Privacy Policy

Introduction

Français Flow is operated by Klaudia Kromołowska ("we", "us", "our"). We are committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data when you use our French learning platform, in accordance with the General Data Protection Regulation (GDPR).

Data Controller

The controller of your personal data is Klaudia Kromołowska, with correspondence address at ul. Warszawska 111, 42-200 Częstochowa, Poland. Tax ID (NIP): 6793269779. Contact: salut@francaisflow.com. As the controller, we determine the purposes and means of processing your personal data.

Data We Collect

We collect: your email address and display name when you create an account; your learning progress, exercise results and spaced-repetition state; your preferences (language, theme, learning goals); recordings of your spoken answers if you use the DELF speaking exercises; payment data processed by Lemon Squeezy, our merchant of record (we never store card details); records of how you practise, read and listen and of how your exam simulations go, linked to your account (see “Practice behaviour data” below); and aggregated, anonymised usage analytics to improve the platform.

Legal Basis for Processing

We process your data on the following bases under GDPR Article 6: (a) Contract performance (Art. 6(1)(b)) — account data, learning progress, and subscription management are necessary to deliver the service you signed up for; (b) Legal obligation (Art. 6(1)(c)) — billing and transaction records are retained to comply with Polish accounting law (5-year statutory requirement); (c) Consent (Art. 6(1)(a)) — if you opt in to marketing communications, your email is processed for that purpose; consent may be withdrawn at any time without affecting the lawfulness of prior processing; (d) Legitimate interest (Art. 6(1)(f)) — records of how you practise, read and listen (answer timing, the starts and ends of practice rounds, exam sections and exam simulations, typed or selected answers, time spent with a text and the words you looked up in it, device and input type) are processed to improve the learning method; see “Practice behaviour data” below, including your right to object and the Settings toggle.

How We Use Your Data

Your data is used to: provide personalised learning experiences through spaced repetition; track your progress and generate statistics; process subscription payments; improve our platform and content; and send account-related transactional notifications. Marketing communications are sent only with your explicit, separate consent.

Practice behaviour data

When you practise, we record how you practise, not only what you answered: how long each answer took and when a card was revealed, when a practice round started and how it ended (finished, quit, tab closed or left idle), the answers you typed or selected, whether you used a hint or replayed audio, when the practice tab was in the background, your device type (touch or mouse) and screen size, the time of day and timezone of each session, the number of days since your previous session, a snapshot of your practice settings, and where you arrived from (entry source or referring page). These records are linked to your account and are kept only in our own database (Supabase, EU region); they are never shared with third parties or used for advertising. We use them to improve the learning method, for example to find the point at which learners give up and to tune review scheduling. The legal basis is our legitimate interest in improving the service (GDPR Art. 6(1)(f)). Raw records are deleted 18 months after they were recorded. You may object to this processing at any time (GDPR Art. 21). The simplest way is in Settings, under “Practice data”, by turning off the “Collect my practice data” switch: turning it off immediately and irreversibly deletes every practice behaviour record collected so far for your account (including the records described in the next paragraph) and stops collection, while your progress, results and review schedule are left untouched; turning it back on resumes collection from that moment. You may also object by e-mail to salut@francaisflow.com — we will then do the same for you. We do not claim overriding grounds for this processing: an objection is always honoured.

We also record how you use texts and exam simulations. When you read an article in the reading module or listen to a dialogue or a dictation sentence in the listening module, we record: which text you opened (its identifier and CEFR level), how long it was visible on screen (counted only while the browser tab is in the foreground), how many times you started the audio, which words of the text you looked up in the translation tooltip (the words themselves, not their translations), how many times you translated a selected passage (without the selected text), the list of words that make up the text (so that we can later check which of them turned up in your reviews), and, for a dialogue or a dictation, the quiz score or the verdict on your transcription (perfect / close / wrong) and whether the transcript was revealed. In DELF exam preparation (listening and reading comprehension, timed sections and full exam simulations) we record: when a round, section or simulation started and ended and how it ended (finished, time expired, quit with the button, page left or tab closed), the level and type of section, which documents were shown and for how long, the number of the option chosen in multiple-choice questions and the time from the document being shown to the choice, answer changes, audio replays, and the number of answered and correct answers in each document. These events never contain your recordings or their transcripts, written texts, notes taken while listening, the text of the answer options or AI-generated feedback; for the writing and speaking sections we record only the start, end and duration of the section. These records are subject to the same rules as the other practice behaviour data: the same purpose, the same legal basis, the same database in the EU region, 18 months of retention, no external recipients and the same objection switch in Settings.

Third-Party Processors

We share data with the following processors, each bound by a Data Processing Agreement: Supabase Inc. (USA; our data hosted in the EU region — Ireland) — database and authentication infrastructure; Vercel Inc. (USA) — application hosting and content delivery (IP address, request metadata, logs); Lemon Squeezy, LLC (USA) — our merchant of record for payments, invoicing, and subscription management (acts as an independent controller for transaction data); Amazon Web Services (EU region — Frankfurt) — transcription of your spoken answers (Amazon Transcribe) and speech synthesis (Amazon Polly) in the DELF speaking module; Google LLC (USA) — AI-powered content generation, including word enrichment, card suggestions and the AI chat (Gemini / Vertex AI API), scoring of your spoken DELF answers, speech synthesis (Cloud Text-to-Speech) and translations; Sentry / Functional Software Inc. (USA; processing in the EU region) — error tracking; PostHog, Inc. (USA; data hosted in the EU) — product analytics, loaded only after you accept analytics cookies; Mixpanel, Inc. (USA) — product analytics, loaded only after you accept analytics cookies; Grafana Labs (EU region) — application logs; Resend, Inc. (USA) — delivery of transactional emails; Pexels (Germany, part of Canva) — stock image search for card illustrations; Forvo Media, S.L. (Spain) — pronunciation audio; GitHub, Inc. (USA) — storage of weekly database backups. We do not sell your data to any third party.

International Data Transfers

Some processors are based outside the European Economic Area (EEA), specifically in the United States. These transfers rely on one of two bases: a European Commission adequacy decision under the EU–US Data Privacy Framework (GDPR Article 45), where the provider is certified under that programme, or Standard Contractual Clauses approved by the European Commission (GDPR Article 46(2)(c)). Wherever possible we choose EU-region processing: our database, application logs, error monitoring, PostHog analytics and speech processing all run in European regions.

Data Storage & Security

Your data is stored on Supabase (PostgreSQL) with row-level security policies. All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is restricted to authorised personnel only.

Data Retention

We retain your data as follows: account and learning data — kept for the lifetime of your account and deleted within 30 days of an account deletion request (database backups, which we keep for 30 days, expire within the same period); billing and transaction records — retained for the period required by tax law, that is until the tax liability becomes time-barred, which happens 5 years from the end of the calendar year in which the payment deadline fell (Article 86 § 1 in conjunction with Article 70 § 1 of the Polish Tax Ordinance); speech recordings — held in a private bucket accessible only to you, until you delete them yourself or delete your account; practice behaviour records — deleted 18 months after they were recorded, or immediately when you turn off their collection in Settings; server and error logs — retained for a limited period in accordance with our logging provider’s retention policy, then automatically deleted; marketing consent records — retained until you withdraw consent or request deletion. Deleting your account also erases your recordings and uploaded images.

Cookies & Tracking

We use only essential cookies (authentication session, invite gate, demo mode) and functional cookies that you control (interface language, theme). We also use PostHog and Mixpanel for product analytics — both set cookies and collect usage data, including your account identifier, so under our strict consent settings they load only after you accept analytics cookies. If you choose ‘Essential only’, all non-essential scripts (analytics and browser error monitoring) stay switched off. You can change or withdraw your choice at any time via Cookie settings (below or in the footer), or through your browser.

Analytics and error monitoring load only after you accept. To review, change, or withdraw your choice: Cookie settings

Artificial intelligence

Some features of the platform use artificial intelligence: the AI assistant chat, card enrichment, translation and example suggestions, homework generation in the class module, and synthetic voice recordings. If you use the speaking exercises, your recording is sent to an AI system (Google Gemini) for scoring and to Amazon Transcribe for transcription. We always tell you when you are interacting with an AI system. Machine-generated content may contain errors — treat it as study material, not as an authoritative source. We analyse your progress automatically in order to schedule your reviews, but we do not make automated decisions about you that produce legal effects or similarly significantly affect you within the meaning of GDPR Article 22. Your answers in exercises and in class assessments are graded by a deterministic algorithm comparing your answer against a key — not by an AI system.

Your Rights

Under GDPR you have the right to: access your personal data (Art. 15); correct inaccurate data (Art. 16); request deletion of your data (Art. 17); restrict processing (Art. 18); receive your data in a portable format (Art. 20); object to processing based on legitimate interests (Art. 21) — for practice behaviour records also with a single switch in Settings; withdraw consent for marketing at any time. To exercise these rights, visit the Settings page or contact us at salut@francaisflow.com.

Right to Lodge a Complaint

If you believe we are processing your personal data in violation of GDPR, you have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl.

Contact

For privacy-related questions or to exercise your rights, contact us at: salut@francaisflow.com. We respond without undue delay and in any event within one month of receiving your request. For particularly complex requests we may extend that period by a further two months — we will tell you within the first month, together with the reason (GDPR Article 12(3)).