Lingadoo Privacy Policy

1) What we collect and why

a) Account information (you provide this)

• Name and email address when you create an account or sign in with Google.
• Content you create, such as custom questions or vocabulary sets. Your private working copy is not shown to other teachers.
• Messages you send us for support or feedback.

Legal basis: contract (we need this to provide the service).

b) Session and usage data (collected automatically on each login)

• Your IP address is sent to a geolocation service (ip-api.com) to determine your country, timezone, and internet service provider name. The IP address itself is not stored by us.
• Country and timezone are stored to help us understand when and where the service is used.
• Device type, operating system, browser, and screen size.
• Whether you signed in with email or Google.
• Login session start and end times.
• The URL you arrived from and any UTM marketing parameters present in the link you clicked (for example, utm_source). These are only captured once per session and only if present in the URL.

Legal basis: legitimate interests (understanding how the service is used, improving performance, and maintaining security).

c) Game activity data (collected automatically when you run a game)

• Which game was played, the level, vocabulary category, and game mode selected.
• Number of teams configured and number of questions.
• Whether the game was completed, abandoned, or still running, and how long it lasted.
• Whether content came from the Lingadoo library, an academy, or a mix.

Legal basis: legitimate interests (understanding which games and configurations are used to prioritise improvements).

d) Analytics events (collected automatically)

We log named events such as opening the rules, starting a game, completing a game, and viewing certain pages. These are linked to your account and session.

Legal basis: legitimate interests (product analytics).

e) Payment data

If you subscribe to a paid plan, payment details are handled entirely by Stripe. We do not store card numbers or full payment details ourselves. We receive your subscription status and plan type from Stripe.

Legal basis: contract.

2) What we do not collect

• We do not collect data about individual students. Lingadoo is operated by teachers; students participate in games via a shared screen and do not create accounts or submit personal data to us.
• We do not store your precise city or street-level location.
• We do not track you across other websites.
• We do not sell, rent, or share personal data for advertising.

3) Cookies

Session cookie (strictly necessary)

We set one session cookie to keep you logged in while you use the site. This is required for the service to function and does not require your consent. It contains no personally identifying information beyond a session identifier and is deleted when you close your browser or log out.

No tracking or analytics cookies

Lingadoo does not use Google Analytics, advertising cookies, or any other third-party tracking cookies. We do not track you across other websites.

Payment-related cookies

When you use our paid plans, Stripe (our payment processor) may set cookies to process payments securely and detect fraud. We do not control these cookies.

4) Third-party processors

We share data with the following services only to the extent needed to operate Lingadoo:

• Supabase — database and authentication infrastructure. Your account data, session data, and game data are stored in Supabase's managed PostgreSQL database. Supabase Inc. is US-based and operates under standard contractual clauses for GDPR compliance.
• ip-api.com — geolocation. Your IP address is sent to ip-api.com on each login to determine your country, timezone, and ISP name. ip-api.com does not store IP addresses from API requests beyond their processing window. See ip-api.com legal.
• Google — authentication (Google Sign-In). Google may process data in the US. See Google's Privacy Policy.
• Stripe — payment processing for paid subscriptions. Stripe handles all payment card data. See Stripe's Privacy Policy.

We do not use any other third-party analytics, advertising, or tracking services.

5) Data storage and security

Data is stored in Supabase's managed database with row-level security and encrypted connections. We use server-side access controls to restrict who can read analytics data. No system is entirely risk-free, but we take reasonable technical steps to prevent unauthorised access or loss.

7) International transfers

Supabase, Google, and Stripe are US-based services. Transfers are covered by standard contractual clauses or equivalent safeguards under GDPR Article 46.

8) Data retention

We keep account and usage data for as long as your account is active. If you delete your account, we remove your personal data within a reasonable period, except where retention is required by law (for example, billing records). Session and game analytics data that is not linked to an active account is retained in aggregated form only.

9) Your rights

Under GDPR and equivalent laws, you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Lodge a complaint with your national data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD).

To exercise any of these rights, email: info@lingadoo.com.

10) Changes to this policy

We will update this page if our data practices change in a material way. The effective date at the top of this page shows when it was last revised.

11) Contact

For any privacy question or data request: info@lingadoo.com.