Privacy Policy

1. Who is responsible for your data

LingoNibble, established in Belgium, is the data controller for personal data processed through lingonibble.com and the LingoNibble web app. You can reach us about any privacy matter at support@lingonibble.com.

This policy explains what we collect, why, how long we keep it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).

2. What we collect

Account data: your email address, display name, chosen interface language and target language, and authentication identifiers. If you sign in with Google, we receive your email address, name and profile picture from Google — never your Google password.

Learning data: units and sections completed, exercise answers and mistakes, placement and level-check results, practice minutes, milk and cookie balances, and settings such as audio preferences.

AI practice data: the text messages you send to the AI tutor and roleplay simulations, the model's replies, and — if you use voice input — the audio recording you make and its transcript.

Purchase data: the cookie packs you buy, amount, currency, VAT country, timestamp and Stripe payment identifiers. We never receive or store your full card number.

Technical data: IP address, device and browser type, approximate country, and app error and performance logs. Some learning progress is also stored locally in your browser so the app works offline.

3. Why we use it, and our legal basis

To provide your account, save your progress and deliver the courses you use — performance of our contract with you.

To operate the AI tutor, simulations, transcription and translation features you choose to use — performance of our contract with you.

To process purchases, credit cookies, calculate VAT and keep accounting records — performance of our contract and compliance with our legal obligations.

To keep the service secure, prevent abuse of the AI features, and diagnose faults — our legitimate interest in a safe, working product.

To send service emails such as sign-in links, password resets and purchase receipts — performance of our contract. Marketing emails, if we ever send them, require your consent and can be withdrawn at any time.

To show advertising on blog articles — based on your cookie consent only (see section 7).

4. AI features: audio and transcripts

When you chat with the AI tutor or run a roleplay simulation, your messages are sent to our AI provider to generate a reply. When you use voice input, your audio is sent for speech-to-text transcription and a text transcript is returned.

We keep AI chat transcripts and any associated voice recordings for a maximum of 30 days, after which they are deleted. They are retained during that window only to deliver the conversation, restore an interrupted session, and investigate abuse or technical faults.

Your conversations and recordings are not used to train third-party AI models. We do not sell them and we do not use them for advertising. Please do not enter sensitive personal data, credentials or confidential information into AI chats.

5. Who we share data with

Hosting and database provider (Supabase / AWS EU-West): stores your account, learning progress and purchase records within the EU/EEA.

AI providers (Lovable AI Gateway / Google Gemini): receive your chat messages and voice recordings solely to generate replies and transcripts.

Stripe: processes payments and handles card data as an independent controller for its own compliance purposes.

Google (Analytics and AdSense): only where you have consented to analytics or advertising cookies.

Email provider (Resend / Supabase email): delivers sign-in and transactional emails.

We never sell your personal data. Where a provider is outside the EEA, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.

6. How long we keep data

Account and learning data: while your account is active. If you delete your account, we erase it within 30 days, except where we must keep records for longer by law.

AI chat transcripts and voice recordings: maximum 30 days (see section 4).

Purchase and invoice records: 7 years, as required by Belgian accounting and tax law.

Security and error logs: up to 12 months.

7. Cookies and advertising

We use strictly necessary cookies and local storage to keep you signed in and to save your progress and settings. These cannot be switched off without breaking the app.

Analytics and advertising cookies are set only after you consent. Advertising is shown on our blog articles; Google and its partners may use cookies to serve and measure ads. You can withdraw or change your consent at any time from the cookie settings in the app, and manage ad personalisation at google.com/settings/ads.

8. Your rights

You have the right to access your data, correct it, erase it, restrict or object to processing, receive a portable copy, and withdraw consent where processing is based on consent. You can export or delete your account data yourself from Settings, or write to support@lingonibble.com. We respond within one month.

If you believe we have mishandled your data, you may lodge a complaint with the Belgian Data Protection Authority (Autoriteit Gegevensbescherming, Drukpersstraat 35, 1000 Brussels) or with the supervisory authority in your country of residence.

9. Children

LingoNibble is not intended for children under 16. We do not knowingly collect data from children under 16; if you believe a child has created an account, contact support@lingonibble.com and we will delete it.

10. Security and changes to this policy

Data is transmitted over HTTPS, stored on access-controlled infrastructure, and protected by row-level access rules so you can only reach your own records. No system is perfectly secure; we will notify you and the supervisory authority of a data breach where the law requires it.

We may update this policy. The current version is always published here with its last-updated date, and we will notify you in the app or by email before material changes take effect.

11. Contact

Privacy questions, access and deletion requests: support@lingonibble.com.