Legal · Effective 23 August 2026
Privacy Policy
Effective Date: 23 August 2026
Last Updated: 23 August 2026
This Privacy Policy explains how personal data is processed when you use the Lingofisy mobile application, website and related services.
Lingofisy is designed as an English-language learning platform and includes learning, progress, subscription and artificial-intelligence functionality.
1. Controller
The controller responsible for processing your personal data is:
Rasul Mammadov
operating under the name Lingofisy
Clara-Mleinek-Str. 1
10557 Berlin
Germany
Email: support@lingofisy.com
There is currently no designated data-protection officer unless one is appointed and this Privacy Policy is updated accordingly.
2. General Principles
We process personal data only where necessary for legitimate purposes relating to Lingofisy or where otherwise permitted or required by law.
We do not sell your personal data.
We do not currently use Lingofisy learner data for third-party targeted advertising.
We aim to collect only data reasonably necessary to provide, protect and improve the Service.
3. Account and Authentication Data
When you create or use a Lingofisy account, we may process:
- internal user ID;
- email address;
- name or display name where provided;
- date of birth supplied for age verification;
- authentication-provider information and identifiers from Google, Apple or another supported provider;
- account creation time;
- login information;
- account preferences;
- selected learning settings;
- selected tutor;
- profile information voluntarily provided by you.
Passwords and authentication credentials are handled through the authentication infrastructure used by Lingofisy and are not intended to be stored by Lingofisy as readable plain-text passwords.
Purpose
We use this information to create and authenticate your account, verify that the Service's minimum-age requirements are met, maintain account security, synchronize your data and provide personalized features.
Legal basis
Article 6(1)(b) GDPR — processing necessary for performance of the contract and provision of the Service. Article 6(1)(f) GDPR may additionally apply to security and fraud-prevention processing. Article 6(1)(c) GDPR may apply where age-related processing is necessary to comply with a legal obligation.
4. Learning and Progress Data
Lingofisy may process your selected course and learning path, CEFR level, placement results, completed lessons, quiz results, vocabulary and grammar progress, review history, speaking activity, learning time, XP, coins, streaks, achievements, rewards, selected tutor cosmetics, weak areas, mistake-repair information and personalized recommendations.
Purpose
This information saves and synchronizes progress, personalizes learning, displays statistics, calculates XP, streaks and achievements, and creates review and repair exercises.
Legal basis
Article 6(1)(b) GDPR.
5. AI Speaking, Audio and Conversation Data
When you voluntarily use AI speaking or related features, Lingofisy may process microphone audio, recording duration, spoken content, transcripts, conversation history, AI responses, corrections, vocabulary and grammar feedback, fluency feedback, pronunciation-related information where available, roleplay responses and lesson or scenario context.
Purpose and legal basis
This data is processed to transcribe speech, understand responses, generate AI replies, provide feedback, continue conversations, identify mistakes, create personalized exercises and provide speaking history where implemented. The legal basis is Article 6(1)(b) GDPR because processing is necessary to provide AI functionality you actively request.
Lingofisy is not intended to collect highly sensitive personal information through ordinary AI speaking exercises. Avoid including unnecessary information concerning health, religion, political beliefs, sexual life or other highly sensitive matters.
6. Raw Audio
When you submit speech, the audio must be transmitted to relevant speech-processing infrastructure. Under the current Lingofisy architecture, raw microphone recordings are not intended to be permanently retained in Lingofisy's application database after relevant AI processing is completed.
Third-party AI or infrastructure providers may temporarily process or retain data according to their applicable service configuration, contractual obligations and legally permitted retention periods.
7. AI Transcripts and Feedback
Unlike temporary raw audio, transcripts and AI-generated feedback may be stored in your Lingofisy account where necessary to provide speaking history, personalized learning, mistake tracking, review exercises or relevant learning context. You may request deletion of your account and associated personal data as described below.
8. OpenAI
Lingofisy uses the OpenAI API for speech transcription, language-model processing, conversational responses, corrections, roleplay feedback and tutor speech.
Depending on the feature, information transmitted may include audio, transcripts, spoken or typed responses, limited conversation and lesson context, and prompts needed for the requested functionality.
OpenAI states that API data is not used to train or improve its models by default unless the API customer explicitly opts in. Under OpenAI's default API controls, abuse-monitoring logs may be retained for up to 30 days, and some Responses API application state may also be retained for 30 days. These periods may be longer where legally required or where necessary to protect the service.
OpenAI may process EEA data through OpenAI Ireland Limited and other approved processors or affiliates. International transfers are protected by adequacy decisions and/or Standard Contractual Clauses where required.
9. AI Processing and Automated Decisions
Lingofisy automatically analyzes learning input to generate educational output. Automated processing may influence corrections, practice exercises, personalized recommendations, review material and AI conversation responses.
Lingofisy does not use these systems to make decisions producing legal or similarly significant effects about you within the meaning of Article 22 GDPR. AI-generated educational assessments are not official examination results, immigration assessments, employment decisions or academic certifications.
10. Subscription and Entitlement Data
Paid subscriptions are purchased through Apple App Store or Google Play. Lingofisy uses RevenueCat to manage subscription status and Pro entitlements.
Depending on the platform and transaction, we or RevenueCat may process your Lingofisy user identifier, store/platform, subscription product, entitlement status, transaction identifier, purchase date, renewal and expiration information, purchase receipt or token, and subscription state.
Lingofisy does not receive your full credit-card number from Apple or Google.
Purpose and legal basis
This data determines Pro access, unlocks paid functionality, restores purchases, synchronizes entitlements, troubleshoots subscription problems and prevents fraud. Legal bases are Articles 6(1)(b), 6(1)(c) where retention is required by law, and 6(1)(f) GDPR for fraud prevention and security.
11. RevenueCat
RevenueCat provides subscription-management and entitlement infrastructure and acts as a processor for relevant Lingofisy customer data under its applicable Data Processing Addendum. RevenueCat may process data outside the EEA, including in the United States; where required, international transfers use recognized safeguards such as European Commission Standard Contractual Clauses.
RevenueCat may retain subscription-related personal data for the term of the service relationship and for longer periods where necessary for legal obligations, dispute resolution, fraud prevention or enforcement of agreements, in accordance with its applicable retention policy and DPA.
12. Apple and Google
Apple and Google provide app-distribution, account and payment functionality. When you interact with their stores, they may independently process store account, device, transaction, payment and purchase-history information. Apple and Google may act as independent controllers for their platform processing; their privacy policies apply.
13. Supabase
Lingofisy uses Supabase as backend infrastructure for authentication, database storage, backend APIs, server-side functions, account information, progress synchronization, learning records, AI-related backend operations and security controls. Supabase processes personal data on behalf of Lingofisy under its applicable contractual and data-processing terms. Where international transfers occur, appropriate safeguards including Standard Contractual Clauses are used where required.
14. Technical, Security and Usage Data
Lingofisy may process limited technical and operational information including user identifier, app version, operating system/platform, timestamps, feature-usage events, error categories, API failures, request metadata, security events, rate-limit information, AI usage, estimated or actual AI costs and subscription-entitlement checks.
We use this information to keep the Service operational, identify bugs, improve reliability, prevent fraud, detect abuse, protect accounts, secure infrastructure, control malicious activity and manage technical capacity and AI costs.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interests are operating a reliable, secure and economically sustainable service, preventing fraud and abuse, and protecting users and infrastructure. Where strictly necessary to perform the Service, Article 6(1)(b) GDPR may additionally apply.
15. Device Permissions
Depending on functionality, Lingofisy may request microphone, photo-library/image-selection, notification or other device permissions necessary for a feature. Microphone permission is required for speaking exercises; photo access may be requested if you choose a profile image; notification permission may be requested if you enable reminders. You may revoke permissions in operating-system settings, although features may stop functioning.
16. Local Device Storage
Lingofisy may store authentication sessions, preferences, learning-state caches, synchronization data, offline functionality, feature configuration and technical retry queues on your device.
Where Section 25 TDDDG applies, storage or access strictly necessary to provide a digital service expressly requested by you may be used without consent as permitted by law. If non-essential tracking is introduced, it will be activated only after obtaining consent where legally required.
17. Support Communications
If you contact support@lingofisy.com, we may process your email address, name, account-identifying information, message, voluntary attachments and correspondence needed to resolve your request.
We use this information for support, legal/privacy requests and troubleshooting. Legal bases are Articles 6(1)(b), 6(1)(f) and, where required by law, 6(1)(c) GDPR.
18. Website Hosting
The Lingofisy website is hosted using GitHub Pages. When you access the website, GitHub may technically process information including IP address, requested page, date and time, browser/device information and server-request information. This processing is necessary to deliver and protect the website. The website's Figtree font is self-hosted from the Lingofisy website and does not require a request to Google Fonts.
Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is secure and reliable operation of the Lingofisy website.
19. Recipients of Personal Data
Depending on functionality, personal data may be processed by Supabase, OpenAI, RevenueCat, Apple, Google, GitHub Pages, our email provider, professional advisers where legally necessary, and authorities where disclosure is legally required. We do not disclose personal data to unrelated third parties merely so they can advertise their products to Lingofisy users.
20. International Data Transfers
Some providers are based in or use infrastructure outside Germany or the EEA, including the United States. Where GDPR requirements apply, transfers use an appropriate mechanism such as an adequacy decision, the EU-U.S. Data Privacy Framework where applicable, Standard Contractual Clauses or another mechanism permitted by Articles 45–49 GDPR.
Contact support@lingofisy.com for further information about applicable safeguards.
21. Data Retention
We retain personal data only for as long as necessary for the purpose collected or where legally required.
- Account and learning data: generally while your account exists.
- AI transcripts and feedback: while needed for speaking history, personalized learning or mistake repair, and otherwise until deletion is requested or the data is no longer needed.
- Raw audio: not intended to be permanently stored in the Lingofisy application database; OpenAI and other processors may temporarily retain submitted data under their applicable default controls and legal obligations.
- Generated tutor audio: cloud-generated tutor audio may be cached in Supabase storage for service performance and is deleted according to the applicable cache lifecycle.
- Subscription records: as required for access, disputes, fraud prevention, tax, accounting, legal obligations and provider retention policies.
- Security, technical and support records: only as reasonably necessary for operation, incident investigation, fraud prevention, support and legal claims.
After the applicable purpose and retention period expire, data is deleted or anonymized unless further processing is legally permitted.
22. Account Deletion
You may request deletion through in-app account deletion where available or by contacting support@lingofisy.com. We aim to delete or anonymize account-linked data from Lingofisy's active systems without undue delay and generally within 30 days after a verified request, unless continued retention is necessary for a legal obligation, fraud prevention, security, pending disputes or legal claims.
Encrypted backups, OpenAI abuse-monitoring records, RevenueCat records and other provider-held copies may remain until the provider's applicable retention or deletion cycle ends and will not be restored except for disaster recovery, security or legal purposes.
Deleting an account does not cancel an Apple or Google subscription; subscriptions must be managed separately through the relevant store.
23. Security
We implement measures designed to protect personal data against unauthorized access, accidental loss, unlawful processing, alteration, disclosure and destruction. Measures may include encrypted network communication, authentication, access controls, server-side authorization, database row-level security, protected credentials, secure session storage, abuse protection, rate limiting and separation of client-accessible credentials from server secrets.
No internet-connected service can guarantee absolute security. We will comply with applicable breach-notification and remediation requirements.
24. Cookies and Similar Technologies
The mobile application uses application/device storage necessary for functionality described above. Lingofisy does not currently use learner data for third-party behavioral advertising. If the website later introduces non-essential analytics, advertising cookies, marketing pixels or comparable tracking requiring consent, an appropriate consent mechanism will be implemented before activation.
25. Marketing Communications
We may send communications necessary to operate your account, including authentication messages, security notices, important service information and subscription information. Marketing messages will be sent only where permitted by applicable law. Where marketing is based on consent, you may withdraw consent at any time.
26. Children
Lingofisy is not intended for children under 13 to create independent accounts. Where a user is a minor, use and processing must comply with applicable parental-consent and capacity requirements. Where consent is relied upon and parental authorization is required, the legally necessary authorization must be obtained.
27. Your Rights Under the GDPR
Where the GDPR applies, you may have rights to access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20), objection (Article 21), and withdrawal of consent (Article 7). You may also lodge a complaint with a competent supervisory authority. Withdrawal does not affect processing lawful before withdrawal.
28. Right to Object
Where we process data on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. If data is processed for direct marketing, you may object at any time. Send requests to support@lingofisy.com.
29. Complaints
You may complain to a data-protection supervisory authority, particularly in your habitual residence, place of work or the place where you believe an infringement occurred. For the controller's establishment in Berlin, the competent supervisory authority is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
Email: mailbox@datenschutz-berlin.de
Telephone: +49 30 13889-0
datenschutz-berlin.de
You may also contact us first at support@lingofisy.com.
30. No Sale of Personal Data
Lingofisy does not sell user personal data for money and does not currently share learner personal data for cross-context behavioral advertising. If this changes materially, we will update this Policy and provide required consent or opt-out mechanisms before relevant processing begins.
31. Legal Obligations
We may process or disclose data where reasonably necessary to comply with law or binding orders, prevent fraud, investigate security incidents, establish/exercise/defend legal claims, or protect users or others from serious harm. The applicable legal basis may include Article 6(1)(c) or 6(1)(f) GDPR.
32. Future Change of Controller
Lingofisy is currently operated by the individual identified in Section 1. If the business is incorporated, reorganized, sold or transferred to another legal entity, the controller may change. This Policy will be updated and affected users informed where required. Transfers will comply with applicable data-protection requirements.
33. Changes to This Privacy Policy
We may update this Policy because of new functionality, provider or processing changes, law or security requirements. The latest version will be published with its effective date. Where a material change requires notice or consent, we will provide it.
34. Contact
For privacy questions and data-subject requests:
Lingofisy
Rasul Mammadov
Clara-Mleinek-Str. 1
10557 Berlin
Germany
Email: support@lingofisy.com