Privacy Policy

This English text is provided for convenience. In case of any discrepancy, the Russian version published on this website prevails.

1. General provisions#

1.1. This Privacy Policy (the “Policy”) describes what data is processed, and for which purposes, when using the langlisto online service — the websites langlisto.com, app.langlisto.com and their subdomains (the “Service”) — as well as users’ rights regarding their personal data.

1.2. The “Operator” is the person who runs the Service and determines the purposes and means of personal data processing in the Service. Contact for personal data matters: support@langlisto.com.

1.3. Personal data is processed in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and other applicable laws of the Russian Federation.

1.4. By using the Service, the user confirms that they have read this Policy.

2. What data is processed#

2.1. Account data provided by the user: email address; name (display name); password (stored only as a cryptographic hash, never in plain text); time zone; native language and language settings; contact details (optional, for teachers); notification and interface settings.

2.2. When signing in with Google: the Google account identifier, email address, and name received from Google with the user’s consent.

2.3. Student data entered by a teacher: the student’s email address on invitation; the student’s name; the teacher’s private notes about the student (visible only to that teacher).

2.4. Learning data arising from the use of the Service: exercise answers and attempt history; homework statuses and results; the personal vocabulary and training statistics; voice recordings made by the student in exercises (for example, pronunciation practice); exercise comments, including attached images and voice messages; class chat messages; the teacher’s interaction history with the automatic material-generation tools.

2.5. Content: files uploaded by users (images, audio, video, teaching materials), including materials of the teacher’s public page.

2.6. Applications from teachers’ public pages: the name, email address, phone number, and message text provided by the person submitting the application. This data is delivered to the teacher the application is addressed to.

2.7. Technical data: IP address; request data (server logs); technical error reports (browser/device type, page address, crash details); cookies and browser local storage data (see the Cookie Policy for details); the advertising campaign tag (utm) the user arrived from before registering.

2.8. Data the Service does not collect: passport or other identity document data; bank card data and payment details (the Service does not accept payments); precise geolocation; special categories of personal data (health, beliefs, etc.) are not requested by the Service.

3. Purposes of processing#

3.1. Data is processed to: provide the Service’s features and perform the terms of service (organizing classes, lessons, assignments, vocabulary, video calls, public pages, applications); communicate with the user (service emails: address confirmation, sign-in links, student sign-in credentials, notifications about learning events); ensure security and prevent abuse (rate limiting, blocking violators, detecting suspicious activity); diagnose and fix errors and improve the Service; measure the effectiveness of advertising campaigns (via depersonalized campaign tags); comply with legal requirements.

3.2. Data is not used to show third-party advertising, is not sold, and is not shared with third parties for their own marketing purposes.

3.3. The user manages email notifications about learning events in the notification settings (including turning email notifications off entirely).

4. Legal bases#

4.1. Processing is based on: the data subject’s consent; the necessity of performing an agreement to which the subject is a party (the Terms of Service); the Operator’s legitimate interests in the operation and security of the Service; legal requirements.

5. Student and minor data#

5.1. A student account may be created by a teacher (the teacher provides the student’s email address). By inviting a student, the teacher confirms that they provide the address lawfully and with the student’s consent — and, for a minor, with the consent of the minor’s parent or other legal representative.

5.2. A teacher has access to their students’ learning data (answers, progress, vocabulary, recordings made within lessons) to the extent necessary to run instruction.

5.3. With respect to student and applicant data that a teacher processes for their own purposes, the teacher acts as an independent personal data controller.

6. Sharing data with third parties#

6.1. To operate specific features, data is shared with infrastructure and technology providers (processors) to the minimum extent necessary:

• hosting, file storage, and CDN — running the Service, storing uploaded files, and delivering them;
• speech synthesis and recognition services (Microsoft Azure Speech) — the text of words and phrases to be voiced, and the user’s voice when using speech-recognition exercises;
• artificial intelligence model providers — the request text necessary to perform the feature: material-generation requests, texts for translation, material contents when generation tools are used;
• Google — when signing in with a Google account;
• an email service — sending service emails to the user’s address;
• an error monitoring service (Sentry) — technical reports about interface failures;
• Telegram (Bot API) — service notifications to the Operator about certain Service events (for example, a new registration or a new application) for operational administration;
• image search services (Pixabay, Giphy) — only the search query text entered by the user when picking illustrations; no personal data is shared.

6.2. Lesson video calls run on the Operator’s own infrastructure; the Service does not record video calls.

6.3. Some providers listed in clause 6.1 are located outside the Russian Federation; in those cases, cross-border data transfer takes place to the extent necessary for the respective feature, in compliance with legal requirements.

6.4. Data may be disclosed upon a lawful request of authorized state bodies.

7. Retention periods#

7.1. Account and learning data is stored while the user uses the Service and is deleted or depersonalized at the user’s request or upon account deletion, except for data whose retention period is established by law.

7.2. Server logs are kept for up to 30 days; database backups for up to 7 days.

7.3. Uploaded files are kept in storage and are accessible via direct unique links; those links are available to the participants the file is shown to in the Service.

8. Data protection#

8.1. Measures include, in particular: encrypted connections (HTTPS); storing passwords only as hashes; role-based access control; rate limiting and abuse protection; backups; restricting the circle of persons with access to data.

9. Your rights#

9.1. The user may: obtain information about the processing of their data; demand that data be corrected, blocked, or deleted; withdraw consent to processing; request account deletion.

9.2. Requests are sent to support@langlisto.com from the email address linked to the account. The Operator responds within the timeframes established by law (as a general rule, within 10 business days, with a possible extension the user is notified about).

9.3. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal and may make further use of the Service impossible.

10. Cookies#

10.1. The use of cookies and browser local storage is described in the Cookie Policy published on the Service’s website.

11. Changes to the Policy#

11.1. The Operator may amend the Policy. A new edition is published on this page with its edition date. The Operator additionally informs about material changes through the Service.

12. Contacts#

12.1. For personal data matters: support@langlisto.com.