Privacy Policy (GDPR)

This translation is provided for your convenience; in the event of a discrepancy, the French version prevails (publisher established in France, applicable French and European law).

PRIVACY POLICY (GDPR) 1. DATA CONTROLLER PROSELLER23 — Arabico, Hubert Wojtkielewicz, sole trader (micro-entrepreneur). Email: [email protected]. Full details appear in article 16. With fewer than 250 employees and no large-scale processing of sensitive data, appointing a Data Protection Officer is not mandatory (GDPR art. 37). Send data requests to that email. 2. PERSONAL DATA COLLECTED 2.1 Registration: first name, email and password stored using cryptographic hashing; Google/Apple sign-in supplies your email and account identifier. 2.2 Learning and use: words learned, scores, lessons completed, study time and sessions, quiz/exercise results, word lists (favourites, difficult words), videos watched, badges, rewards and gems earned/spent. 2.3 Gamification: XP, level, daily streak, league position, reward chests and daily goal. Your first name or username is visible to other users in rankings and weekly leagues. You may object (article 7). 2.4 Subscription: active/inactive status, Pro/Pro Accompagné plan, expiry, free-trial and family-sharing status. We do NOT store card numbers. Apple/Google handle all payments and are PCI-DSS certified. 2.5 Technical: device, OS/version, app version; hosting providers process IP addresses to provide the service; the publisher does not store them. 2.6 Notifications: APNs/FCM push token and platform (iOS, Android, web). 2.7 Preferences: app language (French/English), daily learning goal and declared Arabic level. 3. LEGAL BASES Contract performance (GDPR 6.1.b): account/authentication, progress, spaced repetition, subscriptions/payments and gems. Legitimate interest (6.1.f): weekly rankings/leagues, motivation, app improvements and bug fixes; you may object at any time. Consent (6.1.a): push notifications, revocable in app/device settings. Legal obligation (6.1.c): billing records for tax/accounting purposes. 4. RECIPIENTS Processors receive data strictly to provide the service: • Supabase Inc.: hosting, database, authentication; EU (Dublin, Ireland, eu-west-1); signed DPA and Standard Contractual Clauses (SCCs). • RevenueCat Inc.: iOS/Android in-app purchases; US; EU-US Data Privacy Framework. • Vercel Inc.: web hosting; US/EU; that Framework. • Cloudflare, Inc.: audio/video/PDF distribution via R2/Workers, global network including EU; Framework and DPA. • Resend Inc.: transactional emails; EU (Ireland); signed DPA. • Apple Inc.: Sign in with Apple and iOS purchases; US; Framework. • Google LLC: Google Sign-In, Android purchases and FCM; US; Framework. We do not sell, rent or share personal data for advertising/marketing. The app integrates no advertising tracking, behavioural analytics or fingerprinting. 5. TRANSFERS OUTSIDE THE EU US processors (RevenueCat, Vercel, Apple, Google) are covered by the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023), GDPR-compliant SCCs and signed DPAs with each processor. If the Framework is invalidated, we undertake to implement additional safeguards recommended by the EDPB. 6. RETENTION Account/progress: throughout registration, then 3 years after last login (civil limitation period). Billing: 10 years under French Commercial Code L123-22. Push tokens: until consent withdrawal or account deletion. Technical data: at most 12 months. Thereafter data are deleted or irreversibly anonymised. 7. YOUR RIGHTS GDPR articles 15–22: access and copy (15), rectification (16), erasure (17), restriction in certain cases (18), portability in a structured commonly used machine-readable format, JSON/CSV (20), objection to legitimate-interest processing including leagues/public username (21), and withdrawal of consent at any time without affecting previous lawful processing (7). Contact [email protected]. We reply within 30 days; complex requests may require two additional months, with notice. 8. COMPLAINT TO THE CNIL You may complain if processing breaches the rules: https://www.cnil.fr — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. 9. AUTOMATED DECISIONS AND PROFILING Spaced repetition adjusts word review frequency to your performance; leagues rank users by weekly XP. Neither has legal or similarly significant effects under GDPR article 22. To object, contact [email protected]. 10. COOKIES AND LOCAL STORAGE No advertising cookies or third-party trackers. Technical localStorage keeps language (French/English), notification status and login session. It is strictly necessary and exempt from prior consent under the CNIL exemption and article 82 of the French Data Protection Act. 11. SECURITY GDPR article 32 measures: HTTPS/TLS, secure OAuth 2.0/hashed passwords, per-user Row Level Security, server-side API keys and payment webhook signature checks. 12. DATA BREACHES For a personal data breach likely to create a high risk, we undertake to notify the CNIL within 72 hours (GDPR 33) and inform you promptly by email/notification (34). 13. PUSH NOTIFICATIONS With prior consent: morning daily-goal reminders, evening streak reminders and ranking alerts when a competitor overtakes you. APNs/FCM delivery depends on your device. Disable them at any time in app/device settings. 14. MINORS Intended for ages 15 and over. Under article 45 of French Law no. 2018-493 of 20 June 2018, under-15 data-processing consent must be given jointly by the child and a holder of parental responsibility. We do not knowingly collect under-15 data without parental consent and will promptly delete accounts registered without it. 15. CHANGES Substantial changes are notified by email/in-app at least 15 days before taking effect. The update date appears above. 16. CONTACT AND LEGAL DETAILS Questions/rights: PROSELLER23 — Arabico; Hubert Wojtkielewicz, sole trader (micro-entrepreneur); SIRET 89787782500017. VAT not applicable, French General Tax Code article 293 B. 26 Rue Arsène Bouget, 95150 Taverny, France. [email protected]; +33 7 45 21 88 11.