Privacy Policy — Spanish with Pavel

1. Data controller

The data controller is Pavel Dragunov ("we", "us"), contact: SpanishWithPavel@yandex.ru.

Website: https://spanishwithpavel.com.

This Policy explains how we collect and use personal data when you use our language-learning platform. It is intended for users in the UK, Spain, the EU, and other jurisdictions alongside our Russian-language terms where applicable.

2. Data we collect

We process data necessary to provide the educational service:

Account data: email, name, password (hashed by our auth provider).
Profile: language level, learning goal, interface language, active course, daily goal, streak.
Learning progress: chapters, scores, exercises, personal vocabulary.
AI tutor conversations: message content and chat history.
Learning Profile: aggregated skill confidence based on your answers (not raw chat logs for unrelated purposes).
Technical data: session cookies, IP address, browser data — for security and operation. Aggregated Vercel Web Analytics (cookieless) — for page traffic and performance.

3. Purposes

We use your data to:

create and secure your account;
deliver personalised lessons and AI tutoring;
save progress and adapt content;
provide support and improve the service;
comply with legal obligations.

4. Legal basis (UK / EU)

Contract performance (Art. 6(1)(b) GDPR / UK GDPR) — providing the service you signed up for.

Legitimate interests (Art. 6(1)(f)) — security, fraud prevention, service improvement (balanced against your rights).

Consent (Art. 6(1)(a)) — optional marketing communications where applicable.

5. Processors and international transfers

We do not sell personal data. Infrastructure and AI providers may process data on our behalf:

Where data leaves the UK/EEA, we rely on appropriate safeguards (Standard Contractual Clauses or equivalent).

Supabase (database & authentication).
Vercel (application hosting).
AI API providers (Groq, Google Gemini) — only prompt/response text needed for tutoring.

6. Retention

Data is kept while your account is active. After deletion, primary data is removed within 30 days; backups may persist up to 90 days.

7. Your rights

Depending on your location, you may have the right to:

access and receive a copy of your data (Settings → Export data);
rectify inaccurate data;
erase your account (Settings → Delete account);
restrict or object to certain processing;
data portability;
withdraw consent where processing is consent-based;
lodge a complaint with the ICO (UK) or your local supervisory authority.

8. Cookies

We use essential session cookies for login (Supabase session). We do not use advertising cookies.

For visit statistics and page performance we use Vercel Web Analytics and Speed Insights. These services set no cookies and collect only aggregated, anonymised data (page views, device, country, Core Web Vitals). Sensitive URL parameters (tokens, email) are stripped before sending. We do not use advertising or third-party trackers.

9. Children

The service is for users aged 16+. Younger users need parental consent.

10. Changes

We may update this Policy. The current version is always at https://spanishwithpavel.com/privacy.

11. Contact

Controller: Pavel Dragunov

Email: SpanishWithPavel@yandex.ru

Website: https://spanishwithpavel.com