Privacy Policy

Last updated: January 1, 2026

1. Data Controller

Opieesti OÜ (a company under Estonian law, no. 17450090), operating the OpiFluent service ("we"), is the data controller for your personal data. See our legal notice. Contact: [email protected]

2. Data We Collect

We collect: email address, password (hashed), preferred language, CEFR level, learning statistics (XP, streak, words learned), session history. We do not collect payment data (handled by Stripe).

3. Purpose of Processing

Your data is used to: provide the learning service, personalize your experience, track your progress, send transactional emails (account confirmation, magic link).

4. Legal Basis

Processing is based on: contract performance (Art. 6.1.b GDPR) for service delivery, your consent (Art. 6.1.a GDPR) for marketing communications.

5. Retention Period

Your data is kept as long as your account is active. After account deletion, data is erased within 30 days.

6. Your Rights (GDPR)

You have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17, button in your profile), portability (Art. 20, contact us), objection (Art. 21). To exercise your rights: [email protected]. You may also lodge a complaint with the competent supervisory authority (in France, the CNIL, www.cnil.fr) if you believe your rights are not being respected.

7. Sub-processors and Data Recipients

We rely on the following providers to deliver the service: Supabase (database hosting and authentication, EU Frankfurt), Vercel (application hosting), Google / Gemini (processes your messages and voice for the AI tutor, speech-to-text and text-to-speech), Stripe (payment processing, we do not store any banking data), Brevo (marketing emails), Resend (transactional emails: account confirmation, magic link). Each of these providers processes your data solely for the purposes described, under a GDPR-compliant contract.

8. International Transfers

Google LLC (provider of the Gemini AI) is based in the United States. Data transfers to this provider are governed by the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework, ensuring an adequate level of protection for your data.

9. Cookies and Local Storage

We use functional cookies (authentication session) and local storage (localStorage) to remember your preferences (language, level) and, for visitors, first-party attribution data (visit source: UTM) used solely for internal statistics. We do not use any advertising cookies or third-party pixels (Google Analytics, Meta, TikTok, or other).

10. Contact

For any questions: [email protected]