Privacy Policy

1. Who We Are

DipLangs (“we”, “us”, “our”) operates the website diplangs.com. We are committed to protecting your personal data in accordance with the EU General Data Protection Regulation (GDPR).

Data controller contact: diplangs.support@gmail.com

2. Data We Collect

• Account data: email address and password (hashed) when you register.
• Usage data: practice sessions, scores, streaks, XP points, and module usage counts.
• Technical data: IP address, browser type, and session tokens (managed by Supabase Auth).
• AI interactions: text you submit to our AI chat and writing/speaking practice features, processed by OpenAI.

3. How We Use Your Data

• To provide and personalise our language learning service.
• To track your progress, streaks, and XP across sessions.
• To enforce subscription plan limits.
• To improve our content and AI-generated explanations.
• To send transactional emails (e.g. password reset) — no marketing emails without consent.

4. Legal Basis (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): processing your account and session data to deliver the service.
• Legitimate interests (Art. 6(1)(f)): security, abuse prevention, and service improvement.
• Consent (Art. 6(1)(a)): for any optional communications.

5. Third-Party Services

• Supabase (database & authentication) — data stored in EU region. Privacy Policy
• OpenAI (AI explanations & chat) — text prompts sent to OpenAI API. Privacy Policy
• Vercel (hosting) — server logs and CDN. Privacy Policy
• DODO Payments (payment processing) — handles all subscription billing. Your payment card details are processed directly by DODO Payments and are never stored by DipLangs. Privacy Policy

6. Data Retention

We retain your account and progress data for as long as your account is active. If you delete your account, your personal data is removed within 30 days. Anonymised usage statistics may be retained indefinitely.

7. Your Rights (GDPR)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, email us at diplangs.support@gmail.com. We will respond within 30 days.

8. Cookies & Local Storage

We use strictly necessary cookies and browser local storage to maintain your login session (via Supabase Auth). We do not use advertising or tracking cookies. No cookie consent banner is required for strictly necessary cookies under GDPR.

9. Security

All data is transmitted over HTTPS. Passwords are never stored in plain text. We use industry-standard security practices provided by Supabase.

10. Contact & Complaints

For any privacy concerns: diplangs.support@gmail.com

You also have the right to lodge a complaint with your local data protection authority.