Privacy Policy

This policy explains which personal data we process when you use NuovaLingua, why, for how long, who we share it with and what rights you have. It is written under Regulation (EU) 2016/679 (GDPR) and describes how the Platform really works: wherever it says “if you enable”, “if you consent” or “if you use”, that thing does not happen without an action of yours.

1. Data controller

The controller is Patryk Lewczuk, trading as the sole proprietorship Patryk Lewczuk Nuovalingua (registered in the Polish CEIDG business register), tax ID (NIP) 6772545398, al. 3 Maja, 30-062 Kraków, Poland. For any question about your data write to privacy@nuovalingua.com (phone +48 789 818 641). No data protection officer has been appointed, as it is not mandatory for this activity.

2. What data we process

We only collect the data needed to run the service. Here it is, grouped by where it comes from.

• Account: name, email address, password (stored only as a bcrypt hash, never in clear), role (Student or Teacher), interface language, language you study, time zone, optional profile photo, the interests and goals you declare, the date you accepted the Terms and the date you confirmed being at least 18. Your date of birth is used only for the age check during sign-up and is not stored. You may optionally tell us whether you prefer to be greeted in the masculine or feminine form: that is the only use of that information.
• Sign-in with Google: if you choose to sign in with your Google account, we receive from Google your name, email, profile picture and an account identifier. We never receive or store your Google password.
• Teacher profile: photo, presentation (in the languages you write it in), languages taught, rate, availability, reviews received. To pay you: legal name, country and tax identifier, passed to Stripe for the Teacher's payout account. See section 4.
• Lessons: bookings, any notes you write when booking, calendar and availability, cancellations, the rating and review you leave after a lesson. If you connect your Google Calendar, we store the access tokens issued by Google and the identifiers of the events we create in your calendar.
• Virtual classroom: during a lesson, audio and video flow in real time through Daily's infrastructure. In the classroom your name appears in short form (for example “Anna K.”). Daily does not keep the lesson.
• Lesson recording and analysis (Students): if analysis is on, the browser of whoever is in the classroom records the lesson audio — their own voice and the other person's — and uploads it to our storage when the lesson ends. The audio is transcribed automatically and the audio file is deleted right after transcription. The transcript and the learning report stay in the Student's account and are visible to the Teacher who gave the lesson. The Student can turn analysis off in Settings: from then on their lessons are not recorded. Details in sections 3 and 8.
• Study and content: saved words, notes, exercise results, mistakes kept for review, reading progress, readings created on request for you, sheets assigned by the Teacher, game counters (lives, streak, level).
• Conversations with the AI assistant (Nova, Ambrogio, scenes and missions): the messages you type or dictate and the replies you receive. For voice chats with Nova, the audio you record is transcribed and not kept as a file.
• Messages: your conversations with your Teacher or Students, with any attachments (images). Support requests: name, email, message and any screenshots.
• Payments: handled by Stripe. We never see or store your full card number; we keep the Stripe customer and subscription identifiers, amounts, currency, status and the history of payments and refunds.
• AI usage: for every request we record which feature you used and its estimated cost, to apply the limits of your plan.
• Communications: service emails (we keep a log of what was sent, with recipient, subject and outcome), in-app notifications, push notifications only if you enable them in your browser, promotional emails only if you opted in.
• Technical data: IP address and account identifier to limit repeated requests (anti-abuse, kept for minutes or at most a week), the host's technical logs, browser type. The channel you found us through (for example “instagram”), only if you consented to the measurement cookie or tell us yourself at sign-up.

3. Purposes and legal bases

• Creating and managing your account, running the Platform, lessons, classroom and messages — performance of the contract (art. 6(1)(b)).
• Age check at sign-up — legal obligation and contract (art. 6(1)(c) and (b)).
• Recording, transcribing and analysing lessons — performance of the contract (art. 6(1)(b)): the learning report is part of the lesson service and is included in the Plus and Premium plans. The Student can turn it off at any time in Settings, with effect on later lessons. By teaching on the Platform, the Teacher accepts that lessons may be recorded for this purpose.
• Artificial-intelligence features (conversation, scenes, corrections, translations, readings on request, text-to-speech) — performance of the contract (art. 6(1)(b)).
• Payments, invoicing, accounting and Teacher payouts — contract and legal obligations (art. 6(1)(b) and (c)).
• Publishing and promoting the Teacher's profile — contract with the Teacher (art. 6(1)(b)) and legitimate interest in promoting the service (art. 6(1)(f)). See section 4.
• Security, fraud and abuse prevention, limiting repeated requests — legitimate interest (art. 6(1)(f)).
• Service emails and notifications (confirmations, reminders, messages received) — performance of the contract (art. 6(1)(b)). Push notifications only start if you enable them in your browser and you can switch them off at any time.
• Promotional emails — consent (art. 6(1)(a)), withdrawable in Settings.
• Measuring acquisition channels (nl-src cookie) and the Meta pixel — consent given in the cookie banner (art. 6(1)(a)), withdrawable via “Cookie preferences” in the footer.
• Tax obligations, handling complaints and defending rights — legal obligation and legitimate interest (art. 6(1)(c) and (f)).

We make no automated decisions with legal or similarly significant effects on you. The limits of your plan (for example the number of lives or the monthly AI allowance) are rules that apply equally to everyone, enforced automatically, and are not profiling.

4. Teachers' public profile

Whoever signs up as a Teacher publishes a profile made to be seen: it is how Students find, recognise and choose them. Visible to the public — including people without an account and search engines — are therefore the profile photo, the name in short form (for example “Luisa Reg.”), the presentation, the languages taught, the rate, availability and reviews received.

These elements, photo included, may appear anywhere on the Platform — home page, Teacher list and search, presentation pages — and in the materials we use to promote the service, such as advertisements, social-media content and email communications. The purpose is one only, and it matches the Teacher's interest: making them visible to potential Students. We do not use the photo for any other purpose and do not pass it to third parties for theirs.

For a Teacher the photo is necessary: without it the profile cannot be published. The Teacher can replace or remove it at any time in the settings; once removed, the profile stays unpublishable until a new one is uploaded. Anyone who no longer wants to appear can remove the photo, ask for the profile to be suspended, or close the account by writing to privacy@nuovalingua.com.

Promotional use OUTSIDE the Platform (ads, social media, email) rests on legitimate interest, and the Teacher can object at any time by writing to privacy@nuovalingua.com while keeping the profile active on the site. Removal from the Platform takes effect immediately; for copies already released (a search engine cache, an advertisement already published) we will do what is reasonably possible to stop them, without being able to guarantee instant disappearance.

Students have no public profile and their photo is never published. If a Student leaves a review, only the name in short form (for example “Anna K.”) appears next to it.

5. Special categories of data

We do not ask for special categories of data (art. 9 GDPR: health, religion, political opinions, sexual orientation and the like). What you say during a recorded lesson, write in your notes or tell the AI assistant is, however, transcribed or stored like any other content: please do not share sensitive information through these tools. If you do, we process it only to provide the service and you can ask us to delete it at any time.

6. Recipients and providers

To run the service we rely on providers that process data on our behalf (processors, art. 28 GDPR) under written agreements. For each one we state what it actually receives.

• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe Inc., USA) — payments, subscriptions, refunds and, for Teachers, the payout account with tax details. It receives name, email, card details (which we never see) and amounts.
• Daily (Daily.co, USA) — video classroom: the lesson's audio and video in real time and the participant's shortened name. It does not record or keep lessons.
• Vercel (Vercel Inc., USA) — hosting of the Platform, technical logs and file storage: profile photos, attachments to messages and support requests, lesson audio awaiting transcription. Stored files are reachable through unguessable addresses but are not password-protected; lesson audio is deleted after transcription.
• Neon (Neon Inc., USA) — the database where account and service data live.
• Groq (Groq Inc., USA) — automatic speech-to-text: it receives the lesson audio file and, for voice chats with Nova, your recorded sentences.
• Anthropic (Anthropic PBC, USA) — the AI models: it receives the transcript text to analyse, your messages to the assistant, the learning context needed (level, recent mistakes, goals), your first name when you talk to Ambrogio, texts to translate and requests for readings. It never receives your email, password or payment data.
• Microsoft Azure (Microsoft Ireland Operations Ltd.) — text-to-speech: it receives only the text to be read aloud, no account data.
• Google (Google Ireland Ltd.) — sign-in with Google, if you choose it; Google Calendar, if you connect it (we create and update your lesson events in your calendar). In the voice demo on the home page, if you use Chrome, speech recognition is the browser's own and is provided by Google.
• Resend (Resend Inc., USA) — delivery of service and promotional emails: email address, name and message content.
• Upstash (Upstash Inc., USA) — temporary counters limiting repeated requests: IP address or account identifier, for minutes and at most seven days.
• Meta (Meta Platforms Ireland Ltd.) — only if you consent to marketing cookies: the Meta pixel reports that a page was viewed, that the trial exercise was completed or that you signed up. See the Cookie Policy.
• Your browser's push service (Google, Apple or Mozilla depending on the browser) — only if you enable push notifications: it receives the notification text.
• Image and video providers on the home page (Pexels, Unsplash): your browser downloads the files directly from their servers, which therefore see your IP address, as with any image on the web.

We do not sell your data and do not pass it to third parties for their own purposes. We may disclose it to competent authorities when the law requires. Teachers receive the Student data needed for the lesson (name, language, level, analyses and messages of their own lessons) and must use it for that purpose only.

7. Transfers outside the European Union

Several providers are based in the United States or may process data there (Stripe, Daily, Vercel, Groq, Anthropic, Resend, Upstash, Meta, Google, Microsoft). In those cases the transfer relies on an adequacy decision of the European Commission (the EU-US Data Privacy Framework, for providers certified under it) or on the Standard Contractual Clauses adopted by the Commission, with supplementary measures where needed. You can ask for a copy of the safeguards applied by writing to privacy@nuovalingua.com.

8. How long we keep data

• Account and service data: for as long as the account exists. On deletion, data is erased or anonymised as described in section 9.
• Lesson audio: in the browser until uploaded (if the upload fails, it stays in the browser's local storage for at most 48 hours so it can be retried); in our storage only until transcription, normally a few minutes, then deleted.
• Lesson transcripts and reports: in the Student's account for as long as the account exists, or until the Student asks for them to be deleted.
• Conversations with the AI assistant, messages with the Teacher, readings on request, results and progress: for as long as the account exists.
• Email log and support requests: for as long as the account exists; on deletion, name and email are replaced by a placeholder.
• Payments, invoices, payouts and tax data: 5 years from the end of the calendar year in which the tax payment deadline expired (Polish accounting obligation).
• Anti-abuse counters (IP, identifier): from a few minutes to seven days.
• Host technical logs: for the short period set by the hosting provider.
• Cookies and browser data: durations are in the Cookie Policy.

9. What happens when you delete your account

You can delete your account yourself in Settings. We do not physically delete the record, because some rows must remain for accounting obligations and for the integrity of other users' data; instead we apply an irreversible anonymisation:

• Deleted: profile photo, password, interests, preferences, saved words, notes, exercise results and mistakes, reading progress, readings on request, transcripts and reports of your lessons (if you are a Student), the messages you wrote, conversations with the AI assistant, notifications, push subscriptions, Google Calendar link and access tokens, open sessions, invitations.
• Anonymised: name and email in the account, in support requests and in the email log; booking notes; for Teachers, the presentation and photo. Reviews and bookings remain but are no longer linked to an identifiable person.
• Kept by law: payments, refunds, invoices, payouts and, for Teachers, tax details, for the period in section 8.

Lesson transcripts and reports belong to the Student's learning path: if it is the Teacher who deletes their account, they remain in the Student's account with the Teacher's details anonymised.

10. Your rights

You have the right to access your data and obtain a copy, to have it rectified, erased or restricted, to object to processing based on legitimate interest, to receive the data you gave us in a portable format, and to withdraw a consent at any time without affecting the lawfulness of what was done before. Many of these you can do yourself: editing your data, turning lesson analysis off, choosing about promotional emails and deleting the account are in Settings; cookie choices are under “Cookie preferences” in the footer. For everything else write to privacy@nuovalingua.com: we reply within one month.

11. Complaint to a supervisory authority

If you believe the processing breaches the GDPR, you can lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or with the authority of the EU country where you live.

12. Security

We apply proportionate technical and organisational measures: passwords stored only as hashes, encryption in transit (HTTPS), role-based access controls, limits on repeated requests, database backups, system access restricted to the controller. No system is one hundred per cent secure: keep your credentials safe and tell us immediately if you suspect unauthorised access.

13. Cookies

We use few cookies and similar technologies, described one by one in the Cookie Policy, which also tells you how to change your choices.

14. Minors

The Platform is for people aged 18 or over. We do not knowingly collect data from minors; if we find an account held by a minor we close it and delete the data.

15. Changes and contact

We may update this policy when the service or the law changes. Material changes will be communicated to you (by email or with a notice on the Platform) and the version in force, with its date, is always available on this page. Controller: Patryk Lewczuk Nuovalingua — al. 3 Maja, 30-062 Kraków, Poland — privacy@nuovalingua.com — tel. +48 789 818 641.