Privacy Policy

This policy explains how Langkit processes personal data when you visit our website, use the learning app, contact us, or acquire a Langkit product. It also explains your rights under the EU General Data Protection Regulation (“GDPR”).

1. Controller and contact

The controller is Jesco Wuester, a sole trader established in Portugal, trading as Langkit.

• Business address: R. Hermano Neves 18, Piso 3, Escritório 7, V6030, 1600-477 Lisboa, Portugal
• Portuguese tax number (NIF): 316197637
• Email: hey@langkit.app

For privacy questions or requests, use the email address above.

2. Personal data we process

Account and profile data

• Email address (given at registration, or taken from the email on a completed order), user identifier, account dates, and authentication records
• Display name and settings you choose to provide
• Account-security and email-verification status

Learning and content data

• Learning progress, card reviews, scheduling data, session history, and saved corpus selections
• The list of words you already know, which we use to generate practice sentences pitched at your level
• Preferences, notes, reports, and other content you choose to submit
• Locally stored study data and preferences kept in your browser

Purchase and support data

• Checkout email, order and purchase identifiers, purchased product, entitlement, and refund status
• Messages and information you send when asking for support or exercising a legal right
• We do not receive or store your complete card number. Lemon Squeezy collects payment and billing information as merchant of record.

Technical and analytics data

• IP address and request information processed in security, hosting, and server logs
• Browser, device type, operating system, approximate location, referring page, and pages visited
• Anonymous, low-cardinality product events such as starting checkout, signing up, or completing a session
• Diagnostics needed to investigate errors, abuse, and service availability

3. Purposes and legal bases

• Contract performance (Article 6(1)(b) GDPR): creating and authenticating your account, providing learning features, processing purchase entitlements, generating downloads, and answering requests about the Service. Where the email on a completed order has no Langkit account, we create an invited account for it so the purchased access can be delivered and preserved.
• Legal obligations (Article 6(1)(c) GDPR): keeping records and responding to valid legal, consumer-protection, tax, accounting, or data-protection requests where applicable.
• Legitimate interests (Article 6(1)(f) GDPR): securing the Service, preventing fraud and abuse, maintaining reliable operations, understanding aggregate feature usage, and improving Langkit. We limit this processing and balance it against your rights and expectations.
• Consent (Article 6(1)(a) GDPR): optional marketing or other processing for which we specifically ask permission. You may withdraw consent at any time without affecting prior processing.

4. Service providers and recipients

We disclose only the data reasonably needed for these providers to perform their roles:

• Hetzner Online GmbH (Germany) — the servers that run our own installation of the Supabase platform (authentication, database, data synchronization, file storage), the learning backend, backups, and the object storage that delivers downloadable assets. Data centres are in Germany and Finland (privacy notice)
• Resend, Inc. (United States) — delivers sign-in, verification, invitation, and purchase emails on our behalf and processes the recipient address and delivery metadata (privacy notice)
• AI model providers — we generate practice sentences and analyse Japanese text with large language models reached through OpenRouter, Inc. and its upstream model providers (privacy notice). Requests contain sentence text and, for personalised sentences, a list of words you know. They never include your name, email, or account identifier, and we use providers that do not train on request data.
• Vercel — website delivery and cookieless Web Analytics. Analytics records aggregate page, device, referrer, approximate-location, and product-event data without attaching it to your Langkit account (analytics privacy information)
• Lemon Squeezy — hosted checkout, payment, tax, receipts, refunds, fraud prevention, and order administration as merchant of record. Lemon Squeezy is an independent controller for payment transactions (privacy notice)
• The Movie Database (TMDB) — browsers may load title artwork directly from TMDB, which exposes normal request metadata to that service (privacy policy)

We may also disclose information when legally required, to protect users or the Service, or in connection with a business reorganization subject to appropriate confidentiality and notice. We do not sell personal data or use it for third-party behavioral advertising.

5. International transfers

Some providers may process data outside Portugal or the European Economic Area. Where required, transfers rely on a European Commission adequacy decision, Standard Contractual Clauses, or another lawful safeguard. You may contact us for information about safeguards relevant to your data.

6. Retention

Account and learning data are normally kept while your account is active. Following account deletion, we aim to delete or anonymize account-linked learning data within 30 days, subject to backups and records that must be kept for legal or security reasons. Backup copies expire according to the backup rotation rather than being restored for ordinary use.

Order, purchase-key, entitlement, and support records are kept for as long as reasonably needed to deliver durable purchased access, handle refunds and fraud, establish or defend legal claims, and satisfy applicable accounting and legal-retention periods. Security logs are retained only for a period proportionate to operational and abuse prevention needs. Anonymous Vercel Analytics visitor hashes expire after 24 hours; aggregate analytics may be retained for longer.

7. Browser storage and analytics

Langkit uses essential browser storage for authentication, purchase recovery, preferences, offline learning data, and core application functionality. Removing it may sign you out, clear locally stored progress, or remove saved settings. Vercel Web Analytics does not use tracking cookies; it uses a short-lived request-derived hash and does not associate analytics with your Langkit account. We do not use advertising cookies.

8. Your rights

Depending on the circumstances, GDPR rights include:

• Access to your personal data and information about its processing
• Correction of inaccurate or incomplete data
• Erasure of data that no longer has a lawful reason to be kept
• Restriction of processing in specified circumstances
• Portability of data processed automatically on consent or contract grounds
• Objection to processing based on legitimate interests
• Withdrawal of consent at any time where processing relies on consent

Send requests to hey@langkit.app. We may need to verify your identity and will normally respond within one month. These rights can be limited where an exemption or overriding legal duty applies.

9. Automated decisions

Langkit does not use personal data to make solely automated decisions that produce legal or similarly significant effects. Automated entitlement checks simply determine whether an account or purchase key covers a requested feature or download.

10. Security

We use measures appropriate to the risk, including encrypted transmission, managed authentication, access controls, signed purchase links, restricted administrative access, and backups. No system is perfectly secure, so please use a unique password and tell us promptly if you suspect unauthorized account or purchase access.

11. Complaints

Please contact us first so we can investigate. You also have the right to complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the data-protection authority where you live or work.

12. Changes

We may update this policy when our processing, providers, or legal duties change. We will post the new version, revise the date above, and provide reasonable notice of material changes where appropriate.