Privacy policy

1. Data controller

The data controller within the meaning of the GDPR (Regulation (EU) 2016/679) and applicable data protection law is:

• Buzly Labs Ltd
• UIC: 201170349
• Website: greeklingo.app
• Email for data protection enquiries: ask@greeklingo.app

2. What data we collect

• Account data: email, password (encrypted), name/display name, profile information.
• Learning data: lesson progress, test results, certificates, favourite words, streak.
• Subscription data: Premium status, identifiers from the payment provider (no full card data on our servers).
• Communication: messages via the contact form, emails (e.g. word of the day, confirmations).
• Technical data: IP address, browser type, language, cookies, analytics events.

3. Purposes and legal basis

• Providing the service — registration, lessons, progress (contract performance, Art. 6(1)(b) GDPR).
• Payments and subscription — order processing (contract / legitimate interest).
• Support — responding to enquiries (legitimate interest / contract).
• Analytics and marketing — improving the site, ad pixels (consent where applicable, Art. 6(1)(a) GDPR).
• Security and legal obligations — abuse prevention, accounting (legal obligation / legitimate interest).

4. Recipients and processors

We share data only with providers necessary to operate GreekLingo:

• Supabase — database hosting and authentication (EU/US, standard contractual clauses where required).
• Vercel — application hosting.
• Lemon Squeezy — merchant of record: payments, subscriptions and billing; may use payment partners per the Lemon Squeezy privacy policy.
• Google Analytics / Google Cloud TTS — analytics and speech synthesis (with analytics consent).
• Meta Pixel, TikTok Pixel, Microsoft Clarity — analytics and advertising (with consent).
• Email provider (SMTP) — transactional and marketing emails.

We do not sell personal data to third parties.

5. Retention period

• Account data — until account deletion or up to 3 years of inactivity.
• Subscription and billing data — per accounting requirements (usually up to 5 years).
• Analytics cookies — per provider settings or until consent is withdrawn.

6. Cookies

We use essential cookies for login and session, and analytics/marketing cookies after your consent via the cookie banner. You can change your choice by clearing the localStorage key "cookie-consent" or rejecting non-essential cookies on first visit.

7. Your rights (GDPR)

You have the right to:

• access your personal data;
• rectify inaccurate data;
• erasure ("right to be forgotten");
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time (without affecting the lawfulness of prior processing).

To exercise your rights, email ask@greeklingo.app.You may lodge a complaint with the Commission for Personal Data Protection (CPDP) — www.cpdp.bg.

8. Security

We apply appropriate technical and organisational measures (encryption, access control, secure providers) to protect personal data against unauthorised access, loss, or destruction.

9. Children

The service is not intended for persons under 16 without parental/guardian consent. If we learn that data was collected from a child without consent, we will delete it.

10. Changes

We may update this policy. Material changes will be published on this page. See also our terms of service.