Privacy Policy

1General

This Privacy Policy explains how the personal data of people who use the Lingomios website, apps and related services (together, the "Service") is processed. Lingomios is the controller of your personal data; contact details are at the end of this page.

This notice is intended to meet the information obligations under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).

2Information we collect

We only collect data we need to provide, improve and secure the Service:

• Account information: email address, display name, password (stored only as a secure hash) or, if you sign in with Google, your Google account identifier.
• Language preferences: your interface language, native language, the language you are learning, your level, learning goals and daily study time goal.
• Learning data: lessons you complete, your answers, your progress, vocabulary and error patterns, and the structured learning notes your AI teacher keeps for you.
• Conversation data: the text of your written or spoken practice with the AI teacher, corrections and the session summary.
• Support requests: the category, subject and message you enter in the support form, and our team's reply.
• Confirmations: the 18+ eligibility confirmation you give for AI features and its date.
• Technical and security data: session cookies, sign-in and security logs, error and performance measurements. Usage measurements are pseudonymous; conversation text and email addresses are not added to them.

3Voice practice and microphone

We only ask for microphone permission when you start voice practice, and we never record in the background. Your speech is passed temporarily through our servers to a speech recognition provider to be converted to text. We do not store raw audio recordings and do not create voiceprints.

You do not have to grant microphone permission; without it you can do the same practice by typing. We do not show unverified pronunciation or fluency scores.

4Why we process your data and on what legal basis

We process your data for the following purposes, based on the legal grounds in Article 5 KVKK and Article 6 GDPR:

• Creating your account, signing you in and providing lessons, the AI teacher and voice practice: entering into and performing our contract.
• Personalising your learning, showing your progress and preparing review suggestions: performance of our contract.
• Answering support requests and sending email notifications about them: performance of our contract.
• Keeping the Service secure, preventing abuse and quota overuse, and fixing errors: legitimate interest.
• Measuring and improving the Service with pseudonymous usage data: legitimate interest.
• Meeting legal obligations and responding to requests from competent authorities: legal obligation.
• Optional features you explicitly start, such as microphone access: your choice and explicit permission, which you can withdraw at any time.

5The AI teacher

The AI teacher uses a third-party AI provider to generate its answers. Only the context needed for the current practice is sent: your active language profile, lesson or scenario details, the last few conversation turns and summarised learning notes. Your full history is not sent with every request.

We use contracts and service settings to ensure providers do not use conversation content to train their own models. AI output is not shown or stored before it passes safety and format checks. No decisions about you are made by AI; the teacher's suggestions are for learning only.

We recommend not writing sensitive information such as passwords, ID numbers, health details or card details in your conversations.

6Who we share your data with

We do not sell your personal data or share it with advertising networks. We only share your data, to the extent necessary, with service providers who help us run the Service and act on our instructions:

• Hosting, database and authentication infrastructure (Supabase).
• AI teacher, speech recognition and speech synthesis (OpenAI).
• Authentication if you choose to sign in with Google (Google).
• An email delivery provider for account and support emails.
• Public authorities with legal power, only where we have a legal obligation.

7International transfers

Some of our service providers may process data on servers outside Türkiye or the European Economic Area. In that case we transfer data with the safeguards provided for in Article 9 KVKK and the GDPR, such as standard contracts or adequacy decisions, and require providers to process the data only for the Service.

8How long we keep data

We keep your data only as long as the purpose requires:

• Raw microphone audio: not stored.
• Conversation transcripts (written and voice practice): at most 30 days; after that, conversation turns, corrections and summaries are deleted.
• Lesson progress and structured learning notes: while your account is open or until you reset them.
• Support requests: for a reasonable period to resolve the request and any disputes.
• Security and legal records: for as long as security needs and statutory retention periods require.
• When you delete your account, your personal data is deleted or anonymised; records we are legally required to keep are retained only for that purpose with restricted access.

9Your rights

Under Article 11 KVKK and the GDPR you have the right to learn whether your personal data is processed and, if so, to request information and a copy; to learn the purpose of processing and whether data is used accordingly; to know the third parties it is transferred to; to have incomplete or inaccurate data corrected, deleted or its processing restricted; to receive your data in a portable format; to object to processing based on legitimate interest; to withdraw your consent; and to claim compensation if you suffer damage from unlawful processing.

You can exercise most of these rights directly on your Profile page: correct your details, export your data, delete your conversation history, reset your AI learning notes and request account deletion. For other requests, email us; we respond within 30 days at the latest.

If you are not satisfied with our response, you can complain to the Personal Data Protection Authority (KVKK) in Türkiye or, in the European Union, to the data protection authority of the country where you live.

10Security

We encrypt your data in transit, use row-level access rules in our database so that only your own records are accessible to you, and restrict admin panel access with role-based permissions and, where required, two-step verification. Admin actions are logged. No system is perfect; if a data breach occurs, we will inform affected people and authorities as required by law.

11Age requirement

The AI teacher and voice practice features are only for users aged 18 and over, and we ask for an explicit eligibility confirmation before you use them. We do not try to guess your age and do not store your date of birth. We currently do not offer a separate experience for minors; if we learn that we have collected data from a minor, we delete it.

12Changes to this policy

We may update this policy to reflect changes in the Service or the law. The current version is always published on this page with its last updated date. We announce important changes in the Service or by email before they take effect.