Privacy Policy

Introduction

Ulusoy Apps Oy (“we”, “us”, “our”) is committed to protecting your privacy in accordance with GDPR (EU) 2016/679 and applicable laws. This Privacy Policy describes what we collect, why we collect it, how we use and share it, and your rights.

1) Data Controller

2) Legal Bases for Processing

• Contract performance: Providing your account, core learning features (including speaking and writing evaluation), and purchases.
• Legitimate interests: App security, fraud prevention, analytics for product improvement, and performance monitoring. We balance these interests against your rights.
• Legal obligation: Tax/accounting and compliance.
• Consent: Website cookies and any optional marketing communications.

3) Categories of Personal Data We Process

• Identity and contact: Name, email; Firebase UID; social sign-in basic profile (Google/Apple) if used.
• Account and profile: Display name, avatar, preferred learning level and languages, onboarding completion. Stored in Firestore collections such as users and userprofiles.
• Authentication data: Email/password (handled by Firebase Auth), token/credential metadata from Google/Apple to sign you in.
• Purchase metadata: Subscription status and entitlement checks via RevenueCat/App Store/Google Play. We do not process card numbers.
• Technical data: Device/OS, app version, platform; security signals via Firebase App Check.
• Analytics data: Screen views and events via Firebase Analytics; may associate analytics with your Firebase user ID and user properties such as subscription-tier and locale.
• Crash data: Crash/error reports, device model/OS, stack traces via Firebase Crashlytics.
• Audio data (Speaking feature): Short audio recordings captured on your device and sent transiently to Google Vertex AI strictly for evaluation; not stored by us after processing.
• Text content (AI features): Your prompts/text for translation and writing feedback sent to Google services to generate responses.
• In-app web content: If you open external content in a WebView, the external site’s own privacy policy applies.

4) How We Use Your Data

• Create and authenticate your account; manage sessions.
• Provide and personalize learning features across speaking, writing, reading, listening, conjugations, etc.
• Manage subscriptions and entitlements with RevenueCat; verify purchases with Apple/Google.
• Provide speaking evaluation and chat experiences using Vertex AI in the EU region; provide writing feedback and dictionary/translation using Google services.
• Analyze usage and performance (Firebase Analytics) and improve reliability (Firebase Crashlytics).
• Protect the service (Firebase App Check, fraud/abuse prevention).
• Comply with legal obligations.
• Marketing: We do not sell personal data. Promotional messages are sent only with your consent.

5) Data Sharing and Processors

We share data only as needed to operate the app, under appropriate contracts (e.g., DPAs/SCCs):

• Google Firebase: Auth, Firestore (profiles), Analytics, Crashlytics, App Check, and Storage.
• Google Cloud Vertex AI: Processes audio and text content for speaking/chat features.
• Google Translate API: Processes text you choose to translate.
• RevenueCat: Subscription management and entitlement checks.
• Apple App Store & Google Play: Purchase processing and receipts.
• Shorebird: Delivers app updates; no user content uploaded.
• Other infrastructure providers as necessary and under contract.

6) International Transfers

• In-app AI (speaking/chat) is processed in europe-north1 for Vertex AI.
• A scheduled backend function using Vertex AI runs in us-central1 but does not process personal data.
• Firebase Analytics and Crashlytics may process data outside the EU. Appropriate safeguards (e.g., SCCs) are used.

7) Retention

• Account & profile data: Retained while active; deleted upon request or after up to 24 months of inactivity.
• Purchases/entitlements: Retained per store/legal requirements.
• Analytics & crash data: Retained per Firebase defaults.
• Audio (speaking): Not stored after evaluation.
• Logs from scheduled tasks contain no personal data.

8) Cookies and Tracking

Website: Functional/analytical cookies; preferences managed via banner.

Mobile app: No cookies. Uses Firebase Analytics & Crashlytics. No advertising SDKs.

9) Your Rights (GDPR)

• Access, rectification, erasure
• Object or restrict processing (incl. analytics)
• Withdraw consent
• Data portability
• File a complaint with the Finnish DPA

To exercise rights, contact us at: info@ulusoyapps.com

10) Children

Service not intended for children under 13. Contact us for deletion if data was provided.

11) Security

• TLS encryption in transit.
• Firebase App Check.
• Least-privilege access controls and periodic reviews.
• Crash logs limited to diagnostics.

12) How to Manage Your Choices

• Account deletion upon request (removes Firebase Auth account and Firestore profile).
• You may object to analytics; we will stop associating data with your user ID.
• Deny microphone permission to disable speaking features.
• Unsubscribe from marketing emails to withdraw consent.

13) What We Do Not Collect

• Payment card numbers
• Precise location, contacts, photos, health data
• Advertising identifiers for targeted ads

14) Updates

We may update this policy. Updates will be posted in-app and on the website.