Flalingo Privacy Policy

At Global Education Technology, C-corp (“Flalingo”) we treat the security and confidentiality of your data as a priority. This Policy explains the conditions under which the personal data we collect when you use our website and services is processed, the legal bases on which we rely, and the rights available to you. It is written to meet the requirements of the EU General Data Protection Regulation (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) and comparable data protection laws in other jurisdictions.

1. Controller and How We Collect Data

Flalingo processes both the data you provide to us directly (account details, profile information, content you share) and data obtained by automated means (system data, cookies, approximate geographic location). This data is collected using server log files and Data Collection Tools (cookies, web beacons) for the purposes of providing our services, improving the user experience and maintaining security.

Flalingo also processes audio, video and text data relating to live lessons in order to personalise the education service you have purchased, and carries out AI-assisted analysis of that data to produce individual performance reports and practice content. Detailed information about these activities is set out in section 4 of this Policy and in the Privacy Notice.

The data collected through cookies and similar technologies, the types of cookies used and their purposes, and how you can manage your preferences are explained in detail in our Cookie Policy.

2. Legal Bases for Processing Personal Data

We process your data on the following legal bases:

• Performance of a contract (GDPR Art. 6(1)(b)): creating your account, enrolling you in courses, managing payment transactions and delivering the education service; teacher matching, generating your post-lesson performance analysis report and producing personalised practice and revision content, each of which forms a defined part of the package purchased.
• Compliance with a legal obligation (GDPR Art. 6(1)(c)): meeting statutory retention obligations and responding to lawful requests from competent authorities.
• Legitimate interests (GDPR Art. 6(1)(f)): improving service quality, preventing fraud and resolving technical problems; measuring educational quality and reviewing teacher performance; and establishing, exercising or defending legal claims. Where we rely on legitimate interests we balance those interests against your rights and freedoms, and you may object to such processing at any time as described in section 8.
• Consent (GDPR Art. 6(1)(a)): marketing communications, third-party advertising, and publishing user review or testimonial videos in which your name, surname and face are clearly visible on our website and social media platforms. Where we rely on consent it is requested separately and you may withdraw it at any time.

3. International Data Transfers

Your personal data may be transferred to our service providers and group companies whose servers are located outside your country, for the purposes of carrying out sales, communication, finance and operational processes, sharing data with teachers based in other countries so that the education service can be delivered, and performing the AI-assisted analysis activities described in section 4 of this Policy.

Where personal data is transferred out of the European Economic Area, the United Kingdom or another jurisdiction that restricts international transfers, we rely on an adequacy decision of the competent authority or, where none applies, on appropriate safeguards within the meaning of Chapter V of the GDPR — in particular the Standard Contractual Clauses adopted by the European Commission and, for the United Kingdom, the International Data Transfer Agreement or Addendum — supported by any additional technical and organisational measures required. You may request a copy of the safeguards we rely on by contacting us using the details in section 1. Flalingo takes the administrative and technical measures necessary to keep your data secure during such transfers.

4. AI-Assisted Analysis and Personalisation

Flalingo uses AI-assisted analysis tools in order to personalise the service:

• Teacher Matching (Smart Matching): the information you provide during registration and level assessment, together with data about your lesson history, is evaluated automatically to generate suitable teacher recommendations. The final choice of teacher is always made by you.
• Post-Lesson Analysis (FLAI Report): the audio and/or video recording of your live lessons and in-lesson text data are analysed automatically to produce an individual report on your language level (by reference to the CEFR), your vocabulary and your grammar performance.
• Personalised Practice (Flomework): the results of the analysis are used to generate practice, revision and reinforcement content tailored to you.
• Speaking Practice with AI (FLAI Speaking): if you use this feature, your voice recordings are processed in order to generate speaking practice feedback and an assessment of your pronunciation and fluency.

These activities are carried out on the basis of performance of a contract, because they form a defined part of the service purchased, and on the basis of our legitimate interests in so far as they serve to measure and improve service quality. In order to carry out these activities, your audio, video and text data may be transferred to AI and language-processing service providers located in other countries, subject to the safeguards described in section 3.

These tools support the service but do not produce decisions about you that are based solely on automated processing and that produce legal effects concerning you or otherwise significantly affect you. You may request information about the results of these analyses, ask us to correct results you consider inaccurate, and object to any assessment carried out solely by automated means where it produces an adverse effect for you.

4a. Optional advertising measurement in Speaking Coach

This section applies only to the Flalingo: AI Speaking Coach app. If you allow advertising measurement, we share selected information with Meta and TikTok to understand which ads lead to app use and subscriptions. Your choice is optional and does not affect app access or your subscription. On iOS, measurement also requires your device tracking permission. Advertising measurement can be enabled only after you confirm that you are at least 18. We record your age band and consent choice with your account on our servers.

The information includes permitted advertising identifiers (IDFA on iOS and the Android advertising ID), the iOS vendor identifier (IDFV), app or SDK installation identifiers, and basic technical information such as IP address, device model, operating system, app version and language. These identifiers can be linked to a device or installation; they are not anonymous.

Selected activities include opening the app, completing a first speaking session and starting checkout. TikTok also receives a trial or paid subscription confirmed by the in-app purchase flow and the subscription plan. Our servers may use subscription records verified by RevenueCat to send permitted trial, initial paid subscription and renewal events, with the plan, amount and currency, to Meta. These events are matched using the permitted Meta SDK identifier. RevenueCat continues to manage subscriptions; our servers control consent for this advertising transfer.

Our advertising integration does not send conversation recordings, transcripts or lesson messages to Meta or TikTok. Our selected advertising event fields do not include your name, email address or phone number. Processing needed to provide speaking practice and manage subscriptions continues separately from this optional advertising measurement.

You can withdraw your choice in Profile under Ad measurement. Turning it off stops further optional advertising events from this device. The server withdrawal request is delivered when your device can connect; it cannot take effect on the server immediately while offline. Once our server records the withdrawal, it stops the associated pending advertising deliveries. This does not automatically delete information already sent to a platform. For deletion requests, use the contact details and rights described in this Policy. An offline withdrawal applies to the permission saved on this device. A newer permission granted on another device may remain active; turn it off there too if needed.

5. Anonymised Learning Data and Datasets

Flalingo uses learning data derived from your live lessons — your CEFR-referenced language level, your vocabulary and grammar metrics, your speaking pace, lesson transcripts and patterns in the mistakes you make (together, “Learning Data”) — in order to improve service quality and to train language and artificial intelligence models.

Before Learning Data is shared with any third party it is stripped of information that could identify you — such as your name, contact details, the organisation you work for and personal references spoken during a lesson — and is aggregated or otherwise anonymised so that it can no longer be linked back to you. Anonymised Learning Data may be used to improve our services and to train and develop language and artificial intelligence models, and may also be compiled into anonymised datasets and research outputs that we licence, share or sell to third parties.

Because such data has been anonymised, it no longer constitutes personal data under the GDPR, and it is treated as deidentified information and not as personal information under the CCPA/CPRA; the rights described in section 8 therefore do not apply to it. Any processing carried out before anonymisation remains subject to this Policy, and we do not attempt to re-identify anonymised data.

This programme is enabled by default. You may opt out at any time through your account settings or by using the contact details in section 1; after you opt out, your data will not be included in any anonymised dataset created from that date onwards. Lessons taken by students under the age of 18 are excluded from this programme entirely.

6. Limitations of Liability

Security commitment and risk statement: Flalingo applies industry-standard security measures, including encryption in transit using current TLS standards, to protect your data against unauthorised access. However, no method of transmission over the internet or of electronic storage can be guaranteed to be 100% secure. Save where liability cannot lawfully be limited, Flalingo is not responsible for third-party cyber attacks occurring during the transmission of your data in the absence of gross negligence on its part.

User responsibility and account security: keeping your account password confidential is your responsibility. Flalingo is not responsible for data breaches resulting from your password being shared with third parties or obtained by unauthorised persons. If you notice anything suspicious in your account, please notify us immediately at info@flalingo.com, together with any supporting evidence.

Third-party links: our services may contain links to third-party websites or applications. Flalingo is not responsible for the privacy practices or the content of those sites, and we recommend that you review their own privacy policies.

Accuracy of data: you undertake that all information you provide to Flalingo is accurate, complete and up to date. You are responsible for legal disputes or service disruptions arising from the provision of incorrect or incomplete information.

Lesson recordings and personalised analysis: audio and/or video recordings of your live lessons are made in order to produce your individual post-lesson analysis report (FLAI Report), to generate personalised practice and revision content (Flomework), to measure educational quality, to review teacher performance and to handle requests and complaints. These recordings are not anonymous; they are processed in association with your account and protected as personal data. Within Flalingo, only authorised personnel (your education consultant and the quality and support teams) may access them. Recordings are retained for 1 year, after which they are deleted or irreversibly anonymised. Where lesson recordings are used for statistical analysis, reporting or model development, the data is anonymised beforehand as described in section 5.

Separately, testimonial videos that you send to us entirely of your own free will and with your explicit consent for marketing and promotional purposes are processed and published on our platforms without anonymisation, with your name, surname and face clearly visible. Where a user who has not reached the age of majority (a child) appears in such a video, we obtain verifiable explicit consent from the holder of parental responsibility (a parent or guardian) before processing or transferring that visual and audio data, and either you or they may withdraw that consent at any time.

7. Retention Periods

Where applicable law prescribes a period for which data must be retained, your personal data is kept for at least that period. Where no such period is prescribed, data is retained for reasonable periods determined so as to be relevant, limited and proportionate to the purposes of processing, after which it is deleted or anonymised.

Lesson recordings are retained for 1 year, and post-lesson analysis reports and personalised content records for 1 year.

8. Your Rights

In relation to your personal data you have the right to:

• be informed whether your personal data is being processed and, if so, to access it and obtain a copy (GDPR Art. 15),
• be informed of the purposes of processing and whether your data is used in accordance with those purposes,
• know the recipients or categories of recipients to whom your data has been disclosed, including any transfers to other countries and the safeguards applied,
• have inaccurate or incomplete personal data rectified (GDPR Art. 16),
• have your personal data erased where the conditions provided by law are met (GDPR Art. 17),
• obtain restriction of processing in the circumstances provided by law (GDPR Art. 18),
• request that any rectification, erasure or restriction be notified to the third parties to whom your data has been disclosed (GDPR Art. 19),
• receive your personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller (data portability, GDPR Art. 20),
• object to processing based on our legitimate interests, and to object at any time to processing for direct marketing purposes (GDPR Art. 21),
• not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or otherwise significantly affects you, and to object to such a decision (GDPR Art. 22),
• withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal (GDPR Art. 7(3)), and
• claim compensation for damage suffered as a result of unlawful processing of your personal data.

Additional rights for California residents

If you are a resident of California, you also have the right to know what personal information we collect, use, disclose and sell or share, and the categories of sources and recipients involved; to request deletion of your personal information; to request correction of inaccurate personal information; to opt out of the sale or sharing of your personal information; to limit our use and disclosure of sensitive personal information to what is necessary to provide the services; and not to be discriminated against for exercising any of these rights. For products other than Speaking Coach, we do not sell or share personal information that identifies you. The optional advertising-data transfers for Speaking Coach are described in section 4a; the anonymised datasets described in section 5 consist of deidentified information, and you may nevertheless opt out of that programme at any time.

How to exercise your rights

You may exercise these rights at any time, free of charge and without having to follow any particular formality. Many preferences can be managed directly from your account settings. Otherwise, please contact us using any of the following channels:

• by e-mail at info@flalingo.com,
• by telephone on +1 401 203 1078, or
• by post at 445 South California Avenue, Palo Alto, CA 94306, USA.

You do not need to use a specific form or particular wording, and we will not refuse a request because of the way in which it was submitted. To help us deal with your request efficiently, it is helpful to tell us which right you wish to exercise and to give enough detail for us to identify the data concerned. We will ask you for additional information only where we have reasonable doubts as to your identity, and we will not request more information than is necessary for that purpose. If you are a California resident, you may also use an authorised agent to submit a request on your behalf; in that case we may ask the agent to provide proof of your authorisation.

We will respond without undue delay and in any event within one (1) month of receipt, or within forty-five (45) days if you are a California resident. Where a request is complex or where you have made a number of requests, we may extend this period as permitted by applicable law and will inform you of the extension and the reasons for it. Requests are handled free of charge; a reasonable fee may be charged, or a request refused, only where it is manifestly unfounded or excessive or where additional copies are requested, to the extent applicable law permits.

If you are not satisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority of your country of residence, place of work or the place of the alleged infringement (GDPR Art. 77), and you may also have the right to seek a judicial remedy.

9. Updates to this Policy

Flalingo reserves the right to update this Policy at any time in order to reflect changes in applicable law or new service processes. Updates take effect on the date they are published on the website. Where a change is material, we will notify you by e-mail, through a notice within the service, or by another means required by applicable law.

This document is also available in other languages; in the event of any conflict between a translation and this English version, this English version shall prevail.