Privacy Policy

    Effective Date: March 20, 2026 | Entity: Language Lift, Inc.

    1. Data Controller & Scope

    Language Lift, Inc. ("Language Lift", "we", "our", or "us"), registered in Delaware, USA, with pedagogical and engineering operations in Berlin, Germany, acts as the Data Controller under the EU General Data Protection Regulation (GDPR) and applicable data protection legislation worldwide.

    This Privacy Policy describes how we collect, use, process, and protect your personal information across our website (languagelift.org), web application (app.languagelift.org), and related learning services.

    2. Information We Collect

    • Account Information: Name, email address, password hash, and learning language preferences when you register.
    • Learning & Performance Telemetry: Exercises completed, reaction latencies, spaced-repetition memory stability (FSRS), vocabulary review intervals, and diagnostic CEFR placement scores.
    • Payment & Billing Data: Transaction records, subscription status, and billing addresses processed securely via Stripe. We never store raw credit card numbers on our servers.
    • Technical Identifiers: IP addresses, browser user agents, operating system parameters, and session tokens strictly used for security authentication and DDoS mitigation.

    3. Voice & Audio Data (AI Speaking Tutor)

    Zero Audio Retention & Ephemeral Processing

    When you use the AI Speaking Tutor, your microphone captures spoken German sentences. Audio streams are transmitted via encrypted TLS connections directly to real-time speech-to-text inference engines. We do not record, store, sell, or retain audio recordings. Spoken data is discarded immediately upon generating phonetic feedback and is never used to train public machine learning foundation models.

    4. AI Writing Submissions & Data Privacy

    Text submitted through the AI Writing Coach is parsed exclusively to produce grammatical feedback, stylistic revisions, and vocabulary suggestions. Submissions are processed via secure enterprise API endpoints with zero-day data retention clauses. Your personal writing journals and essays are never indexed into public training corpuses.

    5. Legal Bases for Processing (GDPR Article 6)

    We process personal data under the following legal frameworks:

    • Contractual Performance (Art. 6(1)(b)): To deliver personalized learning, manage subscriptions, and provide technical support.
    • Legitimate Interests (Art. 6(1)(f)): Platform security, fraud prevention, and performance optimization.
    • Consent (Art. 6(1)(a)): Optional marketing communications and microphone hardware permissions.

    6. Your Rights & Data Portability

    Under GDPR and CCPA/CPRA, you possess the right to:

    • Access & Portability: Export your full Vocabulary Bank and learning history in structured JSON or CSV format at any time.
    • Rectification & Erasure: Request immediate correction of erroneous records or complete deletion of your account and all associated data ("Right to be Forgotten").
    • Opt-Out: Withdraw consent for marketing emails or non-essential telemetry at any moment.

    To exercise any of these rights, contact our Data Protection Team at privacy@languagelift.org. Requests are fulfilled within 30 days without charge.

    7. Security & Encryption Standards

    All data is encrypted in transit using TLS 1.3 and at rest utilizing AES-256 encryption. Infrastructure is hosted in SOC 2 Type II certified cloud environments with automated security patch management and regular penetration testing.

    8. Contact Information

    If you have inquiries or concerns regarding this Privacy Policy or our data handling practices:

    Language Lift, Inc. — Privacy & Data Protection Office

    Email: privacy@languagelift.org

    Support: support@languagelift.org

    Postal Address: Language Lift, Inc., 1209 Orange Street, Wilmington, DE 19801, USA