Privacy Policy
Last updated: 18 July 2026
1. Who is responsible for your data
The data controller is [FULL NAME OR COMPANY], based at [ADDRESS, LUXEMBOURG], [VAT / REGISTRATION NUMBER, if applicable].
For any privacy matter, contact [CONTACT EMAIL].
2. What data we collect
| Data | When it is collected |
|---|---|
| Name, email address and profile picture | When you sign up with your Google account |
| The content of your conversations with Foxi (text and voice) | While you practise in the app |
| Your progress: level, completed lessons, badges | During use |
| Subscription and payment data | When you subscribe (handled by Stripe; we never store your card) |
| Notification identifier | If you enable reminders |
| Technical data: IP address, device type, access logs | Automatically, when you use the service |
[VERIFY: are voice recordings stored at any point, or processed and discarded? This is the most sensitive point in the whole policy and must be stated precisely.]
3. Why we use it and on what legal basis
- To provide the service (create your account, run the conversation, save your progress): performance of the contract.
- To charge your subscription: performance of the contract and legal tax obligations.
- To send you notifications or practice reminders: your consent, which you can withdraw at any time.
- To keep the service secure and working (abuse prevention, error diagnosis): legitimate interest.
4. Who we share data with
We do not sell your data. We work with providers who process it on our behalf:
| Provider | Purpose |
|---|---|
| Sign-in with your account | |
| Groq | AI conversation processing |
| Stripe | Subscription payments |
| Cloudflare | Hosting and data storage |
| Resend | Emails and notifications |
[VERIFY: add or remove providers to match what you actually use today.]
Some of these providers are located in the United States. Those transfers rely on the European Commission's standard contractual clauses or the applicable adequacy framework.
5. How long we keep it
We keep your account and progress for as long as it stays active. If you delete it, we erase your data within [X DAYS], except for records we must retain by law, such as invoices, which are kept for the period required by Luxembourg tax rules.
6. Your rights
At any time you can ask us to access, correct, delete, restrict, object to the processing of, or port your data. Write to [CONTACT EMAIL] and we will reply within one month.
If you believe we handle your data improperly, you can lodge a complaint with Luxembourg's Commission nationale pour la protection des données (CNPD) at cnpd.public.lu.
7. Minors
Habliko is intended for people aged [MINIMUM AGE: 16 in Luxembourg unless parental consent] and over. We do not knowingly collect data from children below that age.
8. Cookies and local storage
We use storage on your device to keep you signed in and remember your preferences. [VERIFY: state here whether you use analytics or any non-essential cookie — if so, a consent banner is required.]
9. Changes to this policy
If we change it, we will update the date above and, where the change is significant, notify you in the app.