This Privacy Policy explains how LingoSnips (“we”, “our”, or “us”) collects, uses, and protects your personal information when you use our Service. We are committed to protecting your privacy and handling your data in an open and transparent manner.
1. Who We Are (Data Controller)
LingoSnips operates an AI-powered Spanish listening app — a daily feed of short Spanish news briefs, short stories, and bedtime stories, generated as text and read aloud as audio. LingoSnips (operated at lingosnips.com) is a trade name (“doing business as” / DBA) wholly owned and operated by Aplauso Inc, a company based in the United States, and we store and process your data primarily in the United States.
For the purposes of the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and similar laws, Aplauso Inc (operating as LingoSnips) is the data controller of the personal data described in this policy. For any privacy questions, or to exercise your rights, contact us at [email protected].
2. Data We Collect
2.1 Information you provide
Account data: email address, password (stored as a hashed credential via Supabase Auth), and optional display name.
Profile data: your chosen CEFR level, Spanish variety (Peninsular or Latin American), interface language, learning interests, and preferred read-aloud speech pace.
2.2 Data generated during use
Listening activity: which news briefs, stories, and bedtime stories you open or play, your place in the feed, and similar progress data — used to power and personalise your listening experience.
Usage data: the volume and timing of content you listen to and other service usage, used for billing, plan enforcement, and capacity planning.
First-party analytics: we record our own usage events — pages viewed, buttons and links clicked, how far into a clip you listen, the interface language a page was shown in, your device type (mobile or desktop), an approximate region (the country we infer from your browser's time-zone setting — never from your IP address), and where a visit started (entry page, referring site, campaign tags, and any affiliate code). These events are stored in our own database and are not shared with any third-party analytics provider. We attach a first-party visitor and session identifier (see Cookies, below) so we can understand how the Service is used and improve it; for signed-in users these events are linked to your account so we can make your experience more relevant.
Support and feedback: messages, feedback, and reported issues you send us.
The Spanish content itself (news, stories, bedtime) is generated by us and is the same for all learners at a given level and variety — it is not built from your personal information. LingoSnips has : we do not capture or store any audio of you.
no microphone, no voice recording, and no speech recognition
2.3 Technical data
Log data: server-side structured logs including request identifiers, timestamps, and error codes.
Error monitoring: we use Sentry to capture diagnostic error reports. It is configured conservatively — no Session Replay and no intentional collection of personal data.
Cookies: a session cookie set by Supabase Auth to keep you logged in, a cookie-consent preference cookie, a small cookie that remembers your chosen interface language and Spanish variety, and first-party analytics cookies — a long-lived visitor identifier and a short-lived session identifier — that we set ourselves to measure how the Service is used. We do not use advertising cookies, and we never store your raw IP address with these events. For a coarse, country-level sense of where our visitors are, we infer an approximate country from your browser's time-zone setting rather than from your IP address or any precise location data.
Payment data: billing and transaction records managed by Stripe. We do not store your card details; Stripe does.
3. How We Use Your Data
To provide the Service: authenticate you, deliver the generated text and read-aloud audio, and remember your listening progress.
To personalise your listening: use your level, Spanish variety, interface language, and interests to choose which content and voice you hear.
To manage your subscription: apply your plan, enforce plan limits, and process payments.
To operate and improve the Service: monitor performance, diagnose errors, and develop new features using our own first-party analytics (Section 2.2). We do not share this usage data with third-party analytics providers.
To communicate with you: send transactional emails (email verification, billing receipts, important service notices). We do not send marketing emails without your consent.
To comply with legal obligations: retain records as required by applicable law.
4. Legal Bases for Processing (EEA & UK)
If you are in the European Economic Area (“EEA”), the United Kingdom, or another jurisdiction with comparable law, we rely on the following legal bases to process your personal data:
Performance of a contract (GDPR Art. 6(1)(b)) — to create and operate your account and provide the listening service you sign up for.
Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse, debug errors, and understand aggregate usage so we can improve the product. We balance these interests against your rights.
Consent (Art. 6(1)(a)) — for non-essential analytics cookies and any optional marketing. You may withdraw consent at any time.
Legal obligation (Art. 6(1)(c)) — to keep tax, accounting, and other records the law requires.
5. California Privacy Rights
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), gives you specific rights regarding your personal information:
Right to know: request the categories and specific pieces of personal information we have collected about you, and how we use and disclose it.
Right to delete: request deletion of the personal information we have collected from you, subject to certain exceptions.
Right to correct: request correction of inaccurate personal information we maintain about you.
Right to opt out: opt out of the “sale” or “sharing” of personal information. We do not sell your personal information and we do not share it for cross-context behavioral advertising.
Right to non-discrimination: we will not discriminate against you for exercising any of your privacy rights.
To exercise any of these rights, contact us at [email protected]. We will verify your request using the email address registered on your account before acting on it.
6. Data Sharing & Sub-processors
We share your data only as necessary to operate the Service. Our sub-processors are:
Supabase (authentication and database hosting — US region)
Anthropic (AI language model — used to generate the Spanish content; we do not send your account identity)
Cartesia (text-to-speech — the read-aloud audio for news briefs, stories, and bedtime is generated from the content text)
Stripe (payment processing — billing data only)
Sentry (error monitoring — diagnostic reports, configured with no Session Replay and no intentional personal data)
DigitalOcean (cloud hosting infrastructure)
Each sub-processor acts as our processor, is bound by contractual data-protection obligations (including GDPR Art. 28 terms where applicable), and may use your data only to provide services to us. We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
7. Data Retention
Account data is retained for as long as your account is active or until you request deletion.
Listening and usage data is retained while your account is active to support your ongoing learning, then deleted within 30 days of account closure.
Server logs are retained for up to 90 days.
First-party analytics events are retained to understand and improve the Service; for signed-in users they are deleted along with your other account data within 30 days of account closure.
Billing records are retained for as long as tax and accounting law requires, even after account closure.
8. Your Rights
Regardless of where you live, we offer all users the following rights regarding your personal data (these mirror the rights granted under the GDPR and UK GDPR):
Access: request a copy of the personal data we hold about you.
Rectification: correct inaccurate or incomplete data.
Erasure: request deletion of your data (“right to be forgotten”), subject to legal retention obligations. To request deletion, email [email protected] from the email address registered on your account, stating what you would like deleted (e.g. your entire account, or your listening history only). Requests sent from a different address cannot be actioned for security reasons.
Restriction: request that we limit how we process your data.
Portability: receive your data in a structured, machine-readable format.
Objection: object to certain processing of your data.
Withdraw consent: where processing is based on consent, withdraw it at any time, without affecting processing already carried out.
Automated decisions: we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days (one month for GDPR/UK GDPR requests, extendable by two further months for complex requests, in which case we will tell you). We may verify your request using the email address registered on your account before acting on it.
Right to complain. If you are in the EEA or the UK and believe we have mishandled your data, you may lodge a complaint with your local data protection authority — for example, the UK Information Commissioner's Office (ICO), or the lead supervisory authority in your EU member state. You can find your authority via the European Data Protection Board. We would, of course, appreciate the chance to address your concern first.
9. Cookies
We use a minimal set of cookies:
Authentication cookie (essential): set by Supabase Auth to keep you logged in. Required for the Service to function.
Cookie-consent preference (functional): remembers your cookie consent choice.
Language & variety preference (functional): remembers your chosen interface language and Spanish variety.
First-party analytics (functional): a long-lived visitor identifier and a short-lived session identifier that we set ourselves to measure how the Service is used. These are first-party only — the data stays in our own database and is never sent to a third-party analytics provider — and we rely on our legitimate interest in understanding and improving the Service.
We do not use advertising cookies, or cookies that identify you individually for marketing purposes. We do not use third-party analytics cookies.
10. Data Security
We implement technical and organisational measures to protect your data, including:
All data in transit encrypted with TLS 1.2+.
Passwords hashed by Supabase Auth (bcrypt); we never store plaintext passwords.
Row-Level Security (RLS) on all database tables so each user can only access their own data.
Provider API keys (Anthropic, Cartesia) held only on the server and never exposed to the browser.
Regular security reviews and monitoring.
No method of transmission over the internet or electronic storage is 100% secure. If we become aware of a personal-data breach that is likely to affect your rights, we will notify the relevant supervisory authority within 72 hours where the GDPR/UK GDPR requires it, and notify you without undue delay where the breach is likely to result in a high risk to your rights.
11. Children's Privacy
The Service is not directed to children. We do not knowingly collect personal information from children below the minimum age of digital consent that applies to them. In the EEA that age is 16 (or a lower age, down to 13, set by your member state); in the United States and the United Kingdom it is 13. If you believe a child below the applicable age has provided us with personal data, please contact us so we can delete it.
12. International Data Transfers
Aplauso Inc (operating as LingoSnips) is based in the United States, and we (and our sub-processors) store and process your personal data primarily in the United States. If you access the Service from the EEA, the UK, or another region, your personal data will be transferred to and processed in countries whose data-protection laws may differ from those in your country.
Where we transfer personal data out of the EEA or the UK, we rely on an appropriate safeguard recognised under the GDPR/UK GDPR — typically the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), an adequacy decision, or another lawful transfer mechanism. You can request a copy of the safeguard we use by emailing [email protected].
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will post the revised policy here with a new effective date and notify you by email or in-app notice where required. Continued use of the Service after the effective date constitutes acceptance of the updated policy.
Contact
For any privacy-related enquiries or to exercise your rights, contact us at [email protected].
