Personal data processing notice

1. Controller

The controller is DEVTYPED sp. z o.o., ul. Władysława Warneńczyka 13 lok. 33, 39-300 Mielec, Poland, Tax ID (NIP) 8172215305, KRS 0001098974, REGON 528311560. Data protection contact: contact@lingdemy.com.

2. What data we process

• Account: e-mail address, password hash (we never know your password), sign-up date, interface language, plan, e-mail confirmation status, two-step login setting.
• Learning: flashcard settings (source language, languages, categories, filters), language order, languages chosen from the plan's pool, last viewed card and viewed flashcards (first and last day viewed — for the plan's daily limit).
• Sign in with Google (if you use it): your Google account ID, e-mail address and the fact that Google has confirmed it — we receive them from Google. We never receive your Google password, name, photo or any other data from your Google account.
• Account history: changes made to the account (e.g. password or language choice changes) — shown in “My account”, as well as the IP address and browser at sign-up and at e-mail confirmation.
• Login history: date, result, IP address and browser; for login attempts also the e-mail address entered (even if no such account exists). We never store passwords you type.
• Activity history: flashcard views, quiz answers and settings changes — with dates.
• Newsletter (only if you subscribe): e-mail address, language, dates of subscription, confirmation and unsubscription.
• Technical data: IP address and browser information in server logs, cookies necessary for the service to work.

Visitors without an account: learning settings are stored only in the browser session, and the numbers of viewed flashcards (flashcard limit without an account) in the session and in a cookie on the device.

3. Purposes and legal bases

Purpose	Legal basis
Creating and running the account, providing the service, including plan limits	Art. 6(1)(b) GDPR (contract)
Security (login history, abuse detection), notifying us about new accounts, service usage statistics, establishing, exercising and defending legal claims	Art. 6(1)(f) GDPR (legitimate interest)
Keeping data of an account deleted by us (e.g. for breaching the terms) — clarifying the matter and preventing repeated breaches	Art. 6(1)(f) GDPR (legitimate interest)
Newsletter	Art. 6(1)(a) GDPR (consent)
Complaints, accounting (once payments are introduced), obligations towards public authorities	Art. 6(1)(c) GDPR (legal obligation)

4. Recipients

Data may be shared with service providers working for us: hosting and e-mail (dhosting.pl) — only under data processing agreements. We do not transfer data outside the European Economic Area. We do not sell data.

If you sign in with Google, Google Ireland Limited processes the sign-in data as a separate controller under its own terms (Google’s privacy policy).

We may disclose data to public authorities (e.g. courts, prosecutors, police) only where the law requires it.

5. Retention

• Account: until it is deleted. An account you delete yourself is removed immediately.
• Account deleted by us (e.g. for breaching the terms): for 1 year after deletion, then the data is deleted automatically.
• Payment-related data (once payments are introduced): for 5 years from the end of the calendar year in which the payment was made — as long as tax and accounting laws require.
• Data related to an offence or proceedings (e.g. at the request of authorities or to establish or defend legal claims): until the proceedings are finally concluded and limitation periods have expired.
• Login history: 180 days. Activity history: 365 days.
• Newsletter: until you unsubscribe.
• Server logs: application logs — 14 days; hosting logs — according to the hosting provider’s rules.
• Database backups are replaced by newer ones; data deleted from the service disappears from backups as they are replaced.

6. Your rights

You have the right to access, rectify and erase your data, restrict processing, data portability (download a copy in “My account” → Your data), object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of earlier processing). You may lodge a complaint with a data protection authority (in Poland: the President of the Personal Data Protection Office, UODO).

7. Voluntary provision and automated decisions

Providing an e-mail address is voluntary but required to create an account. We do not make decisions based solely on automated processing and do not profile users. Plan limits (e.g. the daily flashcard limit) apply equally to all accounts in a given plan.