Privacy Policy

Last Updated: August 11, 2026

1. Who We Are

LearnLingo.ai is operated by LearnLingo.ai Ltd.

For direct accounts, we act as the data controller for personal information collected through our Platform. For questions about data protection, please contact us at info@learnlingo.ai.

For partner, school and institutional access, the controller and processor roles depend on the parties' actual purposes and responsibilities. The partner or institution generally controls learner selection, source cohort data and its own reporting purpose. LearnLingo.ai independently controls platform authentication, safety, security, provider selection, product operation, support and its own audit. We act as a processor only for operations covered by documented instructions and the applicable agreement.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, password, and profile settings.
• Protected-Minor Eligibility: A signed age band, jurisdiction and the notice, policy and authority versions used for activation. We do not require a precise date of birth or identity document by default.
• Guardian Authority: A guardian contact used for the review, adult and authority declarations, decision, expiry, withdrawal and content-free audit evidence. Guardian links are single-use, and raw activation or recovery tokens are not stored.
• Payment Information: Credit card details, billing address, and other payment details (processed by our payment provider, Stripe).
• Profile Information: Language learning preferences, native language, and proficiency levels.
• User Content: Conversation data (including transcripts), voice recordings, written responses, and saved vocabulary.
• Journey Analytics: Milestone readiness scores, progress snapshots, and AI feedback summaries that power your personalised dashboard.
• Communications: Information you provide when contacting us for support or participating in surveys.

2.2 Information Collected Automatically

When you use our platform, we may automatically collect:

• Usage Data: Interaction data including exercises completed, time spent on the platform, and features used.
• Device Information: Device type, operating system, browser type, and internet connection.
• Location Information: General location based on IP address (not precise GPS data).
• Log Data: Server logs, error reports, and performance data.
• Cookies and Similar Technologies: Information collected through cookies and similar technologies. See Section 11 for details about analytics and advertising cookies and your choices.

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• Social media platforms, if you choose to connect your account.
• Our service providers who help us with fraud prevention and security.
• Partners or institutions that provide signed pseudonymous launch, age-band, authority and optional cohort claims under an applicable arrangement.

3. How We Use Your Information

We use your information for the following purposes:

3.1 Providing and Improving Our Services

• Delivering personalised language learning experiences.
• Processing transactions and managing your account.
• Analysing usage to improve our platform and educational content.
• Surfacing journey dashboards, readiness alerts, and personalised milestones based on your progress data.
• Developing new features and services.
• Providing customer support and responding to inquiries.

3.2 AI-Powered Features

Our service uses artificial intelligence technologies to:

• Generate conversational language practice tailored to your level.
• Analyse your language use to provide feedback and corrections.
• Convert text to speech for pronunciation examples.
• Assess your speaking skills and provide improvement recommendations.

To enable these features, your conversation data, transcripts, and (when applicable) voice recordings are processed by approved AI and speech service providers under data-processing safeguards. We do not permit these providers to train their models on your data. Adult service profiles may allow some speech providers to retain audio for up to 730 days for quality and abuse prevention.

Protected-minor AI or voice processing is available only through a current, evidenced minor provider profile with stricter purpose, service and retention limits. If that profile or evidence is unavailable or expired, protected-minor processing fails closed. The applicable child and guardian notice identifies the protected purpose and retention class before activation.

AI feedback is private formative practice. It is not an official grade or credential and is not used to decide admission, placement, discipline, eligibility or access to education. For protected minors, we do not use conversations to infer emotion, health, character, honesty, vulnerability or protected traits, create voiceprints, or build advertising audiences.

3.3 Marketing and Communications

With your consent, we may use your information to:

• Send you promotional emails about new features, special offers, or other information we think you may find interesting.
• Provide updates about our services and changes to our policies.
• Measure the effectiveness of our marketing campaigns.

We tailor these communications using aggregated journey analytics (for example, milestone readiness status or recently unlocked content) and only send them when you have opted in.

You can opt out of marketing communications at any time by following the unsubscribe link in any message or contacting us directly.

We do not send promotional marketing to known minors or use their activity for behavioural advertising, cross-selling or promotional scoring. Guardian activation, withdrawal and recovery messages are transactional and contain no promotion.

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Contract Performance: Processing necessary to provide adult or organisational services under the applicable Terms or agreement.
• Direct-Minor Consent: For protected direct accounts in Ireland, consent supports account activation and requested AI language practice. A learner aged 16 or 17 provides the affirmative authorisation; for a learner aged 13 to 15, a verified holder of parental responsibility or equivalent authority provides it. Refusal leaves the account protected, and withdrawal stops future consent-based learning processing.
• Legitimate Interests: The minimum processing needed for authentication, session integrity, replay prevention, rate limiting, fraud and abuse controls, authority validation, revocation, security and content-free audit evidence. For children, we use this basis only where a child-specific assessment shows that the processing is necessary, proportionate and does not conflict with the child's best interests.
• Consent for Optional Processing: Separate, granular choices for matters such as non-essential analytics cookies or adult marketing communications. These choices are not bundled with protected-minor activation.
• Legal Obligation: Processing necessary to comply with our legal obligations under Irish and EU law.

Payment authority is separate from guardian learning authority. Optional school, cohort or partner reporting data does not create authority to activate a learner.

5. How We Share Your Information

We may share your information with the following categories of recipients:

5.1 Service Providers

We share information with trusted third-party service providers who help us operate our business, including:

• Cloud hosting and storage providers.
• Payment processors.
• Customer support and communication tools.
• Analytics and performance monitoring services.
• AI service providers for conversation and voice processing.

These service providers are only authorised to use your information as necessary to provide services to us and are contractually obligated to protect your information under strict data processing agreements.

Institutional customers can request our Data Processing Addendum (DPA) via Data Processing Addendum.

5.2 Partners, Institutions and Guardians

We share only the data allowed by the applicable partner or institutional arrangement and reporting configuration. Optional cohort information does not grant staff, content or decision-making access. A guardian receives authority status and the information needed to manage that authority, but no learner conversations, progress, staff, partner, administration, billing or payment access by default.

5.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).

5.4 Business Transfers

If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information.

5.5 With Your Consent

We may share your information with third parties when you have given us your consent to do so.

6. International Data Transfers

LearnLingo.ai is based in Ireland, and your data is primarily stored and processed in the European Union. However, some of our service providers may be located outside the European Economic Area (EEA).

When we transfer personal data outside the EEA, we ensure adequate protection through:

• Relying on adequacy decisions by the European Commission.
• Using Standard Contractual Clauses approved by the European Commission.
• Implementing additional safeguards as required by the GDPR and other applicable data protection laws.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption of sensitive data in transit and at rest.
• Regular security assessments and vulnerability testing.
• Access controls and authentication requirements.
• Staff training on data protection and security practices.
• Incident response procedures.

Despite our best efforts, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data in accordance with industry standards.

8. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account information is retained while your account is active. If you request deletion of your account, we will delete or anonymise your personal information, except where we need to retain certain information for legitimate business or legal purposes.

For adult service profiles, transcripts and conversation history are generally retained for up to 730 days from collection to provide learning history and quality assurance, unless we delete or anonymise them sooner in response to a valid request or account closure. Adult speech-provider audio retention may also be up to 730 days as described above.

Protected-minor accounts use a stricter retention class. Raw conversation transcripts are minimised after 30 days. Derived conversation feedback, rich exam feedback, journey content, listening attempts, pronunciation activity and saved learning content are minimised or deleted after 365 days. Content-free operational logs are retained for 30 days and retention receipts for 12 months.

Guardian activation links expire after 24 hours. Pending guardian request contact is retained for no more than 30 days, subject to earlier replacement or minimisation. Non-secret authority decisions, policy versions and security evidence may be retained separately where needed to prove consent, withdrawal, revocation, abuse controls or legal compliance.

9. Your Data Protection Rights

Depending on your location, you may have certain rights regarding your personal information, including:

• Access: Request a copy of the personal information we hold about you.
• Rectification: Request correction of inaccurate or incomplete information.
• Erasure: Request deletion of your personal information in certain circumstances.
• Restriction: Request that we temporarily or permanently stop processing your personal information.
• Data Portability: Request a copy of your data in a structured, commonly used, and machine-readable format.
• Objection: Object to processing based on legitimate interests, including profiling, and for direct marketing.
• Withdraw Consent: Withdraw consent at any time where we rely on consent to process your information.

To exercise these rights, please contact us at info@learnlingo.ai. We will respond without undue delay and ordinarily within one month, subject to the GDPR.

If you are located in the European Union, you also have the right to lodge a complaint with your local data protection authority.

A child is a data subject in their own right. A guardian request is assessed for identity, current authority, the learner's capacity and best interests; learner data does not automatically belong to the guardian. Withdrawing learning consent does not require us to erase minimum security or authority evidence held under a separate valid basis.

10. Children's Privacy

LearnLingo.ai supports protected access for learners aged 13 to 17 in defined journeys. Under-13 use is not supported. If we learn that an under-13 account has been created, we restrict the account and take proportionate steps to minimise or delete the information unless it must be retained for security, legal or rights-handling purposes.

For direct self-serve access in Ireland, a learner aged 16 or 17 may provide their own specific activation authorisation after receiving child-readable privacy and AI information. A learner aged 13 to 15 needs authorisation from a verified holder of parental responsibility or equivalent authority. The learner receives their own explanation even where the guardian supplies the authorisation.

Partner- or institution-launched minors require a current verified attestation and signed age band. We do not treat optional cohort information, a school identifier or a return URL as authority. Invalid, expired, revoked or mismatched authority fails closed.

Consent does not make a child an adult or give a guardian ownership of the child's information. Minor accounts retain protected defaults, separate payment authority, no behavioural advertising or promotional marketing, and a child-readable AI notice before practice. Learners and guardians can use the contact above to ask questions, exercise rights or withdraw the authority they supplied.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform. Cookies are small text files that are stored on your device when you visit our website.

We use the following types of cookies:

• Essential/Functional Cookies: Necessary for the functioning of our website and services and to remember your preferences.
• Analytics Cookies (Google Analytics): Help us understand how visitors interact with our website and improve the platform.
• Advertising Cookies (Meta Pixel): Optional cookies used to measure ad campaign performance and improve ad relevance.

Analytics and advertising cookies are optional and can be accepted or declined via our consent banner where required. They remain off by default for protected minors. You can also control cookies through your browser settings. Disabling non-essential cookies does not prevent protected-minor activation.

For additional details, see our Cookie Policy.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make.

We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws. You can see when this Privacy Policy was last updated by checking the "Last Updated" date displayed at the top.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

• Email: info@learnlingo.ai