Privacy Policy
Lingomir — operated by HomeDea LLC
Version 1.7 · Last updated: October 23, 2026
This Privacy Policy explains how HomeDea LLC ("the Operator", "we", "us") collects, uses, shares, and protects your personal data when you use Lingomir at https://lingomir.com (the "Service"), and the rights you have.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) for users in the EU/EEA, and with other applicable data-protection laws in the regions we serve. Where this policy refers to GDPR rights, we extend equivalent rights to all users regardless of location.
1. Who is the controller
The data controller is:
HomeDea LLC — a limited liability company registered in the State of Wyoming, United States of America Registered address: 30 N Gould St, STE R, Sheridan, WY 82801, USA Registration number: LLC, State of Wyoming, USA · Tax ID: 61-2344206 (EIN) Privacy / data-protection contact: support@lingomir.com General contact: support@lingomir.com
We have not appointed a statutory Data Protection Officer because we are not required to; you can nonetheless reach our data-protection contact at support@lingomir.com for any privacy matter.
2. Data we collect
We collect only what we need to run the Service. We do not use advertising trackers, and we do not sell or share your data with advertisers.
We use two analytics tools, and they are very different from each other:
- Umami, which we host ourselves on our own server. It counts page views and records the referring website and any campaign parameters in the link you followed. It sets no cookies, does not track you across other websites, and stores no data that identifies you personally.
- Microsoft Clarity, a product-analytics service run by Microsoft. It builds heatmaps of where people click and scroll, and records session replays — a reconstruction of your interactions with our pages (mouse movement, clicks, scrolling, and the pages you moved between). Clarity sets cookies and shares this data with Microsoft as an independent recipient. It is configured to mask text you type, and the content of your practice conversations with characters is marked in our code as hidden so it is excluded from recordings. A replay is still data about you. See Sections 4 and 9, and how to opt out.
| Category | Examples | Source |
|---|---|---|
| Account & identity | Email address, hashed password (bcrypt), optional display name; optional date of birth and your answer to «I am 18 or older»; for guests, an anonymous account identifier | You / created for you |
| Learning data | Lessons completed, spaced-repetition (SRS) state, vocabulary progress, quiz/assessment results | Generated by your use |
| Practice-conversation data | Messages you send to AI characters, AI responses, and related grading/translation results | You / generated by your use |
| Gamification data | Experience points (XP), level, rank, streaks, quests, places/achievements, leaderboard standing | Generated by your use |
| Subscription & billing status | Plan, trial status, renewal date, subscription/payment status, top-up balance, and a payment-processor reference. We do not store your full card number | You / payment processor |
| Tax record of a purchase | For each payment and refund: the country of your billing address (the payment page asks for the address), the country of your card or bank and the country of your IP address at purchase, the country they establish, the amount and the VAT inside it. Kept to charge the right VAT, as tax law requires | You / payment processor / derived |
| Web-push subscription | The push endpoint/keys from your browser, if you opt in to notifications | You (opt-in) |
| Product-analytics & session replay | Pages viewed, clicks, scrolling and mouse movement on our pages, approximate location (country/region from IP), device, browser and screen size — collected by Microsoft Clarity | Generated by your use |
| Acquisition attribution | Where your account came from the first time you opened the Service: campaign parameters in the link (utm_*), the referring website's address without its query string, the page you landed on, an advertising-network click identifier if the link carried one, your device type, browser language and country | Derived from your first visit |
| Technical & security data | IP address, device/browser type, timestamps, and server logs used for security, abuse prevention, and debugging | Automatic |
| Support data | Messages you send us and their contents | You |
| Real situations | Photos and texts of letters, SMS, notices and forms you bring to Vesna; a visit's details (where, why, when, city); your message drafts; rehearsals and your chat with Vesna about that situation. Document, card and account numbers (JMBG, passport, card, IBAN) are hidden before storage, and you can paint over parts of a photo before sending | You |
We do not intentionally collect special-category data. Please do not enter sensitive personal information into practice conversations.
3. How and why we use your data, and our lawful bases
| Purpose | Data used | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Create and operate your account; save and sync your progress | Account, learning, gamification data | Contract (Art. 6(1)(b)) |
| Provide AI practice, grading, translation, and text-to-speech | Practice-conversation data, learning data | Contract (Art. 6(1)(b)) |
| Show age-labelled material (strong language, grown-up feed cards) only to people old enough for it, and keep the Service for people aged 16 and over | Date of birth, if you give it, or your answer to «I am 18 or older». It is used for nothing else and never shown to other users | Contract (Art. 6(1)(b)) |
| Process subscriptions, trials, top-ups, renewals, and refunds | Subscription & billing status | Contract (Art. 6(1)(b)); legal obligation for tax/accounting records (Art. 6(1)(c)) |
| Work out and declare the VAT on a purchase (the EU's OSS scheme and other countries' rules), and offer payment only where we may sell | Tax record of a purchase | Legal obligation (Art. 6(1)(c)) |
| Send transactional/service messages (security, billing, important notices) | Account & billing data | Contract (Art. 6(1)(b)) / legitimate interests (Art. 6(1)(f)) |
| Keep the Service secure; prevent fraud and abuse; debug | Technical & security data | Legitimate interests (Art. 6(1)(f)) |
| Improve and develop the Service, understand feature use | Learning & usage data, in aggregated/pseudonymized form where feasible | Legitimate interests (Art. 6(1)(f)) |
| Count visits and see which channel brought you here | Page views, referring site, campaign parameters (Umami — no cookies) | Legitimate interests (Art. 6(1)(f)) |
| Understand how our pages are actually used — heatmaps and session replay | Product-analytics & session-replay data (Microsoft Clarity — uses cookies) | Legitimate interests (Art. 6(1)(f)) — to find what is broken or confusing in the interface. You can switch this off at any time; Section 9 says how |
| Send marketing email (tips, offers, news) | Email, display name | Consent (Art. 6(1)(a)) — opt-in, withdrawable anytime |
| Send web-push notifications | Push subscription | Consent (Art. 6(1)(a)) — opt-in, withdrawable anytime |
Where we rely on legitimate interests, we have weighed those interests against your rights and use the minimum data necessary; you may object as described in Section 8.
4. Processors and who we share data with
We do not sell your personal data. We share it only with service providers ("processors") who process it on our behalf under a data-processing agreement and only on our instructions, and with authorities where legally required.
| Processor | Role | Data shared |
|---|---|---|
| netcup GmbH (Germany, EU) | Cloud hosting and database infrastructure | All data stored by the Service |
| OpenAI | AI provider that generates practice conversations, grading, and translation, reads documents in «Real situation» and searches the web for official information for it | The text you send to AI characters and related learning context; photos and texts you bring to «Real situation» |
| Stripe | Payment processing for subscriptions and top-ups | Billing identifiers, subscription/payment data (card data is handled directly by the processor) |
| Link (Link, LLC, a Stripe company) | Merchant of record for card payments from 22 October 2026: takes the payment, charges and pays the tax, sends receipts, answers about the transaction. For the transaction it acts under its own privacy policy, shown at checkout | Email address, billing address, payment details, what was bought and its price |
| lava.top | One-off payment for Premium: in roubles by Russian bank cards and SBP, in euros by cards of any bank and PayPal (through its providers, Unlimint and PayPal among them) | Email address, the period paid for and its price, a payment identifier (card data is handled directly by lava.top and its payment providers) |
| Our SMTP email delivery provider | Sending transactional and (if opted in) marketing email | Email address, display name, message content |
| Microsoft (Clarity) | Product analytics: heatmaps and session replay | Pages viewed, clicks, scrolling and mouse movement, approximate location from IP, device and browser information |
| Telegram | Internal notifications to our team in a private work group (a new review, a support message, an idea, a payment) | The learner's name or email address and the text of the event (for example a review or a public chat message); no card data |
AI processing — important. When you use practice conversations, AI grading, or translation, the content of your messages and related learning context is sent to our AI provider (currently OpenAI) to generate a response. The AI provider processes this content to return output to you. We instruct our AI provider by contract not to use your content to train its general models except as permitted by our agreement, and we send only what is needed for the feature. Text-to-speech audio is likewise generated from lesson and practice text by our AI provider. Please do not submit sensitive personal data, passwords, or confidential information in AI conversations.
«Real situation». Photos and texts you bring to this feature are sent to the AI provider to read and explain them, to prepare a visit plan and to check your text. To find official information (for example, what a visit to the MUP usually needs) the AI provider searches the web. The query is built from the general meaning of the situation, without your names, numbers or addresses; the sources are shown to you as links. This is help with the language and general steps, not legal, medical or financial advice.
Google user data (Lingomir for teachers). A teacher or school using Lingomir's platform for teachers may connect a Google account. We then receive the data below and use it only for the purpose named:
- Google Calendar, when a teacher connects it:
- the Google account's email address, to show which account is connected;
- the list of the teacher's calendars (names and identifiers), so the teacher can choose the calendar that receives lessons and the calendars that count as busy;
- busy times of the calendars the teacher chose: start and end only, never titles, attendees or descriptions. They keep booking slots closed while the teacher is busy, are held in memory for up to five minutes and are never written to our database;
- the events we create: lessons scheduled in Lingomir are written to the chosen calendar, changed when a lesson moves and removed when it is cancelled. We keep these events' identifiers to keep them in step. We do not read, change or delete any other event.
- Sign in with Google, when an organisation turns on company sign-in: the account's email address, name and Google account identifier, to sign the person in to the organisation's account.
Google's access tokens are stored encrypted (AES-256-GCM) and used only by our server. We do not sell Google user data, use it for advertising, or use it to develop, improve or train AI or machine-learning models. We transfer it to no one except as needed to provide these features, to comply with the law, or as part of a merger or acquisition with notice to you. No person reads it except with the teacher's permission, where needed for security (such as investigating abuse), or to comply with the law.
A teacher can disconnect at any time: in the cabinet, «Schedule» → «Google Calendar» → «Disconnect», or at https://myaccount.google.com/permissions. Disconnecting in Lingomir removes the upcoming lessons we added to the calendar, revokes our access at Google and deletes the stored tokens and event identifiers; deleting the account does the same.
Lingomir's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Lingomir for teachers (beta). Teachers and schools can run their classes on Lingomir. For what happens in a class — students' names and contact details, lessons, attendance, chats, homework, reviews, recordings and transcripts — the teacher or school is the controller and we process the data on its behalf under the Data Processing Agreement, with the sub-processors it lists (calls and transcription); a student can also ask the teacher or school about their data. A lesson is transcribed only with each participant's consent, from the voices of those who agreed (lesson recording); voices are deleted 30 days after the lesson. We are the controller of a teacher's or school's own account and of the platform's records:
- company sign-in: when an organisation turns it on, Google or Microsoft gives us the account's email address, name and identifier, to sign the person in;
- billing details (name, address, country, VAT number) and the invoices of our commission on students' online payments, kept for at least six years after the year they relate to, as tax law requires;
- tax reporting (DAC7): if you sell lessons through Lingomir for teachers and live or are registered in the EU, we collect your name, address, tax number (or place of birth), date of birth or company number and VAT number, and report them with the year's payments to Ireland's Revenue Commissioners, who share them with your country's tax authority. Legal basis: a legal obligation (Article 6(1)(c) GDPR; Directive (EU) 2021/514). Kept encrypted for six years after the year they relate to.
We may also disclose data if required by law, to enforce our Terms, to protect our or others' rights and safety, or in connection with a merger, acquisition, or sale of assets (with continued protection of your data).
The specific processors may change; we will keep this list current and, where required, notify you.
5. International transfers
The controller is established in the United States, and our processors may process data outside the EU/EEA, including in countries that may not provide the same level of data protection. Where we transfer personal data of EU/EEA users internationally, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, an adequacy decision (such as the EU-U.S. Data Privacy Framework where a processor is certified) — and we take additional measures where needed. You can request more information about these safeguards at support@lingomir.com.
6. How long we keep data (retention)
We keep personal data only as long as necessary for the purposes above, then delete or anonymize it. Retention periods below are our current defaults and may be adjusted where operationally or legally justified.
| Category | Retention |
|---|---|
| Account, learning, and gamification data | Until you delete your account (plus a grace period — see Section 8 and Delete Account) |
| Practice-conversation (dialogue) logs | 24 months from creation, then deleted or anonymized (this period is adjustable and may be shortened) |
| Guest accounts | Removed after an extended period of inactivity if not converted |
| Subscription & billing / accounting records | Retained as required by applicable tax and accounting law — generally up to 7–10 years depending on jurisdiction — even after account deletion, then deleted |
| Tax record of a purchase | 10 years from the end of the year of the purchase (EU VAT rules); after account deletion it is kept without any link to you |
| Web-push subscription | Until you disable notifications or delete your account |
| Marketing consent records | Until you withdraw consent, plus a short record of the withdrawal to honour it |
| Technical & security logs | Typically up to 12 months, longer only if needed for a security incident or legal claim |
| Backups | Purged on a rolling cycle, typically within 30 days |
| «Real situation» photos | Until you delete the situation, at most 30 days from upload; after that only the recognised text remains |
| «Real situation» texts, plan and chat | Until you delete the situation («Delete situation») or your account |
| Google Calendar connection (teachers) | Until the teacher disconnects it or deletes the account; busy times are never stored (held in memory for up to five minutes) |
| Lesson voices (Lingomir for teachers) | 30 days after the lesson (7 days for a lesson held in another service); transcripts and reviews as the DPA says |
| Teachers' billing details and invoices of commission | At least 6 years after the year they relate to (tax law) |
| DAC7 tax data of sellers in the EU | 6 years after the year it relates to, encrypted |
When you delete your account, we erase or anonymize your personal data after the grace period, except records we must keep by law (such as billing/accounting records) and residual copies in backups pending their rolling deletion.
7. How we protect your data
We use technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), hashing of passwords (bcrypt), access controls, and contractual safeguards with processors. Card data is handled by our payment processor under its own security standards; we do not store full card numbers. No system is perfectly secure, but we work to protect your data and to notify you and the competent authority of a personal-data breach where the law requires.
8. Your rights
Under the GDPR (and equivalent applicable laws) you have the right to:
- Access — obtain confirmation of and a copy of your personal data;
- Rectification — correct inaccurate or incomplete data;
- Erasure ("right to be forgotten") — have your data deleted, subject to legal retention;
- Restriction — restrict processing in certain cases;
- Portability — receive certain data in a structured, machine-readable format and, where feasible, have it transmitted to another controller;
- Objection — object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent — withdraw consent (marketing, push) at any time, without affecting processing already carried out;
- Not be subject to solely automated decisions producing legal or similarly significant effects — we do not make such decisions about you.
How to exercise your rights:
- Marketing / push consent: turn off in your profile settings or use the unsubscribe link in any marketing email.
- Account deletion / erasure: use in-app account deletion (when available), the web request path at https://lingomir.com/legal/delete-account (see Delete Account), or email support@lingomir.com.
- Any other right (access, rectification, portability, objection, restriction): email support@lingomir.com or support@lingomir.com.
We respond within the legal time limit (generally one month, extendable for complex requests). We may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
Complaints. You have the right to lodge a complaint with a supervisory authority. If you are in the EU/EEA, you may complain to your local Data Protection Authority; residents of other regions may contact the data-protection or consumer-protection authority competent for their place of residence. We would appreciate the chance to address your concern first at support@lingomir.com.
9. Cookies and local storage
Essential storage. We store your authentication token, basic session/preference data, and the acquisition attribution described in Section 2 in your browser's local storage so you can stay signed in and the app can function. This is essential to provide the Service you request and does not require consent.
Analytics storage. We do not use advertising cookies and we run no cross-site advertising trackers. Our own analytics tool (Umami, self-hosted) is cookie-free. However, Microsoft Clarity sets cookies on your device in order to recognise a returning session and to link the pages of one visit into a single replay.
Your choice. Clarity is non-essential. You can switch it off at any time, and doing so costs you nothing in the Service:
- Use Microsoft's opt-out page at https://clarity.microsoft.com/optout, which applies across every site that uses Clarity; or
- Block third-party scripts, or clear cookies for this site, in your browser settings — most ad- and tracker-blocking extensions already block Clarity.
We do not use Clarity data to make any decision about you as an individual, to profile you, or to advertise to you. If we ever introduce advertising cookies or any cross-site tracking, we will update this policy and ask for your consent first.
You can clear local storage in your browser at any time; doing so will sign you out and may reset guest progress that is not linked to a registered account.
10. Children
The Service is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us personal data, contact support@lingomir.com and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and/or in-app and update the "Last updated" date above. Your continued use of the Service after the changes take effect constitutes acceptance, except where consent is required.
12. Contact
Privacy / data-protection contact: support@lingomir.com General contact: support@lingomir.com · Support: support@lingomir.com Operator: HomeDea LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA
See also our Contact page.
Related documents: Terms of Service · Privacy Policy · Refund & Cancellation Policy · FAQ · Contact · Delete Account