Privacy Notice

1. Who We Are and How to Contact Us

This Privacy Notice is provided by Astraion UG with registered address at Romain-Rolland-Straße 47B, 13089 Berlin, Deutschland ("Astraion", "we", "us", or "our"), the data controller responsible for the Conversaide application and website (collectively, the "Service").

If you have any questions about this Notice or how we handle your personal data, please contact us using the details above.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, and password when you create an account
• Profile information: Optional details such as native language, target languages, and level of proficiency
• Payment information: Billing details processed securely by our payment providers (we do not store full card numbers)
• Support communications: Messages you send to our support team

2.2 Information Collected Automatically

• Usage data: Features used, sessions started, lessons completed, practice streaks, and in-app behaviour
• Device information: Device type, operating system, app version, and language settings
• Log data: IP address, access times, and pages or screens viewed
• Conversation data:Text and audio inputs submitted during language practice sessions. This data is processed by Google's AI services on our behalf — and only with your explicit in-app consent — see Section 5.1 for details. We maintain a strict no-training policy regarding this data — see Section 4 for details.

2.3 Third-Party Sign-In

If you sign in using Apple or Google, we receive limited profile information (such as your name and email address) from those providers, as permitted by your privacy settings with them.

3. Legal Bases for Processing Your Personal Data

We are required by the EU GDPR to have a lawful basis for each purpose for which we process your personal data. The table below sets out our processing purposes and the legal basis on which we rely for each.

Legitimate interests: Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You have the right to object to processing carried out on this basis at any time (see Section 7 below).

Consent: Where we rely on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. You may withdraw consent via your account settings or by contacting us at privacy@conversaide.com.

4. How We Use Your Personal Data

We use your personal data to:

• Provide, operate, and maintain the Service
• Personalise your learning experience and track your progress
• Process transactions and send related information (receipts, renewal notices)
• Send you service-related communications, including updates and security alerts
• Respond to your comments, questions, and support requests
• Monitor and analyse usage patterns to improve the Service
• Detect, investigate, and prevent fraudulent or unauthorised activity
• Comply with our legal obligations

We strictly do not use your personal data, including your text and audio conversation data, to train, retrain, or fine-tune our AI models.

5. How We Share Your Personal Data

We do not sell your personal data.

5.1 Service Providers (Data Processors)

We work with trusted third-party companies acting as data processors on our behalf to help us operate the Service, including cloud hosting providers, payment processors, analytics services, and AI infrastructure providers.

AI processing by Google:To generate your tutor's responses, your conversation data — chat messages, voice recordings and their transcripts, and your learning settings (target language and proficiency level) — is transmitted to Google LLC and processed by Google Cloud services: Vertex AI (the Gemini language model) for tutor responses, Cloud Speech-to-Text and Text-to-Speech for voice practice and tongue twister scoring, and Cloud Translation for message translations. This processing takes place on EU-region infrastructure. We never share your name, email address, or contacts with Google.

This transmission happens only after you have given your explicit consent in the app, which you can withdraw at any time in Settings → AI & Data (withdrawing disables AI-powered practice until re-enabled). Google acts as our data processor under the Google Cloud Data Processing Addendum, which contractually requires protections equivalent to this Notice: Google may not retain your conversation data beyond providing the service, may not use it for advertising, and may not use it to train its own models.

We have entered into data processing agreements with each such provider, requiring them to process your personal data only on our documented instructions and in accordance with applicable data protection law. You may request a list of our key processors by contacting us at privacy@conversaide.com.

5.2 Legal Requirements

We may disclose your personal data where required to do so by law, or in response to lawful requests from competent authorities (such as a court order or subpoena), or where necessary to protect the rights, property, or safety of Astraion, our users, or others.

5.3 Business Transfers

If Astraion is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you in advance of any such transfer and of any consequent change to this Privacy Notice.

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area ("EEA"). Where such transfers occur, we ensure that appropriate safeguards are in place to protect your personal data, including:

• Adequacy decisions: Transfers to countries that the European Commission has determined provide an adequate level of data protection.
• Standard Contractual Clauses (SCCs): Where no adequacy decision exists, we rely on the EU Standard Contractual Clauses approved by the European Commission.

You may request further information about the specific safeguards applied to any given transfer by contacting us at privacy@conversaide.com.

7. Your Rights

Under the EU GDPR, you have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request that we correct inaccurate or incomplete personal data without undue delay.
• Right to erasure: Request that we delete your personal data, subject to certain statutory exceptions.
• Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Right to object: Object to processing based on legitimate interests, or to processing for direct marketing purposes.
• Right to restrict processing: Request that we restrict the processing of your personal data in certain circumstances (for example, where you contest its accuracy).
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

How to exercise your rights: Please contact us at privacy@conversaide.com. We will respond without undue delay and in any event within one month of receipt of your request. Where a request is particularly complex or numerous, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it within the first month. We will not charge a fee for handling your request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, providing reasons for doing so.

Right to lodge a complaint: You have the right to lodge a complaint with your national data protection supervisory authority at any time. If you are based in the EU, please contact your local supervisory authority. We would, however, appreciate the opportunity to address your concerns directly before you approach a supervisory authority, and we encourage you to contact us in the first instance.

8. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide the Service. Upon deletion of your account, we will delete or anonymise your personal data within 30 days, except where:

• We are required to retain it to comply with a legal obligation;
• Retention is necessary for the establishment, exercise, or defence of legal claims; or
• Retention is required for another documented legitimate purpose (such as resolving outstanding disputes).

Where data is retained on any of these grounds, it will be kept securely, processed only for that specific purpose, and deleted once that purpose no longer applies.

9. Automated Decision-Making and Profiling

We use automated processing to personalise your learning content and track your progress within the Service. This processing does not produce legal effects or similarly significant effects on you.

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you. If this changes, we will update this Notice accordingly and, where required, obtain your explicit consent.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls
• Regular security reviews and testing

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required by applicable law.

No method of transmission over the internet or electronic storage is entirely secure. We cannot guarantee absolute security, but we are committed to protecting your personal data and will notify you promptly where a breach is likely to affect your rights.

11. Children's Privacy

The Service is not directed to children under the age of 16 (or such lower minimum age as may be permitted in your EU member state of residence pursuant to Article 8 of the GDPR, which must be no lower than 13). We do not knowingly collect personal data from children below the applicable age without the verified consent of a parent or legal guardian. If you believe we have inadvertently collected personal data from a child below the applicable age, please contact us immediately at privacy@conversaide.com and we will take steps to delete such data promptly.

12. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies. We categorise these as follows:

• Strictly necessary cookies: Essential for the website to function correctly. These do not require your consent.
• Analytical/performance cookies: Help us understand how users interact with our website. These are only set with your consent.
• Functional cookies: Enable enhanced functionality and personalisation. These are only set with your consent.

You may manage your preferences at any time via our cookie consent banner or your browser settings. Withdrawing consent for non-essential cookies will not affect your ability to use the core functionality of the Service, though some features of the website may be limited.

12.1 Website Analytics

To understand how our website is used, we use privacy-friendly analytics software that we host ourselves. Your data is not sent to a third-party analytics company and is never sold or shared for advertising.

This analytics does not use cookies and stores no information on your device. It does not track you across websites, devices, or sessions, and it does not build visitor profiles. We collect only aggregated statistics, such as the page visited, the referring site, and general browser, operating system, device type, and country information. This data cannot be used to identify you and is not linked to your account.

Because nothing is stored on or read from your device, this does not require your consent under § 25 TDDDG. It is based on our legitimate interest in understanding and improving the performance of our website (Art. 6(1)(f) GDPR).

13. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or in applicable law. Where changes are material, we will notify you through the app or by email prior to the changes taking effect. The "Last updated" date at the top of this Notice indicates when it was last revised. We will not treat your continued use of the Service as consent to material changes; where required by applicable law, we will seek your explicit consent before any such changes take effect.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Notice or our data practices, please contact us at: privacy@conversaide.com