Privacy Policy

Last updated: 2 March 2026

1. Introduction

Languamate (“we”, “us”, “our”) is a language practice platform operated from Sweden. We are the data controller for personal data processed through our website, applications, and services (collectively, the “Service”).

This Privacy Policy explains how we collect, use, share, store, and protect personal data when you use the Service.

We have not appointed a Data Protection Officer (DPO). If this changes, we will update this policy. For all privacy matters, contact privacy@languamate.com.

2. Personal data we collect

2.1 Data you provide

• Account information (ages 13+): email address, password (stored only in hashed form), and display name when you create an account.
• Third-party sign-in data: if you sign in using a provider such as Google, we receive the information you choose to share (typically name, email address, and profile picture).
• Content you create (“User Content”): word lists, clues, definitions, activity configurations, and other content you submit through teacher tools or other features.
• Communications: any messages or information you send to us directly (for example, by email).

2.2 Learning progress data (two ways to use Languamate)

A) Self-learners and account holders (ages 13+)

If you create an account and use Languamate for self-study, we may store your learning progress in your account. This can include your answers, scores, results, completion history, and recommendations used to personalise your learning path.

B) Classroom use with student codes (teacher-managed access)

Student-facing activities can be used without an account. If a teacher enables progress tracking or personalised learning paths, we process student activity and progress data under a teacher-managed student code. When a teacher or their school/institution enables progress tracking, they are typically the data controller and Languamate acts as a data processor. Where required, we enter into data processing agreements. We do not require students to provide names or email addresses for student-code access. Teachers and students should avoid using real names in free-text fields.

2.3 Data collected automatically

• Session data: authentication tokens stored in cookies to keep you signed in.
• Server and security logs: our infrastructure providers may log standard request data such as IP address, browser type, referring pages, and timestamps. We use this information for security, abuse prevention, debugging, and service operation.

3. How we use personal data

We use personal data to:

• provide, operate, and maintain the Service;
• create and manage accounts (ages 13+) and authenticate users;
• store and serve activities and User Content created by account holders;
• provide learning progress tracking and personalised learning paths for account holders, and where enabled by a teacher, for student-code users;
• provide teacher-facing class reporting where available;
• communicate with you about your account, support requests, and important Service updates;
• protect the Service (security monitoring, preventing fraud/abuse, and troubleshooting);
• enforce our Terms and comply with legal obligations; and
• improve and develop the Service (using aggregated or anonymised data where possible).

4. Legal bases for processing (GDPR)

We process personal data under the following legal bases. The applicable basis depends on the specific processing activity. If you have questions about which legal basis applies to a specific processing activity, contact us and we will explain.

Contract (Article 6(1)(b))

To provide the Service (including account creation, authentication, saving teacher-created content, and teacher-enabled student progress tracking).

Legitimate interests (Article 6(1)(f))

To secure and operate the Service, prevent abuse and fraud, debug issues, and improve performance and reliability. We balance these interests against your rights and freedoms.

Consent (Article 6(1)(a))

Where we ask for it (for example, optional analytics cookies or marketing communications). You can withdraw consent at any time.

Legal obligation (Article 6(1)(c))

Where we must process data to comply with applicable law.

5. Sharing and third-party service providers

We use trusted third-party providers to run the Service. These providers may process personal data on our behalf and are required to protect it and process it only as permitted by applicable law and relevant contracts.

Examples include:

• hosting and cloud infrastructure (to serve the website and process requests);
• database and authentication services (to store account data and manage sign-in);
• AI providers (to generate or assist with generating content when you use AI features);
• analytics tools (only if enabled, and subject to cookie consent where required); and
• font delivery services (your device may share your IP address with the font provider when loading fonts).

Passwords: we do not share your password with anyone. Passwords are stored only in hashed form and cannot be read by us.

A current list of our sub-processors is available on request by emailing privacy@languamate.com.

We do not sell, rent, or trade your personal data. We do not share personal data with third parties for their own marketing purposes.

6. International data transfers

Some providers may process data outside the European Economic Area (EEA). When personal data is transferred outside the EEA, we use appropriate safeguards such as:

• Standard Contractual Clauses approved by the European Commission;
• transfers to recipients certified under an applicable data privacy framework (where available), such as the EU-U.S. Data Privacy Framework; and/or
• transfers to countries with an adequacy decision, where applicable.

7. Cookies and similar technologies

We use cookies to operate the Service.

Strictly necessary cookies are used for core functions such as login sessions and security.

We may also use optional analytics cookies or similar technologies to understand how the Service is used and improve it. We do not use advertising cookies or tracking pixels. Where required by law, we will ask for your consent before setting non-essential cookies, and you can change your preferences at any time.

8. Data retention

We keep personal data only as long as necessary for the purposes described in this policy, unless a longer period is required by law.

Account data: retained while your account is active. If you delete your account, we aim to erase or anonymise personal data within 30 days, except where it must be retained by law or where copies remain in backups for up to 30 days.

Student progress data (student codes): retained until deleted by the teacher (or where available, the user), and otherwise deleted or anonymised after 12 months of inactivity. Copies may remain in backups for up to 30 days.

User Content: you can delete content you created. Copies may persist in backups for up to 30 days. If content is deleted, links or QR codes pointing to it may stop working.

Logs:retained according to our providers' standard retention periods (typically 30–90 days, and in no event longer than 12 months) and used for security, abuse prevention, and debugging.

9. Security

We use appropriate technical and organisational measures to protect personal data, including:

• encryption in transit (HTTPS/TLS);
• hashed password storage (never plain text);
• secure, HTTP-only cookies where applicable;
• secure storage of secrets and API keys on the server; and
• access controls to limit internal access.

No system is perfectly secure. While we take reasonable steps to protect data, we cannot guarantee absolute security.

In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware, and we will notify affected individuals where required by law.

10. Children and educational use

Languamate is designed for educational use. Students can use activities without creating an account.

Accounts: account creation is intended for users aged 13 and over, unless local laws require a higher minimum age or parental consent. We do not knowingly collect account information from children under 13 (or the applicable minimum age). We rely on users to provide accurate age information during registration.

Younger learners: learners below the applicable minimum age can use the Service via teacher-managed access (for example, student codes) without creating an account. Teachers and students should not include personal data (such as full names or contact details) in free-text fields.

If we learn that an account was created by a user below the minimum age, we will take steps to delete the account and associated data. If you believe a child has provided personal data without appropriate permission or oversight, contact privacy@languamate.com.

11. Your rights (GDPR)

If you are located in the EEA (and in some cases elsewhere), you may have the right to:

• access your personal data;
• correct inaccurate or incomplete data;
• request deletion (subject to legal and technical limits);
• restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• data portability; and
• withdraw consent where processing is based on consent.

To exercise these rights, email privacy@languamate.com. We may need to verify your identity before processing your request. We aim to respond within 30 days (and will notify you if we need more time).

If you are not satisfied with our response, you can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or your local supervisory authority.

12. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

13. Service communications and notices

We may send you administrative or service-related messages (for example, security notices or important updates). These communications are part of operating the Service and are not marketing. You may opt out of marketing communications where offered.

Notices under this policy may be provided by email to your account email address or by posting within the Service.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (if you have an account) or by posting a prominent notice within the Service before the changes take effect. The “Last updated” date at the top shows when this policy was last revised.

15. Contact

For privacy questions or requests, contact: