Privacy Policy

1. 1. Who is responsible for your data

The data controller is [TODO: legal name of the company], [TODO: registered address].

For anything about your personal data, write to privacy@funglot.com. For general questions, write to hello@funglot.com.

This policy covers funGlot at funglot.com. It does not cover other websites that we may link to.

2. 2. What data we collect and how

We collect data directly from you when you register and use funGlot, and automatically, by electronic means, as the app records your practice and your sign-ins. We do not buy data about you from others.

• Account data: your email address, your name, your password (stored only as a hash, never in readable form), an optional profile picture, and a made-up handle for the leaderboard.
• Sign-in data: your sign-in sessions with the IP address and browser user agent they come from, and the email verification codes we send you.
• Learning data: the languages you choose; every practice turn (the word, the language, whether you were correct, your response time and the type of error); the schedule of each word for spaced repetition; your test scores; your points, levels and streaks.
• Conversation data: what you type to AI teachers, and the text recognised from your speech, which are processed to produce replies and to judge your answers.
• Plan and payment data: your plan, billing period, language add-ons, complimentary plans and practice-hour credits, and payment status. Card details are collected by Stripe and never reach funGlot.
• Messages you send us, for example support requests.

Your email address, name and password are needed to create an account and provide the service; without them we cannot open an account for you. The profile picture and taking part in the leaderboard are optional.

3. 3. Voice, video and whether this is biometric data

funGlot is voice-first, so it needs your microphone. Your browser asks for your permission before the app can use the microphone or camera, and you can withdraw that permission in your browser at any time.

Speech recognition: when you speak in a game, your microphone audio is sent to our speech-recognition provider to be turned into text. The audio is not stored by funGlot after it has been transcribed. We keep the outcome of the turn (for example the word and whether it was correct), not your voice.

Live sessions: in a live session, audio and, if you switch it on, video travel directly between the participants’ devices (peer-to-peer, using WebRTC). If a direct connection cannot be made, the encrypted stream passes through a relay server, which forwards it without storing it. Live sessions are not recorded by funGlot.

Not used to identify you: we use your voice only to understand what you said. We do not use it to identify or authenticate you and we do not create voiceprints or voice templates. For that reason we do not treat this audio as biometric data processed to uniquely identify a person, which is a special category of data under Article 9 GDPR and Article 6 KVKK. Your voice is still personal data, and we protect it as such.

Please avoid saying sensitive things about yourself or other people during practice; the games do not need them.

4. 4. Why we use your data and on what legal basis

Each line gives the purpose, the data used and the legal basis under GDPR / UK GDPR and under KVKK.

• Creating and running your account, verifying your email address, signing you in. Data: account and sign-in data. Basis: performance of our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Providing the lessons: games, Studio, speech recognition, AI teacher conversation and judging of answers, spaced-repetition scheduling, fortnightly tests, progress dashboard, points, levels and streaks. Data: learning data, conversation data, microphone audio in transit. Basis: performance of contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Live sessions with other participants. Data: audio and optional video in transit, handle, profile picture, connection data such as IP address. Basis: performance of contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Managing plans, practice-hour limits, credits and payments. Data: plan and payment data. Basis: performance of contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Keeping tax and accounting records. Data: plan and payment data. Basis: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
• Sending service emails: verification codes, receipts, renewal reminders, notices of changes. Data: email address, name. Basis: performance of contract and legal obligation (GDPR Art. 6(1)(b) and (c); KVKK Art. 5(2)(c) and (ç)).
• The optional leaderboard. Data: handle, points, level, day streak. Basis: our legitimate interest in offering a motivating feature that you can switch off at any time (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Keeping funGlot secure, preventing misuse, finding and fixing faults. Data: sign-in data, technical logs. Basis: our legitimate interest in a safe and working service (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• The learning experiment and improving the teaching method (see section 6). Data: learning data. Basis: our legitimate interest in understanding and improving how people learn languages, with safeguards for research and statistics (GDPR Art. 6(1)(f) and Art. 89; KVKK Art. 5(2)(f)); publication only of anonymised results (KVKK Art. 28(1)(b)).
• Answering your requests and handling complaints and legal claims. Data: what the request needs. Basis: legal obligation and our legitimate interest in establishing, exercising or defending legal rights (GDPR Art. 6(1)(c) and (f); KVKK Art. 5(2)(ç), (e) and (f)).

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see section 12). We do not currently rely on consent for any of the processing above. If we ever need your consent, for example for something new, we will ask for it separately from this policy and you will be able to withdraw it at any time.

We do not sell your data and we do not use it for advertising.

5. 5. AI teachers and automated processing

When you practise with an AI teacher you are interacting with an AI system, not a person. AI teachers are labelled in the app and their voices are computer-generated.

To make this work, the text of your typed messages and of your recognised speech, together with the context of the game, is sent to our AI providers, which return the teacher’s reply and a judgment of your answer. Text to be spoken is sent to our speech-synthesis provider. These providers act on our instructions under a contract.

AI judgments decide whether a turn counts as correct and so affect your points, levels, streaks and word schedule. These are automated, but they do not have legal effects on you or affect you in a similarly significant way, so they are not decisions of the kind covered by Article 22 GDPR. AI output may be wrong; if you believe a result is wrong, tell us at hello@funglot.com. Users in Türkiye may also object to a result against them that arises solely from automated analysis (KVKK Art. 11(1)(g)).

6. 6. The learning experiment

funGlot compares learning several languages at once with learning one language alone. For this we analyse learners’ own practice data: which words were practised, in which language, whether the answer was correct, response times, error types, schedules and test scores.

The analysis is done on data from which direct identifiers (name, email address, handle) have been removed or replaced by a code. We may publish the results. What we publish is aggregated and de-identified, so that individual learners cannot reasonably be identified.

You can object to the use of your data in the experiment by writing to privacy@funglot.com. Objecting does not affect your use of funGlot. Results already aggregated and published cannot be changed, because they no longer relate to you.

7. 7. What other users can see

Leaderboard: if you take part, other users see only your handle, points, level and day streak. Your name and email address are never shown. You can hide yourself from the leaderboard at any time in your settings, and an administrator can switch the leaderboard off for everyone.

Live sessions: the people in a session with you hear you, see you if you turn your camera on, and see your handle and profile picture. Because the connection is peer-to-peer, technical connection details such as your IP address may be visible to other participants’ devices.

Other participants are not allowed to record you without your consent, but we cannot technically prevent someone from doing so on their own device.

8. 8. Who receives your data

We use the following providers. Each acts as our processor under a written data processing agreement (GDPR Art. 28; KVKK Art. 12) and may use the data only to provide its service to us, except where noted.

• Cloudflare (headquartered in the United States): hosting of the website, network delivery and security, the relay for live sessions when a direct connection fails, and file storage (for example profile pictures). Data passes through Cloudflare’s global network, including data centres near you and in the United States.
• Microsoft Azure (Microsoft, headquartered in the United States): sending our emails, such as verification codes and service notices. Data: your email address, name and the content of the email.
• Google (Gemini API; headquartered in the United States): speech recognition and speech synthesis. Data: microphone audio for transcription and text to be spoken.
• Anthropic (Claude API; headquartered in the United States): AI teacher conversation and judging of answers. Data: your typed messages, recognised speech text and game context.
• Stripe (headquartered in the United States): payments and subscription billing. Data: your email address, plan, and the payment details you give to Stripe. Stripe also uses payment data for its own legal and fraud-prevention purposes, under its own privacy policy.

Our application servers and database run on our own Kubernetes cluster located in [TODO: country of the servers]; your account and learning data are stored there.

We also disclose data when the law requires it (for example to a court or authority with a valid request), to our professional advisers where needed, and to a successor if funGlot is transferred to another company, in which case we will tell you. Other users see only what section 7 describes.

9. 9. Transfers to other countries

Several of our providers are based in the United States or process data there and in other countries. This means your data may be transferred outside the country where you live.

From the EU / EEA: transfers to US providers that are certified under the EU-U.S. Data Privacy Framework rely on the European Commission’s adequacy decision for that framework. For other transfers, or if that decision ceases to apply, we rely on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.

From the United Kingdom: we rely on the UK adequacy regulations for the United States (the UK Extension to the Data Privacy Framework) where the provider is certified, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

From Türkiye: transfers abroad are made under Article 9 of KVKK as amended in 2024. As there is no adequacy decision of the Personal Data Protection Board for the countries concerned, we rely on one of the appropriate safeguards listed in Article 9(4), in particular the standard contract published by the Board, which is notified to the Authority within five business days of signature.

You can ask us at privacy@funglot.com for more information about the safeguard used for a particular transfer and for a copy of it.

10. 10. How long we keep your data

We keep personal data only as long as needed for the purposes above, then delete or anonymise it.

• Account data and learning data: for as long as your account exists and up to [TODO] months after it is deleted.
• Microphone audio for speech recognition: not stored by funGlot after transcription.
• Live-session audio and video: not recorded and not stored.
• Typed messages to AI teachers and recognised speech text: up to [TODO] days.
• Sign-in sessions with IP address and user agent: until the session ends or expires, and up to [TODO] days afterwards for security.
• Email verification codes: until they are used or expire.
• Billing and tax records: [TODO] years, as required by tax and accounting law.
• Requests about your rights and related correspondence: [TODO] years after the request is closed.
• Backups: overwritten within [TODO] days.
• Aggregated, de-identified experiment results: these no longer relate to an identifiable person and may be kept and published without a time limit.

We may keep data longer where the law requires it or where we need it for a legal claim that is under way.

11. 11. How we protect your data

We use technical and organisational measures suited to the risk: encryption of data in transit, hashing of passwords, access to personal data limited to those who need it, and separation of payment card data, which stays with Stripe.

No system is perfectly secure. If a breach of personal data is likely to put your rights at risk, we will notify the competent authority and you as the law requires.

You can help by choosing a strong password that you do not use elsewhere and by signing out on shared devices.

12. 12. Your rights (GDPR and UK GDPR)

If the GDPR or UK GDPR applies to you, you have the right to:

• access: ask whether we process your data and receive a copy of it (Art. 15);
• rectification: have inaccurate or incomplete data corrected (Art. 16);
• erasure: have your data deleted where the law provides for it (Art. 17);
• restriction: have the use of your data limited in certain cases (Art. 18);
• portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller (Art. 20);
• object: object at any time to processing based on our legitimate interests, including the leaderboard and the learning experiment (Art. 21);
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (Art. 22); we do not make such decisions;
• withdraw consent at any time, where processing is based on consent, without affecting what was done before.

How to use your rights: write to privacy@funglot.com from the email address of your account. Using your rights is free. We answer within one month; in complex cases the law allows us up to two more months, and we will tell you if we need them. We may ask for information to confirm your identity.

Complaints: you have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work or where you think the infringement happened. In the United Kingdom this is the Information Commissioner’s Office (ico.org.uk). We would be grateful for the chance to resolve your concern first.

13. 13. Your rights in Türkiye (KVKK Article 11)

If KVKK applies to you, under Article 11 you have the right to apply to us to:

• learn whether your personal data is processed;
• request information about the processing if it is;
• learn the purpose of the processing and whether the data is used in line with that purpose;
• know the third parties, in Türkiye or abroad, to whom your data is transferred;
• request correction of data that is incomplete or inaccurate;
• request erasure or destruction of your data under the conditions in Article 7;
• request that correction, erasure or destruction be notified to third parties to whom the data was transferred;
• object to a result against you that arises from your data being analysed solely by automated systems;
• claim compensation if you suffer damage because your data was processed unlawfully.

How to apply: in Turkish, in writing to [TODO: registered address], or by registered electronic mail (KEP), secure electronic signature or mobile signature, or by email to privacy@funglot.com from the email address registered in your funGlot account, in line with the Communiqué on the Principles and Procedures for Application to the Data Controller. Your application should state your name and surname, your T.R. identity number (or, if you are not a citizen, your nationality and passport or identity number), your address for notification, a contact email, phone or fax, and the subject of your request.

We answer free of charge as soon as possible and within thirty days at the latest. If answering requires an additional cost, we may charge the fee set in the tariff of the Personal Data Protection Board.

If your application is refused, if you find our answer insufficient, or if we do not answer in time, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) within thirty days of learning of our answer and in any case within sixty days of the date of your application.

14. 14. Cookies and local storage

funGlot uses only strictly necessary cookies: the cookie that keeps you signed in. It is needed to provide the service you asked for, so no cookie banner or consent is required for it.

We also use your browser’s local storage to remember your preferences on your device, such as interface language and mode.

We do not use advertising cookies, analytics trackers or third-party tracking pixels. If that changes, we will update this policy and ask for your consent first where the law requires it.

You can delete cookies and local storage in your browser settings. If you delete or block the sign-in cookie you will be signed out and will not be able to stay signed in.

15. 15. Children

funGlot is for adults aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18.

If you believe a person under 18 has created an account, write to privacy@funglot.com and we will close the account and delete the data.

16. 16. Changes to this policy and contact

We may update this policy when funGlot or the law changes. The date at the top shows the latest version. If a change is significant, for example a new purpose or a new provider that receives your data, we tell you by email or in the app before it takes effect.

Data controller: [TODO: legal name of the company], [TODO: registered address]. Privacy questions and requests: privacy@funglot.com. General contact: hello@funglot.com.