Privacy Policy

1. Introduction

Zollang ("we," "us," or "our") is an AI-powered language learning platform. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website, applications, and services. We are committed to protecting your privacy and handling your data with transparency.

2. Information We Collect

We collect the following types of information:

a) Account Information

When you create an account, we collect your email address, name, and authentication credentials. If you sign in through a third-party provider (such as Google), we receive basic profile information from that provider.

b) Learning Profile

We collect your language learning preferences, including your target language, knowledge level, learning style, weekly goals, and preferred study times.

c) Learning Activity Data

As you use Zollang, we track your vocabulary progress (including spaced repetition parameters such as ease factor, review intervals, and mastery levels), word forms encountered, review history, learning streaks, and daily goals completion.

d) User-Submitted Content

When you create lessons, you may submit text content such as song lyrics, articles, or book excerpts. This text is processed by our AI systems to generate your personalized lessons.

e) AI Tutor Session Data

When you use the AI tutor voice conversation feature, we record session metadata such as duration and vocabulary words you produced, and we store a text transcript of the conversation to support your learning progress. We do not store recordings of your voice — audio is processed in real time and never saved.

f) Usage Data (with your consent)

With your consent, we collect product analytics about how you interact with the platform: screens visited, features used, device type, app version, and an approximate region derived from your IP address on our own servers (the IP address itself is never stored with analytics data). If you decline analytics consent — or never answer the consent prompt — these analytics events are not collected or stored, on web or in the mobile app. Error and crash reports are collected separately to keep the service working (see Section 6).

g) Payment Information

Payments are processed by Stripe. Zollang does not directly store your credit card numbers or full payment details. We retain transaction records such as plan type, billing dates, and payment status.

h) Support Requests

When you contact support, we collect your name, email address, and the subject and text of your message, together with the IP address and browser user agent of the submission, which we retain to prevent abuse and to diagnose problems.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our language learning services
• Personalize your learning experience based on your profile and progress
• Generate AI-powered lessons, vocabulary analysis, and aligned translations from your submitted content
• Schedule and manage spaced repetition reviews for your vocabulary
• Generate text-to-speech audio for pronunciation practice
• Facilitate real-time AI tutor voice conversations
• Process payments and manage your subscription
• Send you email about your account. Receipts, security alerts, support replies and other service messages are part of providing the service. A welcome message, study reminders, lesson updates and product news are sent on the basis of our legitimate interest in helping you keep learning; each of them carries a one-click unsubscribe link and can be switched off under Settings → Email preferences. Offers and promotions are sent only if you opt in
• Analyze usage patterns to improve the platform
• Enforce our Terms and Conditions and protect against misuse

4. AI Data Processing

Zollang uses third-party AI services to power its language learning features. Here is how your data is processed by AI:

• Text analysis: When you submit text for a lesson, it is sent to our AI service providers for linguistic analysis, vocabulary extraction, and sentence alignment
• AI tutor: Voice conversations are streamed in real-time to our AI providers' APIs for processing. Voice data is not permanently stored by Zollang
• Text-to-speech: Text is sent to our text-to-speech providers to generate audio pronunciations. Generated audio is cached on our servers for performance

These AI providers may process and temporarily retain data in accordance with their own privacy policies. We encourage you to review their policies for details on their data handling practices.

5. Confidentiality of Your Data

We take the confidentiality of your data seriously:

• User content is private: Text you submit for lessons is treated as confidential. It is not shared with other users, not used for marketing purposes, and not sold to third parties
• Learning data is personal: Your vocabulary progress, review history, mastery levels, and learning streaks are private to your account and not visible to other users
• AI processing is service-only: Your data is sent to AI providers solely for the purpose of delivering Zollang's learning features. We use API-based processing, and your content is not used to train AI models by Zollang
• Access is restricted: Access to user data within our organization is limited to personnel who require it for service operation, and all such personnel are bound by confidentiality obligations
• Data is isolated: Each user's data is logically separated. There is no cross-user data access within the platform
• Breach notification: In the event of a data breach that affects your personal information, we will notify affected users promptly in accordance with applicable law

6. Third-Party Service Providers

We work with the following third-party providers to deliver our services:

• Supabase — User authentication and database hosting
• Amazon Web Services (AWS) — Media storage and content delivery
• Stripe — Payment processing (web); Apple and Google handle in-app purchases on mobile, coordinated by RevenueCat
• AI and language processing providers (including OpenAI and Google) — Text analysis, AI tutor conversations, and content generation
• Speech providers (including Deepgram for speech recognition and Google and OpenAI for text-to-speech) — Pronunciation practice and audio generation
• Supadata — YouTube transcript retrieval: when you import a lesson from a YouTube video, the video's public URL is sent to Supadata to fetch its transcript. No account information or learner-written content is included in that request
• PostHog — Session replay on the website, only if you consent to analytics. Replays mask all text you see and type; they capture page structure and interactions, not your content
• Sentry (EU region) — Error and crash reporting, so we can find and fix failures
• Resend — Email delivery: support replies and the account emails described in Section 3. Resend keeps its own log of the messages it sends for us — the recipient address, the subject and body of each message and, for support notifications, the name, email address, and message text you submitted — under its own retention policy; deleting your account or support ticket removes our copy but not Resend's copy of emails already sent
• Expo — Push notifications on the mobile app, only if you allow them: Expo's push service holds the device token for your app installation and short-lived logs of the notifications we send through it — the title, the body and whether delivery succeeded — under its own retention policy. The token identifies an app installation rather than you; deleting your account removes our copy of it, and signing out asks us to remove it so notifications stop

Approximate location (country/region) is derived from your IP address on our own servers using a locally bundled database — your IP address is not sent to any location provider. Each provider above processes data only for the purposes described and in accordance with their own privacy policies and applicable data protection regulations.

7. Data Sharing

We do not sell your personal information. We may share information with:

• The third-party service providers listed above, solely for delivering our services
• Law enforcement or government authorities when required by law or to protect our legal rights
• A successor entity in the event of a merger, acquisition, or sale of assets

We may share aggregated or anonymized data that cannot reasonably identify you for analytics, research, or business purposes.

8. Data Retention

We retain your data as follows:

• Account data: Retained while your account is active
• Vocabulary and learning progress: Retained as long as your account exists to maintain your learning history
• Product analytics events: Automatically deleted after 180 days
• Text-to-speech audio: Cached on our servers for performance optimization
• AI tutor session metadata and transcripts: Retained to support your learning progress tracking
• Email delivery records: A record of each account email we send you (which message, when, and whether it was delivered) is kept while your account exists and is deleted with the account, together with your email preferences
• Unsubscribe and bounce list: Addresses we must not mail again — after an unsubscribe, a bounce or a spam report — are kept as a one-way hash of the address, never the address itself, and that hash is kept after your account is deleted, because honouring the unsubscribe is itself our obligation
• Deleted accounts: When you delete your account, it enters a 30-day grace period during which you can sign back in and cancel the deletion. After the grace period your personal data is permanently deleted from our systems, including your analytics events, support tickets, and stored content

9. Cookies and Similar Technologies

We use cookies and similar technologies in two categories:

• Essential (always active): authentication tokens (JWT) managed by our authentication provider to keep you signed in, your language preference, your cookie-consent choice itself, and local storage for preferences such as theme settings
• Analytics (only with your consent): if you choose "Accept All" in the cookie banner, we enable product analytics (including Vercel Analytics pageviews), a per-tab session identifier for our first-party analytics, and PostHog session-replay cookies. We also set a hero_variant cookie, which remembers which of two versions of the homepage headline you were shown so we can compare them; it lasts 90 days. If you choose "Essential Only" — or make no choice — none of these are set and no analytics events are collected

We do not use advertising cookies. You can change your cookie choice at any time via "Cookie Settings" in the site footer; withdrawing consent stops analytics collection and removes the analytics cookies.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption in transit (HTTPS)
• Secure HTTP headers (X-Content-Type-Options, X-Frame-Options, XSS-Protection)
• Database access controls and authentication
• Regular security reviews of our infrastructure

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Your Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your account and associated data
• Export your data in a portable format
• Object to processing of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

You can exercise the access and portability rights directly: Settings → Security → Your data → "Download my data" downloads everything we hold about you as a JSON file, and account deletion is available in the same Settings area. Analytics consent can be changed anytime via "Cookie Settings" on the website or the "Usage data" toggle in the mobile app's Settings. You can choose which account emails you receive under Settings → Email preferences on the website and in the app, and every non-essential email carries a one-click unsubscribe link that works without signing in. Receipts, security alerts and other account-service emails cannot be switched off while you have an account. For anything else, contact us at privacy@zollang.com.

12. International Data Transfers

Your data may be processed and stored in the United States and other countries where our service providers operate (including AWS, Supabase, and AI providers). By using Zollang, you consent to the transfer of your data to these locations. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy.

13. Children's Privacy

Zollang is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information. If you believe a child under 13 has provided us with personal information, please contact us at privacy@zollang.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. We may also send a notification to the email address associated with your account for significant changes. Continued use of the service after changes have been posted constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@zollang.com.