Legal
Privacy Policy
Last updated: 5 May 2026
1. Who we are
LinguaOS is operated by Raeolas.AI (sole trader, Pobiedziska, Wielkopolskie, Poland). We are the data controller for the personal data of teachers and school administrators who use our platform. Teachers act as independent data processors with respect to their students' personal data.
Contact: [email protected]
2. What data we collect
For teachers and school administrators:
- Name and email address (used for account creation and communication)
- Payment details (processed by Stripe — we never store raw card data)
- Subscription plan and billing history
- Usage data: sessions started, lessons booked, AI requests made
- Google account OAuth token (only if you connect Google Calendar)
For students (entered by their teacher):
- Name, age, and native language
- English level (CEFR), learning motivation, target exam
- Interests and learning notes entered by the teacher
- Practice session transcripts and AI-generated feedback
- Assignment submissions and scores
3. Why we process your data
| Purpose | Legal basis |
|---|---|
| Providing the LinguaOS platform | Performance of contract (Art. 6(1)(b) GDPR) |
| Processing subscription payments | Performance of contract (Art. 6(1)(b) GDPR) |
| Generating AI lesson plans and feedback | Performance of contract (Art. 6(1)(b) GDPR) |
| Sending lesson reminders and notifications | Legitimate interest (Art. 6(1)(f) GDPR) |
| Improving platform performance and fixing bugs | Legitimate interest (Art. 6(1)(f) GDPR) |
| Responding to support requests | Legitimate interest (Art. 6(1)(f) GDPR) |
| Legal compliance | Legal obligation (Art. 6(1)(c) GDPR) |
4. Where your data is stored
All data is stored on servers located within the European Union. We use Supabase (with EU-region hosting) as our primary database. We do not transfer personal data outside the EEA without appropriate safeguards.
5. Third-party sub-processors
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU |
| Anthropic | AI content generation (Claude) | USA (SCCs apply) |
| Stripe | Payment processing | USA (SCCs apply) |
| Resend | Transactional email delivery | USA (SCCs apply) |
| Twilio | SMS and WhatsApp notifications | USA (SCCs apply) |
| Google (optional) | Calendar sync — only if you connect Google Calendar | USA (SCCs apply) |
SCCs = Standard Contractual Clauses approved by the European Commission.
6. Google API Services — User Data Policy
LinguaOS's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data Accessed
When a teacher voluntarily connects their Google account, LinguaOS requests the following OAuth 2.0 scopes:
https://www.googleapis.com/auth/calendar.events— create, update, and delete events on the teacher's primary Google Calendarhttps://www.googleapis.com/auth/calendar.readonly— read calendar metadata needed for sync
We do not access any other Google user data (Gmail, Drive, Contacts, etc.).
Data Usage
Google Calendar data is used exclusively to automatically create, update, and delete lesson events on the teacher's calendar when lessons are booked, rescheduled, or cancelled inside LinguaOS. We do not use this data to serve advertisements, train AI/ML models, or for any purpose other than providing the calendar sync feature.
Data Sharing
Google user data is never sold, shared, or transferred to any third party. It is used solely server-side to communicate with the Google Calendar API on the teacher's behalf.
Data Storage & Protection
Only the OAuth refresh token is stored, in our Supabase database hosted within the EU, encrypted at rest. Access tokens are obtained transiently per request and are never written to disk or logs.
Data Retention & Deletion
The refresh token is deleted immediately when a teacher disconnects Google Calendar from their Settings page, or when their LinguaOS account is deleted. To revoke access independently, visit myaccount.google.com/permissions and remove LinguaOS. To request deletion of all associated data, email [email protected].
7. How long we keep your data
- Account data: As long as your account is active, plus 30 days after deletion (for recovery purposes).
- Billing records: 5 years (required by Polish and EU accounting law).
- Session transcripts and AI feedback: Stored indefinitely unless you delete the student profile or your account.
- Notification logs: 90 days.
8. Your rights under GDPR
If you are an EEA resident, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict or object to certain processing
- Data portability — receive your data in a machine-readable format
- Withdraw consent at any time (where processing is based on consent)
- Lodge a complaint with the Polish supervisory authority (UODO: uodo.gov.pl)
To exercise any of these rights, email us at [email protected]. We will respond within 30 days.
9. Data entered by teachers about students
Teachers are responsible for ensuring they have the appropriate legal basis (e.g., parental consent for minors, or consent of the student) to enter student data into LinguaOS. Raeolas.AI processes this data solely on behalf of the teacher. If a student or parent wishes to access, correct, or delete data, they should contact their teacher directly.
10. Cookies
We use only essential cookies required for the platform to function (session authentication). We do not use tracking or advertising cookies. See our Cookie Notice for details.
11. Changes to this policy
We may update this policy from time to time. If we make significant changes, we will notify you by email and display a notice in the app at least 14 days before the changes take effect.
12. Contact us
For any privacy questions or to exercise your rights: