Privacy Policy

This policy explains what Háblalo (hablalo.io, its apps and its browser extension) does with your personal data, who else receives it and what you can ask us to do with it.

1. Who is responsible

The controller is Wiktor Piotr Pawlikowski, a self-employed individual (autónomo) in Spain: Calle Martínez Maldonado 11, 3A, 29007 Málaga, Spain, tax number (NIF) Z3966763G. Write to wiktor@hablalo.io with any question about your data or to use the rights in section 8.

2. What we collect

• Your account: e-mail address, a hash of your password (never the password itself), display name, avatar if you upload one, the languages you study, your level and settings, and when you confirmed your age and accepted the Terms at sign-up.
• Your learning: lessons and progress, reviews, word lists, dictionary lookups, streaks, practice answers, writing, and the mistakes the app records to choose your next practice.
• What you send to AI features: messages to the assistant, writing you ask to have checked, roleplay and dialogue turns, images you attach, and your voice when you use speaking or voice conversation. Audio is sent to the provider that turns it into text, judges your pronunciation from it or answers it; we keep the text, not the recording.
• The assistant’s memory: short facts the assistant saves about you (your goals, level or interests) so later answers fit you. You can read, change and delete each one on the assistant’s memory page.
• Reports you send: corrections to dictionary entries with any screenshots you add, and AI replies you report, with the reason.
• Answers to our feedback form: what you pick and write about the app and about the assistant. The part about the assistant is read by the AI once, to correct the assistant’s memory to match; the form then shows you what it changed.
• Payments: Polar handles the payment. We receive your plan, its status and renewal date, the amount, the currency and the country Polar uses for tax. We never see your card.
• Technical data: the addresses you sign in from and when (to protect your account), a record of refused and unusual requests with their address and browser (to detect abuse), error reports, the time you were last active, and on the mobile app the device details and push token that deliver notifications.

3. Why we use it, and on what basis

• To give you the service you signed up for: your account, lessons, AI features, the assistant’s memory, practice chosen from your mistakes, reports and your subscription. Basis: the contract with you (GDPR art. 6(1)(b)).
• To keep the service secure and working: sign-in addresses, abuse and fraud prevention, daily allowances and error monitoring. Basis: our legitimate interest in a secure, working service (art. 6(1)(f)).
• To meet legal duties such as tax records (kept mostly by Polar) and answers to consumer complaints. Basis: legal obligation (art. 6(1)(c)).
• Push notifications, only if you allow them on your device. Basis: consent (art. 6(1)(a)), which you withdraw in your device settings.

4. AI features and the providers that run them

Háblalo’s AI features are answered by outside providers. The app asks your permission before it first sends them anything of yours. What each one receives:

• Google (Gemini API): the text, images and context of every AI feature, the audio of voice conversations, and your recordings in speaking exercises, which it listens to when it judges your pronunciation. Under the Gemini API terms that apply to a developer in the European Economic Area, Google does not use this content to improve its products.
• OpenRouter, OpenAI and Anthropic: the same text, only when Gemini fails to answer and the request is retried with one of them.
• OpenRouter: when no stock photo shows a word and its picture is generated instead, a description of that picture, written from the word. It is sent without your account or anything else about you.
• TogetherAI and ElevenLabs: your recordings in speaking exercises, to turn them into text.
• ElevenLabs: the text the app reads aloud to you.

Each provider uses the content to produce the answer and keeps it only as long as its API terms allow, typically for abuse monitoring. We do not use your content to train AI models. Please don’t send sensitive data (about your health, for example) to AI features.

5. Other services that process your data

• Polar Software, Inc.: sells the subscription as merchant of record, handles payment, VAT and invoices, and is a separate controller for that.
• Hetzner Online: hosts our servers and database in Falkenstein, Germany.
• Sentry: receives error reports from the website, the apps and the server. When an error happens on the website, the report can include a replay of the page with all text and inputs hidden.
• Expo, Apple and Google: deliver push notifications to the mobile app.
• Resend (Plus Five Five, Inc.): sends the e-mails your account needs (address confirmation, password reset, the reminder before an annual plan renews).
• Zoho Mail: hosts the wiktor@hablalo.io mailbox in its data centres in the EU, so it holds the e-mails you send us and our replies.

We do not sell your data or share it for advertising. We disclose it to others only when the law requires it.

6. Transfers outside the European Economic Area

Our servers are in Germany, but most providers above are based in the United States. For those transfers we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and on the Commission’s Standard Contractual Clauses otherwise. Write to us for a copy of the safeguard that covers a given provider.

7. How long we keep it

We keep your data while your account exists. Deleting the account (Settings, “Delete account”) erases your profile, progress, word lists, chats, the assistant’s memory, private stories and avatar at once. A paid plan that still renews is ended at Polar as part of the deletion, so it stops charging you. Without the app, ask as described on Deleting your account.

A few records stay after deletion with nothing linking them to you: the cost record of your AI requests (without their content), the dictionary entries your lookups created for everyone, and the reports you sent. Our backups hold a copy of the database for up to 30 days, so deleted data leaves them within that time. We keep the record of refused requests with its full address for 90 days; after that we shorten the address so that it shows only the network, not one connection, delete the browser details, and delete the whole record after 180 days. Sentry keeps error reports for up to 90 days. Polar keeps payment records for as long as tax law requires.

8. Your rights

You can ask us for a copy of your data (in a portable format if you like), to correct it, to erase it, to restrict or object to its use, and you can withdraw any consent. Write to wiktor@hablalo.io from your account’s address; we answer within one month. You can also complain to a data protection authority: in Spain the Agencia Española de Protección de Datos (aepd.es), or the authority where you live, such as the UODO in Poland.

9. Decisions made by software

The app chooses your practice, suggests a level after the placement test and grades exercises and writing automatically. None of this has legal or similar effects on you, and you can change your level in Settings at any time.

10. Cookies and storage on your device

• hablalo_access and hablalo_refresh keep you signed in. The service cannot work without them.
• NEXT_LOCALE remembers the interface language and hablalo_tz your time zone, so dates show in your zone. Both end when you close the browser.
• hablalo_practice_direction and hablalo_practice_hints remember two word practice settings: which way a word is asked and whether you see hints. With them the first card is drawn the way you chose from the start. They are set when you change one of those settings and end after a year.
• hablalo_release_seen remembers the version at which you closed the note about changes to the app, so it stays away until the next release. It is set when you close that note or open What’s new, and ends after a year.
• Your browser’s local storage keeps interface settings (the theme, notes you have dismissed), your recent dictionary searches, the answer you have not sent yet in the placement test (what you pick or type before you send it) and, until you confirm it, the address you signed up with. All of it stays on your device; the mobile app keeps that answer, and the notes you have dismissed, in the phone’s storage.

We use no analytics or advertising trackers and store no identifier to follow you. The mobile app keeps an install identifier next to its push token so notifications reach your device. The browser extension keeps its settings and your sign-in in the browser, and sends us the word you select and the sentence around it only when you save or translate that word.

11. Minimum age

Háblalo is for people aged 18 or over. If you believe someone younger has an account, write to us and we will delete it.

12. Changes to this policy

When this policy changes, the date at the top changes with it. We tell you about a change that affects what we do with your data by e-mail or in the app before it applies.

13. Contact

wiktor@hablalo.io, or by post to Wiktor Piotr Pawlikowski, Calle Martínez Maldonado 11, 3A, 29007 Málaga, Spain.