Privacy Policy

This policy explains what personal data we process, for what purposes and with what rights, under Regulation (EU) 2016/679 (GDPR).

1. Data controller

The controller is Patryk Lewczuk, operating as the sole proprietorship Patryk Lewczuk Nuovalingua (CEIDG, Poland), NIP 6772545398, with registered address at al. 3 Maja, 30-062 Kraków. For privacy matters write to privacy@nuovalingua.com (tel. +48 789 818 641). No DPO has been appointed (not required for this activity).

2. What data we collect

• Registration and account data: name, email, password (encrypted), language, time zone, optional profile picture, role.
• Age verification: date of birth is used only to verify adulthood and is not stored; we keep only confirmation of the 18+ requirement and its date.
• Lesson data: bookings, calendar, availability, history, optional Google Calendar link (if you enable it).
• Audio recordings and transcripts: with your consent to analysis, lesson audio is transcribed and processed for the learning report.
• Content you create: notes, vocabulary, exercise answers, reviews, messages with the AI assistant.
• Payment data: handled by Stripe; we do not store full card details, but the customer/subscription identifier and payment history.
• Technical and usage data: logs, IP address, device/browser, data needed for security and abuse prevention.
• Communications: service emails and, with your consent, promotional messages.

3. Purposes and legal bases

• Creating and managing the account and providing the service — performance of the contract (art. 6(1)(b)).
• Age verification — legal obligation / contract (art. 6(1)(c)/(b)).
• Payments, invoicing and accounting — contract and legal obligations (art. 6(1)(b)/(c)).
• Lesson analysis and audio transcription — consent (art. 6(1)(a)), revocable.
• AI features supporting learning — performance of the contract (art. 6(1)(b)).
• Security, fraud and abuse prevention — legitimate interest (art. 6(1)(f)).
• Service emails — performance of the contract (art. 6(1)(b)).
• Promotional messages — consent (art. 6(1)(a)), revocable.
• Tax obligations and legal defence — legal obligation / legitimate interest (art. 6(1)(c)/(f)).

We do not carry out automated decision-making with significant legal effects on individuals.

4. Special categories

We do not request special categories of data (art. 9 GDPR). Please do not share sensitive data during lessons, in notes or with the AI assistant. You can turn off lesson analysis at any time.

5. Recipients and processors

To provide the service we use suppliers that process data on our behalf under data-processing agreements (DPAs):

• Stripe — payments and payouts (payment data, customer identifiers).
• Resend — email delivery (email address, service email content).
• Daily — video classroom (real-time lesson audio/video).
• Groq — audio transcription (only with consent to analysis).
• Anthropic — AI features (text of requests and transcripts).
• Google — calendar, only if you connect your account.
• Vercel — Platform hosting (technical data, logs).
• Neon — database (account and service data).
• Upstash — security / rate limiting (temporary technical identifiers).

We may also disclose data to competent authorities where required by law. We do not sell your data.

6. Transfers outside the EU/EEA

Some suppliers (e.g. Stripe, Daily, Groq, Anthropic, Vercel, Upstash) may process data outside the EU/EEA, in particular in the United States. In such cases the transfer is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms. You can ask us for more information at privacy@nuovalingua.com.

7. Retention

• Account and service data: for the duration of the relationship and a reasonable period afterwards.
• Tax and accounting data: 5 years counted from the end of the calendar year in which the tax payment deadline fell (Polish rules).
• Audio recordings and transcripts: kept only as long as needed to generate the analysis, then deleted or anonymised.
• Technical and security logs: for a limited period necessary for security purposes.

8. Your rights

You have the right to access your data, request rectification, erasure, restriction, object to processing based on legitimate interest, request portability, and withdraw consent at any time (without affecting prior lawful processing). To exercise them write to privacy@nuovalingua.com. Many actions (editing data, disabling analysis, closing the account, withdrawing marketing consent) are available in your account settings.

9. Complaint to the supervisory authority

You have the right to lodge a complaint with the supervisory authority: in Poland the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

10. Security

We apply appropriate technical and organisational measures: hashed passwords, encryption of data in transit, access controls, rate limiting and abuse monitoring. No system is 100% secure: keep your credentials safe.

11. Cookies

We use cookies and similar technologies as described in the Cookie Policy.

12. Changes and contact

We may update this policy; material changes will be communicated and the current dated version will always be available. Controller: Patryk Lewczuk Nuovalingua — al. 3 Maja, 30-062 Kraków — privacy@nuovalingua.com — tel. +48 789 818 641.