the GDPR, you have these rights:
- Access: get a copy of the data we have about you.
- Correction: have wrong data corrected. You can change most of your data yourself in Settings.
- Deletion: have your data deleted (“the right to be forgotten”).
- Restriction: ask us to limit how we use your data, for example while we check a complaint.
- Data portability: get the data you gave us in a machine-readable format, or have it sent to another service.
- Objection: object to our use of your data based on legitimate interests.
- Withdraw consent: at any time, for anything you agreed to. This does not affect what we did before you withdrew it.
- Complain: to Datatilsynet (see Complaints).
How to use your rights
- Download your data: Settings → Account → Download my data.
- Delete your account and your data: Settings → Account → Delete my account.
- Anything else: email privacy@lingovik.com.
We answer within one month. If a request is complex, we can extend this by up to two more months — then we tell you why. Using your rights is free. We may ask you to confirm who you are, for example by writing from the email address of your account.
For the payment data that Paddle holds, you can also contact Paddle directly.
10.Your choices
- Marketing emails: use the unsubscribe link in any marketing email, or email us.
- Push notifications: Settings → Notifications, or the site settings in your browser.
- YouTube videos: Settings → Privacy → YouTube videos → Stop allowing YouTube.
- Data on your device: Settings → Data → Reset everything deletes the app data on that device and signs you out.
11.Complaints
If you think that we handle your data in a wrong way, please tell us first at privacy@lingovik.com — we want to fix it.
You also have the right to complain to Datatilsynet, the Norwegian Data Protection Authority: Postboks 458 Sentrum, 0105 Oslo, Norway — datatilsynet.no (opens in a new tab). If you live in another EU/EEA country, you can also complain to the data protection authority there.
12.Age limit
LingoVik is only for people aged 18 or older. We do not knowingly collect data about anyone under 18. If we learn that a user is under 18, we close the account and delete the data. If you think that a child is using LingoVik, please tell us at privacy@lingovik.com.
13.How we protect your data
- All connections are encrypted (HTTPS).
- Passwords are handled by Firebase Authentication. We never see or store your password.
- Card and payment details are handled by Paddle. We never see your card number.
- Access rules in our database make sure that each account can only read and change its own private data. [CONFIRM: database rules updated for the public launch]
- A secure, HttpOnly session cookie protects access to the service.
- Only the people who run LingoVik can access the systems, and only when it is needed.
- Bug reports remove email addresses, passwords and codes from error messages before they are sent.
No system is 100% secure. If a security breach puts your data at risk, we tell you and Datatilsynet as the law requires. If you share a device with others, sign out after use.
14.Changes to this policy
We update this policy when our service or the law changes. If a change is important, we tell you by email or in the app before it takes effect. The version and date at the top of this page show the latest update.
15.Contact
Questions about privacy? Email privacy@lingovik.com.
[YOUR FULL NAME OR COMPANY NAME], [POSTAL ADDRESS], Norway.