Privacy Policy

This policy explains what personal data we process, for what purposes and with what rights, under Regulation (EU) 2016/679 (GDPR).

1. Data controller

The controller is Patryk Lewczuk, operating as the sole proprietorship Patryk Lewczuk Nuovalingua (CEIDG, Poland), NIP 6772545398, with registered address at al. 3 Maja, 30-062 Kraków. For privacy matters write to privacy@nuovalingua.com (tel. +48 789 818 641). No DPO has been appointed (not required for this activity).

2. What data we collect

• Registration and account data: name, email, password (encrypted), language, time zone, optional profile picture, role.
• Teachers' public profile data: photo, description, languages taught, rate, availability. This is what a Teacher chooses to show so Students can find them (see section 4).
• Age verification: date of birth is used only to verify adulthood and is not stored; we keep only confirmation of the 18+ requirement and its date.
• Lesson data: bookings, calendar, availability, history, optional Google Calendar link (if you enable it).
• Audio recordings and transcripts: with your consent to analysis, lesson audio is transcribed and processed for the learning report.
• Content you create: notes, vocabulary, exercise answers, reviews, messages with the AI assistant.
• Payment data: handled by Stripe; we do not store full card details, but the customer/subscription identifier and payment history.
• Technical and usage data: logs, IP address, device/browser, data needed for security and abuse prevention.
• Communications: service emails and, with your consent, promotional messages.

3. Purposes and legal bases

• Creating and managing the account and providing the service — performance of the contract (art. 6(1)(b)).
• Age verification — legal obligation / contract (art. 6(1)(c)/(b)).
• Payments, invoicing and accounting — contract and legal obligations (art. 6(1)(b)/(c)).
• Lesson analysis and audio transcription — consent (art. 6(1)(a)), revocable.
• AI features supporting learning — performance of the contract (art. 6(1)(b)).
• Publishing and promoting the Teacher's profile — performance of the contract with the Teacher (art. 6(1)(b)) and our shared legitimate interest in making the service known (art. 6(1)(f)). See section 4.
• Security, fraud and abuse prevention — legitimate interest (art. 6(1)(f)).
• Service emails — performance of the contract (art. 6(1)(b)).
• Promotional messages — consent (art. 6(1)(a)), revocable.
• Tax obligations and legal defence — legal obligation / legitimate interest (art. 6(1)(c)/(f)).

We do not carry out automated decision-making with significant legal effects on individuals.

4. Teachers' public profile

Anyone who signs up as a Teacher publishes a profile that is meant to be seen: it is how Students find them, recognise them and choose them. The following are therefore publicly visible — including to people without an account and to search engines: the profile photo, the name (shown in shortened form, e.g. “Luisa Reg.”), the description, the languages taught, the rate, the availability and the reviews received.

These elements, the photo included, may appear anywhere on the Platform — home page, Teacher listing and search, profile pages — and in the materials we use to promote the service, for example adverts, social media content and emails. There is a single purpose, and it matches the Teacher's own interest: making them visible to prospective Students. We do not use the photo for anything else and we do not pass it to third parties for their own purposes.

For a Teacher the photo is necessary: without it the profile cannot be published, because it is the first thing a Student looks at before choosing. It is therefore not a separate consent that can be withdrawn while keeping the profile online — it is a condition for offering lessons on the Platform. A Teacher can replace it whenever they like from their settings, and can remove it at any time from the same place: the photo then disappears from the Platform and the profile stays unpublishable until they upload another one. Anyone who no longer wishes to appear can remove the photo, ask for the profile to be suspended, or close the account by writing to privacy@nuovalingua.com.

What always remains separable is promotional use OUTSIDE the Platform (adverts, social media, emails): that rests on legitimate interest and a Teacher may object at any time by writing to privacy@nuovalingua.com, keeping the profile active and visible on the site. Removal from the Platform takes effect right away; for copies that have already travelled (a search engine's cache, an advert already published) we will do what is reasonably possible to have them withdrawn, but we cannot guarantee they disappear instantly.

Students have no public profile and their photo is never published. If a Student leaves a review, only their initials and shortened name appear next to it (e.g. “Anna K.”).

5. Special categories

We do not request special categories of data (art. 9 GDPR). Please do not share sensitive data during lessons, in notes or with the AI assistant. You can turn off lesson analysis at any time.

6. Recipients and processors

To provide the service we use suppliers that process data on our behalf under data-processing agreements (DPAs):

• Stripe — payments and payouts (payment data, customer identifiers).
• Resend — email delivery (email address, service email content).
• Daily — video classroom (real-time lesson audio/video).
• Groq — audio transcription (only with consent to analysis).
• Anthropic — AI features (text of requests and transcripts).
• Google — calendar, only if you connect your account.
• Vercel — Platform hosting (technical data, logs).
• Neon — database (account and service data).
• Upstash — security / rate limiting (temporary technical identifiers).

We may also disclose data to competent authorities where required by law. We do not sell your data.

7. Transfers outside the EU/EEA

Some suppliers (e.g. Stripe, Daily, Groq, Anthropic, Vercel, Upstash) may process data outside the EU/EEA, in particular in the United States. In such cases the transfer is protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms. You can ask us for more information at privacy@nuovalingua.com.

8. Retention

• Account and service data: for the duration of the relationship and a reasonable period afterwards.
• Tax and accounting data: 5 years counted from the end of the calendar year in which the tax payment deadline fell (Polish rules).
• Audio recordings and transcripts: kept only as long as needed to generate the analysis, then deleted or anonymised.
• Technical and security logs: for a limited period necessary for security purposes.

9. Your rights

You have the right to access your data, request rectification, erasure, restriction, object to processing based on legitimate interest, request portability, and withdraw consent at any time (without affecting prior lawful processing). To exercise them write to privacy@nuovalingua.com. Many actions (editing data, disabling analysis, closing the account, withdrawing marketing consent) are available in your account settings.

10. Complaint to the supervisory authority

You have the right to lodge a complaint with the supervisory authority: in Poland the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

11. Security

We apply appropriate technical and organisational measures: hashed passwords, encryption of data in transit, access controls, rate limiting and abuse monitoring. No system is 100% secure: keep your credentials safe.

12. Cookies

We use cookies and similar technologies as described in the Cookie Policy.

13. Changes and contact

We may update this policy; material changes will be communicated and the current dated version will always be available. Controller: Patryk Lewczuk Nuovalingua — al. 3 Maja, 30-062 Kraków — privacy@nuovalingua.com — tel. +48 789 818 641.