Privacy Policy
October 6, 2026
1. Overview
Lingo180.com is an online language-learning service. This policy explains what personal data we process when you use it, and why. We collect only what we need to run your account.
2. Information we collect
• Account: email address, display name (nickname), password (stored only as a hash by Firebase Authentication — we never see it), chosen avatar and interface language • Learning: course and stage, vocabulary review history, quiz and test results, wrong-answer notes, study streaks, XP and game records • Plan: which plan you are on, its status and the date the paid period ends • Devices and sign-in: the browser details (user agent) of signed-in devices, sign-in times and recent sign-in history — used to apply the device limit and to protect your account • Support: your messages, their dates and our replies
3. Teacher classes and student information
When a teacher invites a student to a class, the student's email address and the name the teacher gives them on the roster are stored with the class. The teacher of the class, and any co-teacher, can see the learning progress and the homework and test results of the students in it. Students agree to this when they join a class.
4. Challenging a friend
When a member invites a friend who has no account to a game, we send the invitation and the result to the friend's email address. The friend's email address, the nickname they enter and their score are used only to run the invitation and report the result. Invitation links expire after 7 days.
5. Why we use your data
To provide your account and the learning service, save your progress, run teacher classes, manage plans through our payment provider, answer support requests, apply the device limit, prevent misuse and improve the service.
6. Legal basis (EU and UK users)
Performance of a contract (Art. 6(1)(b) GDPR) for the account, plans and support; legitimate interests (Art. 6(1)(f) GDPR) for security, misuse prevention and improving the service; legal obligations (Art. 6(1)(c) GDPR) for accounting and tax records.
7. Service providers we use
• Firebase Authentication, Firestore, Hosting and Cloud Run (Google) — sign-in, data storage and delivery of the service • Google Cloud Text-to-Speech — learning audio (no personal data is sent) • Zoho Mail — invitations, notices and support emails • Sentry — error detection and diagnostics • Paddle — our payment provider and merchant of record. Paddle collects and processes payment data; we never receive or store card details. Each provider processes data under its own privacy policy.
8. Payments and merchant of record
Paid plans are sold on the web through Paddle, which acts as merchant of record. Paddle handles payment, invoicing and applicable VAT and is the controller for the payment data it collects. We keep only what we need to link your account to your plan and to support you.
9. Data retention
Account data and learning records are kept while your account exists and deleted when you delete it. Records we must keep by law are kept for the required period; billing records are kept by Paddle for statutory periods. Friend-invitation records are removed after the link has expired.
10. Children
Children under 13 may use the service only under the supervision of a parent or a teacher. We do not knowingly collect personal data directly from children under 13, and we delete it when we find it.
11. Your rights
You may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. EU and UK users may also lodge a complaint with a supervisory authority. You can delete your account and all its data with "Delete account" on the account page.
12. International processing
Our providers may process data outside your country. Where that happens, transfers rely on the safeguards those providers offer, including EU Standard Contractual Clauses. Our operator is established in South Korea (Republic of Korea) and may process personal data there; transfers of EU and UK users' data rely on the adequacy decisions for the Republic of Korea and, where needed, Standard Contractual Clauses.
13. Security
Access rules let each user reach only their own data, and every connection is encrypted with HTTPS.
14. Data controller
A Company operates Lingo180.com and is the controller for the personal data described in this policy. Operator details are set out in the Legal Notice. Registered business address: Seongbuk-gu, Seoul, South Korea — full address in the Legal Notice. Email: support@lingo180.com
15. Changes to this policy
We announce material changes in the service or by email before they take effect.
Lingo180.com
Effective: October 6, 2026
lingo180.com