Privacy Policy
Last updated: 12 June 2026
This policy explains what personal data Tonglift collects, why, the legal bases we rely on, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
Contents
1. Who we are
The data controller responsible for your personal data is:
[Legal entity name]
[Street address, postal code, city]
[Country]
Email: privacy@tonglift.app
If we have appointed a Data Protection Officer, you can reach them at [DPO email, if applicable]. (A DPO is only legally required in specific cases — confirm with your lawyer whether you need one.)
2. Data we collect
| Category | Examples |
|---|---|
| Account data | Email address, display name, hashed password, language/workspace preferences, account timestamps. |
| Conversation & speech data | Audio you record during practice, its transcription, the messages exchanged with the AI tutor, and the corrections/assessments generated. |
| Learning data | Lessons you create or copy, saved vocabulary, progress, streaks, and any lessons you publish to the community library. |
| Payment data | Subscription tier and billing status. Card/payment details are processed by our payment provider (Polar) — we never see or store your full card number. |
| Technical data | IP address, browser/device type, and server logs, collected automatically when you use the service. |
3. Why we use it & legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide your account and the tutoring service | Performance of a contract — Art. 6(1)(b) |
| Process your speech to generate corrections and lessons | Performance of a contract — Art. 6(1)(b) |
| Send transactional email (email confirmation, account notices) | Performance of a contract — Art. 6(1)(b) |
| Process subscription payments & meet bookkeeping/tax duties | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Keep the service secure and prevent abuse | Legitimate interests — Art. 6(1)(f) |
| Optional product updates / marketing email | Consent — Art. 6(1)(a) (you can withdraw any time) |
4. AI processing of your speech
To give you real-time corrections, your recorded audio and messages are processed by automated AI systems (speech-to-text, a language model, and text-to-speech). This processing is what delivers the service. We do not sell your conversations, and we do not use them for advertising. Where a sub-processor could use submitted content to train its own models, we use configurations/agreements intended to prevent that — [confirm each provider's training/retention terms with your lawyer].
5. Sub-processors & international transfers
We use the following processors to run Tonglift. Some are located outside the EU/EEA (notably the US); for those, transfers are protected by the European Commission's Standard Contractual Clauses and/or an adequacy mechanism.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner | Hosting & database | Germany (EU) |
| OpenAI [/ your LLM provider] | Language model — corrections & replies | USA — SCCs |
| [STT/TTS provider] | Speech-to-text / text-to-speech | [location] |
| Mailjet (Sinch) | Transactional email | EU |
| Polar | Payments (merchant of record) & invoicing | [per Polar DPA] |
A current list of sub-processors is available on request at privacy@tonglift.app.
6. How long we keep your data
We keep your personal data for as long as your account is active. When you delete your account (in-app, or by request), we erase your content and scrub your account record; residual copies in encrypted backups are removed on the normal backup-rotation cycle ([state your backup retention, e.g. 30 days]). Invoicing records are retained as long as tax law requires ([e.g. up to 10 years in Germany]).
7. Your rights
Under the GDPR you have the right to: access your data, rectify inaccurate data, request erasure, restrict or object to processing, request data portability, and withdraw consent at any time (without affecting prior processing).
You can delete your account and export your data directly in the app. For any other request, email privacy@tonglift.app. You also have the right to lodge a complaint with a supervisory authority — for us that is [your competent data-protection authority, e.g. the relevant German state DPA].
8. Cookies
We use a small number of strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. These are required for the service to function and do not require consent. We do not use advertising or third-party tracking cookies. [If you later add analytics, add a consent banner and update this section.]
9. Security
We protect your data with encryption in transit (HTTPS), hashed passwords, access controls, and EU-based hosting. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the risk.
10. Children
Tonglift is not directed at children under 16. If you are under the age of digital consent in your country, you may use Tonglift only with the consent of a holder of parental responsibility.
11. Changes to this policy
We may update this policy from time to time. We will post the new version here and update the "last updated" date; material changes will be communicated in-app or by email.
Questions? privacy@tonglift.app