Privacy Policy

1. Introduction

Welcome to OnAlbanian! This Privacy Policy explains how OnAlbanian ("we," "us," or "our") collects, uses, shares, and protects your personal data when you use our website (https://onalbanian.com) and any related services, including our mobile application (collectively, the "Service").

We are committed to protecting your privacy and handling your data in an open and transparent manner, in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws, including Apple App Store guidelines.

This policy applies to all users of our Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Data Controller

The data controller responsible for your personal data is:

OnAlbanian
Email: info@onalbanian.com
Website: https://onalbanian.com

3. What Personal Data We Collect and How

We collect information to provide and improve our Service to you. The types of personal data we may collect include:

Information You Provide Directly:

  • Account Information: When you create an account, we collect your email address and a password (stored securely using hashing).
  • Contact Information: If you sign up for our newsletter or contact us, we collect your email address.
  • Language Information: If you log in via Google, we may collect information about your language preference or the language you are learning. Users may also be able to set this information within their profile.
  • User Content: Information you generate while using the Service, such as progress in exercises, flashcards created, or feedback submitted through integrated tools.

Information Collected Automatically:

  • Log and Usage Data: When you access the Service, our servers automatically record information, including your IP address, browser type and settings, device information, operating system, date/time stamps, and interactions with the Service (e.g., pages visited, features used).
  • Cookies and Similar Technologies: We use cookies to operate and administer our site, gather usage data, and improve your experience. The types of cookies we use include:
    • Essential Cookies: Necessary for the website to function (e.g., session management, security like CSRF protection).
    • Preference Cookies: To remember your settings, like cookie consent choices.

Information from Third Parties:

  • Google Login: If you choose to log in using Google, we receive certain profile information from Google, such as your email address and potentially language preference, as permitted by Google's policies and your privacy settings.

4. How We Use Your Personal Data (Purpose and Legal Basis)

We use your personal data for the following purposes, based on specific legal grounds:

  • To Provide and Manage the Service: (Legal Basis: Necessary for the performance of a contract)
    • Creating and managing your user account.
    • Providing access to learning materials, exercises, and features.
    • Tracking your learning progress.
    • Responding to your inquiries and providing customer support.
  • To Improve the Service: (Legal Basis: Legitimate Interests)
    • Analyzing usage patterns to understand how our Service is used and identify areas for improvement.
    • Using language information for statistical analysis (this data is aggregated or anonymized where possible for purely statistical use).
    • Gathering feedback and fixing bugs (see Section 5 regarding Gleap).
  • To Communicate With You: (Legal Basis: Consent, where required; Legitimate Interests for service updates)
    • Sending newsletters and promotional materials (only if you have opted-in/consented).
    • Sending important service-related notices (e.g., security alerts, changes to terms or policies).
  • For Security and Fraud Prevention: (Legal Basis: Legitimate Interests)
    • Protecting the security and integrity of our Service.
    • Preventing fraudulent activity.
  • To Comply with Legal Obligations: (Legal Basis: Legal Obligation)
    • Meeting legal requirements or responding to lawful requests from authorities.

5. Data Sharing and Third Parties

We do not sell your personal data. We may share your data with third-party service providers who help us operate our Service, but only to the extent necessary and under strict confidentiality obligations. These include:

  • Gleap.io: We use Gleap.io for collecting user feedback and bug reporting to help us improve the Service. When you submit feedback, Gleap may collect the information you provide, along with technical details like your browser, operating system, IP address, and potentially a user identifier if you are logged in, and screenshots if enabled. Gleap is committed to GDPR compliance and provides adequate data protection safeguards.
  • Hosting Provider: Our servers are located in Germany, hosted by a provider compliant with GDPR standards.
  • Legal Requirements: We may disclose your data if required by law or in response to valid requests by public authorities.

We ensure that any third party with whom we share your data provides the same or equal protection of user data as stated in this policy and required by GDPR and Apple guidelines.

Payment processing

In-app purchases and subscriptions are processed by Apple (App Store) on iOS and Google (Google Play) on Android. We do not receive or store your payment card details. From these platforms we receive only the transaction identifier, subscription status (active/cancelled/expired), and product purchased. Subscription lifecycle events may also pass through Superwall, our paywall provider, which we use to manage offers and presentations. See Apple's privacy policy at https://www.apple.com/legal/privacy and Google's at https://policies.google.com/privacy.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law.

  • Account Data: We retain your account information and associated usage data for as long as your account remains active. If you delete your account, we will delete this data within a reasonable timeframe (typically 30 days), subject to any legal obligations to retain certain information (e.g., for security logs or financial records).
  • Other Data: Log data, statistical data, and cookie data are retained for a limited period necessary for their purpose (e.g., server logs are typically retained for 90 days for security analysis).

7. Data Security

We take the security of your data seriously and implement appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction. These measures include data encryption (both in transit and at rest where appropriate), access controls, and regular security reviews. Our servers are located in Germany. However, no internet transmission or electronic storage is 100% secure.

8. Your Data Protection Rights (GDPR)

You have the following rights regarding your personal data:

  • Right to Access: You can request copies of your personal data.
  • Right to Rectification: You can request that we correct any inaccurate information or complete incomplete information.
  • Right to Erasure ('Right to be Forgotten'): You can request that we delete your personal data, under certain conditions (including upon request, as required by Apple).
  • Right to Restrict Processing: You can request that we restrict the processing of your personal data, under certain conditions.
  • Right to Object to Processing: You can object to our processing of your personal data where we rely on Legitimate Interests as the legal basis.
  • Right to Data Portability: You can request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
  • Right to Withdraw Consent: If we rely on your consent to process your data (e.g., for newsletters), you have the right to withdraw that consent at any time.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe our processing of your data infringes GDPR.

To exercise any of these rights, please contact us at info@onalbanian.com. We will respond to your request within one month.

9. International Data Transfers

Your information is processed and stored on servers located in Germany (within the European Economic Area - EEA). We do not transfer your personal data outside the EEA.

10. Children's Privacy

Our Service is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without verification of parental consent, we will take steps to remove that information from our servers.

11. Cookies

We use essential and preference cookies as described in Section 3. If we introduce cookies that require consent (e.g., for analytics or marketing), we will provide clear information and obtain your explicit consent beforehand.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. For significant changes, we may also notify you through the Service or via email. We encourage you to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

info@onalbanian.com