PRIVACY POLICY

DATA WE COLLECT

We collect the following categories of personal data:

• Account data — your email address, display name, and password (stored as a secure hash) when you register.
• Profile data — your selected destination country and preferred language, which you provide during onboarding.
• Session and conversation data — the messages you send and receive during practice sessions, along with session metadata such as the language, level, duration, and start and end times.
• Vocabulary data — words and phrases you save, together with any personal notes you add.
• Payment data — if you purchase a Pro subscription, transaction identifiers and payment status are recorded. Full card details are handled exclusively by our payment provider and are never stored by us.
• Usage data — anonymised page views and feature usage collected by our analytics tool (see Third-Party Services below).

HOW WE USE YOUR DATA

We use your data only for the purposes for which it was collected:

• To provide, operate, and improve the Lunchtime Lingo service.
• To authenticate your account and keep your data secure.
• To generate AI-powered conversation responses during your practice sessions.
• To process Pro subscription payments and verify your subscription status.
• To send transactional emails such as password reset links and account notifications.
• To understand how the application is used in aggregate, so we can improve it.

We do not sell your personal data, use it for advertising, or share it with third parties except as described in this policy.

LEGAL BASIS FOR PROCESSING

Under the GDPR, we process your data on the following legal bases:

• Contract — processing your account, session, and payment data is necessary to provide the service you signed up for.
• Legitimate interests — anonymised analytics help us understand and improve the product without identifying you personally.
• Legal obligation — we may retain certain data to comply with applicable laws.

THIRD-PARTY SERVICES

Lunchtime Lingo relies on the following third-party services to operate:

• Supabase — database, authentication, and file storage. Your account and session data is stored on Supabase infrastructure.
• Anthropic — AI language model powering conversation generation. Messages you send during a session are processed by Anthropic's API to generate responses.
• Mailgun — transactional email delivery for account-related emails.
• Bunq — payment processing for Pro subscriptions.
• Umami — privacy-friendly, cookieless web analytics. No personally identifiable information is collected and no data is shared with advertising networks.

Each of these providers processes data only as necessary to deliver their service and is contractually bound to handle it in accordance with applicable data protection law.

COOKIES AND LOCAL STORAGE

Lunchtime Lingo uses browser local storage to maintain your login session and to remember app preferences such as your selected language. We do not use third-party tracking cookies. Our analytics provider (Umami) is cookieless and does not set any cookies in your browser.

DATA RETENTION

We retain your personal data for as long as your account is active or as needed to provide the service. When you delete your account, your name and login credentials are permanently removed and your profile is anonymised. Session and conversation data associated with your account is retained in de-identified form and cannot be linked back to you.

YOUR RIGHTS

Under the GDPR you have the following rights regarding your personal data:

• Access — you may request a copy of the data we hold about you.
• Rectification — you may ask us to correct inaccurate data.
• Erasure — you may request deletion of your personal data. You can also delete your account directly from the app.
• Restriction — you may ask us to restrict how we process your data in certain circumstances.
• Portability — you may request your data in a structured, machine-readable format.
• Objection — you may object to processing based on legitimate interests.

To exercise any of these rights, contact us at info@lunchtimelingo.com. You also have the right to lodge a complaint with the Dutch data protection authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page. Continued use of the service after changes are posted constitutes acceptance of the updated policy.