Last updated: 21 October 2026
This Privacy Policy explains what personal data Polyglota collects, why we use it, who we share it with, and the rights you have — in plain language. It applies to our websites, the AI Student Portal, classes, translation services, the level test and the referral program.
Cougar OÜ (registry code 17558137, Ahtri tn 12, Kesklinna linnaosa, Tallinn, Harju maakond 15551, Estonia), trading as Polyglota (polyglota.app), is the controller of the personal data described in this policy. Contact for all privacy matters: info@polyglota.app.
Contact and account data: name, email, phone, password (stored hashed), language preferences.
Learning data: course progress, exercise answers, mistakes and corrections, saved vocabulary, notes, study plans, level-test answers and results, class schedules and attendance, homework and feedback.
Voice and speech data: recordings and/or transcripts you create in speaking practice (pronunciation, speaking missions, live practice) and — only with the explicit consent captured in that flow — class-conversation transcripts for learning analysis.
Documents: files you upload for translation quotes and the translated output (these may contain sensitive information — see section 7).
Payment and finance data: lesson balances, payment confirmations, invoices/receipts. We do not store card numbers.
Referral data: your referral code, anonymous visit counts, and — for referred people — the minimum needed to operate the program (see section 9).
Technical data: device/browser information, approximate location, usage analytics, and consent records (what you agreed to, when, from which page).
ChatGPT companion: the conversation and voice stay with ChatGPT. Only authored phrases you select and confirm are saved to your Polyglota account. If you separately opt in within the companion, we count the course and feature used, without messages, audio, email, IP addresses or ChatGPT user/session identifiers. Random event IDs prevent duplicate counts and are kept for three days; non-identifying daily totals for 13 months. The optional choice can be withdrawn in the companion. These counts are not advertising or session replay.
To provide the Services you request — classes, translations, the portal, the level test (legal basis: performance of a contract, or steps before a contract).
To personalise learning — your mistakes, vocabulary and progress power your personal study recommendations (contract / legitimate interest in providing an effective service).
To process voice recordings for pronunciation and speaking feedback (contract for practice features you actively use; consent for class-replay analysis).
To respond to enquiries and manage leads in our CRM (legitimate interest / pre-contractual steps).
To send marketing ONLY if you opt in (consent — withdraw any time).
To run analytics and advertising measurement (consent/legitimate interest — see the Cookie Policy).
To operate the referral program, including fraud prevention (legitimate interest / contract with the referrer).
To meet legal obligations (accounting, tax, consumer law).
AI features are powered by Google Gemini. When you use them, the relevant text or audio (for example an exercise answer, a practice recording, or an uploaded writing sample) is sent to Google for processing and the result is returned to the portal. We do not use your content to train our own models, and we configure providers as processors for our service.
AI features never make decisions with legal or similarly significant effects about you. Level estimates, feedback and study plans are informational and reviewed or adjustable by humans (your teacher or our staff).
We use trusted providers to run the Services: Lovable Cloud / Supabase (hosting, database, file storage), Google (Gemini AI, Google Analytics 4, Google Calendar for teachers’ scheduling), Meta (Meta Pixel advertising measurement), Microsoft (Clarity usage analytics), Freshworks (Freshsales CRM for leads and contacts), Calendly (backup trial-class booking), and banks/payment providers for payments. When you choose to contact us via WhatsApp, Telegram or Instagram, those platforms process your messages under their own policies.
When you book a free trial class on our website, we save the booking in our database, add it as a lead in Freshsales, and create an event in your teacher’s Google Calendar with your name and email (you are invited as a guest, with a Google Meet link). Google sends you the invitation and any updates by email. You can cancel or reschedule with the link in that invitation; cancelling removes the calendar event.
This section applies only to teachers who choose “Connect Google Calendar” in the teacher portal. Students and website visitors never connect a Google account to Polyglota and never grant us access to their Google data (signing in with Google only shares your name and email address, as for any account).
What we access. With the teacher’s permission we use exactly these Google permissions: (1) free/busy information of the teacher’s primary calendar (calendar.events.freebusy) — only the busy time ranges, never the titles, descriptions, locations or attendees of the teacher’s other events; (2) creating, updating and deleting the events that Polyglota itself creates for classes and trial bookings (calendar.events); (3) the email address of the connected Google account (openid, email), so the teacher can see which account is connected. We do not read the titles, details or attendees of any other events.
How we use it. Only to show a teacher’s free time slots on our booking pages, and to put booked classes and trial classes on the teacher’s calendar with a Google Meet link and the student invited as a guest (and to update or remove those events when a class is rescheduled or cancelled). We use Google user data for no other purpose.
Sharing. We do not sell Google user data and do not share it with anyone. It is processed only by our hosting provider (Lovable Cloud / Supabase) to run this feature. It is not used for advertising, is not sent to AI or machine-learning services, and is never used to develop, improve or train AI/ML models.
Protection. The OAuth tokens Google issues are stored only on our servers, never in the browser or the mobile app, and are accessible only to our backend. All data is encrypted in transit (TLS) and at rest.
Retention and deletion. Tokens are kept only while the calendar is connected and are deleted (and revoked with Google) immediately when the teacher clicks “Disconnect” or deletes their Polyglota account. Free/busy information is not stored; it is kept in memory for at most about 60 seconds to speed up the booking page. Events we created stay on the teacher’s calendar until the class is cancelled. A teacher can also revoke Polyglota’s access at any time at https://myaccount.google.com/permissions.
Polyglota's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Documents uploaded for translation may include identity, academic, medical or legal information. They are stored in a private bucket, are never publicly accessible, and are only available to the assigned translator and administrators through time-limited secure links. We use them exclusively to prepare your quote and translation, and we delete or anonymise them on request once legal retention needs (for example invoicing) are met.
Practice recordings are processed to create a transcript and feedback. Class-conversation analysis (replays) happens only with the consent captured in that flow, and extracted learning points are reviewed by your teacher before entering your learning records. You can ask us to delete recordings at any time.
We designed the program to minimise data: referrers share a link; the referred person always submits their own details. Referrers NEVER see the referred person’s data — only anonymous counts and statuses (for example “Invited person #2 — signed up”). For referred people we store the referral code, at most a first name as an internal label, and progress status; you can ask us to anonymise your referral record at any time without affecting your account.
Some providers process data outside the EU/EEA (for example in the United States). Where that happens we rely on appropriate safeguards, such as the EU–US Data Privacy Framework or Standard Contractual Clauses, plus technical measures.
We keep personal data only as long as needed: account and learning data while your account is active (and deleted or anonymised after you ask us to close it); consent records as a legal audit trail; payment and invoice data for the periods required by tax law; translation source documents until the job is complete plus a short handover window, unless you ask for earlier deletion. First-party usage events are kept for 90 days; linked first-activity dates and non-identifying daily totals for 13 months. Account deletion removes linked usage analytics; non-identifying totals may remain until their retention period ends. We also count how many signed-in people use the app each day, per platform (web, iOS, Android), as anonymous daily totals: no account, device identifier or activity is stored with these counts, and the one-day technical value used to avoid counting a person twice is deleted the next day.
How to delete your Polyglota account. In the Polyglota app or on polyglota.app, open Profile → Account (polyglota.app/app/account), choose “Delete my account permanently” and type DELETE to confirm. Deletion runs immediately and cannot be undone. You can also ask us to delete your account by emailing info@polyglota.app from the address on your account; we complete those requests within 30 days.
What is deleted: your notes, saved vocabulary, recorded mistakes and mistake history, pronunciation and speaking attempts, roleplay and conversation-practice sessions, AI coach recommendations, and every voice recording we hold for you. Your login is disabled permanently and cannot be restored.
What is kept, with your name removed: lesson, attendance, payment, invoice and lesson-balance records, and the consent audit trail. Tax and accounting law requires us to keep these (up to 10 years). Your display name and photo are stripped from them, so what remains is not identifiable as you.
Teacher and administrator accounts cannot be deleted from inside the product, because they are attached to assigned students and to financial records. Email info@polyglota.app and we will handle it.
You have the right to access, correct, delete and export your data; to object to or restrict certain processing; to withdraw any consent at any time (without affecting past processing); and not to be subject to automated decisions with legal effect. To exercise any right, email info@polyglota.app — we respond within one month.
You also have the right to complain to a supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados, cnpd.pt), or the authority of your country of residence.
We apply technical and organisational measures: encrypted connections, role-based access rules at the database level, private storage buckets with expiring access links, server-side permission checks for every sensitive action, and audit trails for consent and financial records. No system is perfectly secure, but we design for least access. Never share your password — we will never ask for it.
The AI Student Portal is intended only for adults aged 18 or older; we do not offer portal accounts to minors. Our separately arranged teacher-led classes for children remain available through their parent or guardian. The public marketing experience is directed at adult learners and parents or guardians choosing services. With separate optional analytics consent, Microsoft Clarity may record permitted adult marketing pages and eligible adult student portal screens in a web browser. Children’s accounts, child-facing learning and private booking flows are excluded from replay.
We use cookies and similar technologies (localStorage) for sign-in, preferences, analytics and advertising measurement. See our Cookie Policy for the full list and your choices.
We may update this policy as the Services evolve; material changes will be announced on the site. The date at the top always reflects the current version.
For any privacy request or question, email info@polyglota.app.