Privacy notice

1. Who is responsible

Loriam Holding Ltd, Cyprus, is the controller of your personal data for Pixalingo. Contact: [email protected]. This notice follows the EU General Data Protection Regulation (GDPR).

2. What we collect

Learning data: the languages you learn, your reason and daily goal, which words you learned, your answers and their timing, each word's box and due day, your streak.

Account: your email address, if you add one, and your reminder settings.

Premium: your plan, its status, amounts and currency, and Stripe references. Card details stay with Stripe.

Technical: IP address, device and browser type, your time zone, and security logs.

Where you came from: if you open our site through an ad or a tagged link, the campaign and ad names and the ad click id, kept in our own cookie for 30 days and saved with your account if you start learning.

We do not ask for your name, and we do not collect photos, contacts or location.

3. Why we use it, and on what basis

To run the app: your progress, reviews, Premium and invitations (contract).

To send the sign-in code and, only if you turn them on, daily reminder emails. Every reminder has a one-click unsubscribe link (contract and consent).

To keep invoices and payment records as tax law requires (legal obligation).

To see which of our ads and links bring learners, in our own statistics (legitimate interest).

To measure our ads, only if you allow it: if you came through one of our ads, we tell Meta (Facebook) when you save your progress, start a trial, subscribe or pay, with your email address and user number in scrambled (hashed) form, your country, IP address, browser type and the ad click id. We send this from our server; our pages carry no tracking scripts. You can say no, or change your mind in your profile (consent).

4. Who receives it

Service providers that process data for us under contract: Hetzner (hosting, Germany), Cloudflare (network and file storage), Stripe (payments), Resend (email).

Meta Platforms Ireland Ltd, for ad measurement, only if you allow it.

Our internal business dashboard (a CRM run for us) receives learning and payment statistics per learner without your email address.

The picture cards are created in advance with AI services (Anthropic, Fal); none of your data is sent to them.

Some providers are outside the EU. Where data leaves the EU, we rely on the European Commission's standard contractual clauses or an adequacy decision.

5. Cookies and local storage

We use only our own cookies and storage: to keep your session (so your progress stays on this device), to remember which ad or link brought you (30 days), and your answer about ad measurement. No third-party tracking cookies or scripts.

6. How long we keep it

Your account and learning data: until you delete them. A device-only (anonymous) account that is not used for 13 months is deleted automatically.

Payment records: as long as tax law requires (currently up to 7 years). Ad events: 180 days; the IP address and browser type saved for ad measurement: 90 days. Sign-in codes: 7 days.

7. Your rights

You can access, download (Profile, Download my data), correct or delete your data (Profile, Delete account), withdraw consent, and object to processing. Write to us for anything else. You can also complain to the Cyprus Commissioner for Personal Data Protection or your local data protection authority.