Privacy Policy

Effective date: 14 July 2026 · Version: 2026-07-14-v1

Required before launch: replace REPLACE_LEGAL_NAME, REPLACE_POSTAL_ADDRESS, REPLACE_PRIVACY_EMAIL and REPLACE_COUNTRY. Obtain legal review for the countries where the service is sold.

1. Who controls your information

LanguageStride is operated by REPLACE_LEGAL_NAME, of REPLACE_POSTAL_ADDRESS, REPLACE_COUNTRY (“LanguageStride”, “we”, “us”). We are the controller of personal information described in this policy. Privacy enquiries can be sent to REPLACE_PRIVACY_EMAIL.

2. Scope and minimum age

This policy applies to the LanguageStride website, account, learning tools, subscription features and AI-assisted tools. The service is intended only for people aged 16 or over. We do not knowingly permit accounts for younger users.

3. Information we process

CategoryExamplesMain purpose

Account dataEmail address, display name, account identifier, confirmation and login records.Create and secure the account.

Learning dataSelected languages and levels, card grades, deck progress, script progress, checkpoint results, preferences, mistakes and streak data.Provide progress tracking and personalised revision.

AI inputs and outputsText entered for explanations, practice, writing feedback, study plans and confirmed speaking transcripts, plus generated responses.Provide requested AI-assisted learning features and enforce allowances.

Subscription dataPlan, subscription status, Stripe customer/subscription identifiers, renewal or access-end dates and billing-event records.Grant paid access and manage billing status.

Usage and security dataAI-credit counters, IP-derived rate-limit data, request time, browser-provided technical information and limited error logs.Prevent abuse, control cost, troubleshoot and secure the service.

4. What is not stored by LanguageStride

Payment-card numbers and full card credentials are entered on Stripe’s hosted pages and are not stored in the LanguageStride application database. Microphone recordings used for local playback are not sent to the LanguageStride AI endpoint. The AI receives only the transcript that the learner confirms or edits.

5. Purposes and lawful bases

Where UK or European data-protection law applies, we rely on:

Contract: creating accounts, saving learning progress, providing requested learning tools, administering subscriptions and responding to support requests.
Legitimate interests: securing the service, preventing fraud and abuse, measuring reliability, enforcing AI limits and improving product operation, balanced against user rights.
Legal obligation: keeping records required for tax, accounting, consumer protection, disputes or regulatory compliance.
Consent: where a feature or law specifically requires consent. Consent can be withdrawn for future processing, without affecting earlier lawful processing.

6. AI-assisted features

AI is used only when the learner requests an explanation, targeted practice, roleplay reply, writing assessment or study plan. Flashcard scheduling, local answer matching, readiness calculations, internal checkpoint marking, audio playback and the Mistake Bank do not require AI.

AI responses can be inaccurate or incomplete. Do not submit passwords, payment information, health information, government identifiers or other sensitive personal information. The active provider and model are displayed in Profile → Settings. Depending on configuration, text may be processed by OpenRouter, OpenAI or another provider identified in the application.

7. Browser speech services

Speech recognition may be supplied by the learner’s browser or operating system. That provider may process audio under its own terms and privacy policy. LanguageStride cannot guarantee that speech recognition runs entirely on the device. When recognition is unavailable, learners can type a transcript manually.

8. Service providers and recipients

Cloudflare: website delivery, server-side application logic, security and rate limiting.
Supabase: authentication, database and account records.
Stripe: hosted checkout, payment processing, subscription administration and customer portal.
Configured AI provider: processing text submitted to AI-assisted features.
Professional advisers and authorities: where reasonably necessary for legal, security, accounting or dispute purposes.

We do not sell personal information to advertisers.

9. International transfers

Some service providers may process information outside the user’s country. Where required, we use the provider’s applicable contractual safeguards or other lawful transfer mechanism. Provider locations and transfer terms should be reviewed before launch and after material provider changes.

10. Retention

Account and learning data: while the account is active, then deleted when the account is permanently deleted, subject to backups and legal obligations.
Subscription and transaction records: retained for up to seven years where reasonably required for accounting, tax, disputes or legal compliance.
Billing webhook records: normally retained for up to two years for audit, fraud prevention and entitlement troubleshooting.
AI-credit balances: retained while the account exists; daily and monthly counters reset automatically.
Security and diagnostic logs: normally retained for up to 90 days unless a longer period is needed to investigate abuse or a legal claim.
Local microphone recording: held in the browser session for playback and removed when replaced, the page is closed or browser storage is cleared.

11. Cookies and local storage

LanguageStride uses strictly necessary secure session cookies to keep users signed in. Browser local storage may retain learning preferences and local progress. These technologies are required for requested functionality rather than advertising. If analytics or marketing technologies are added later, this policy and the consent mechanism must be updated before use.

12. Security

Measures include server-side secrets, secure HTTP-only session cookies, same-origin API controls, database row-level security, verified Stripe webhooks, payload limits, AI rate limits and restrictive browser security headers. No internet service can guarantee absolute security.

13. Your choices and rights

Depending on applicable law, users may have rights to access, correct, export or delete information; restrict or object to some processing; withdraw consent; and complain to a regulator. Profile → Settings provides data export and account deletion. An active subscription must be cancelled in the Stripe customer portal before account deletion.

Requests can be sent to REPLACE_PRIVACY_EMAIL. We may need to verify identity. UK users can also complain to the UK Information Commissioner’s Office.

14. Changes

Material changes will be identified by a new effective date and policy version. Where required, we will request renewed acceptance.

15. Contact

REPLACE_LEGAL_NAME
REPLACE_POSTAL_ADDRESS
REPLACE_COUNTRY
Email: REPLACE_PRIVACY_EMAIL