Privacy Policy

ArabeToDe operates the multilingual educational platform at arabetode.app (the "Platform"). The Platform provides AI-powered German language learning services for Arabic speakers, including vocabulary training, AI tutoring, reading practice, structured courses, language exchange calls, a CV builder, and a SaaS solution for Language Centers.

We act as the Data Controller with respect to the personal data of our users. Our third-party service providers act as Data Processors as described in Section 7.

We collect the following categories of personal data:

We process your personal data only where we have a lawful basis under GDPR Article 6. The table below maps our uses to their legal basis:

Our AI Tutor, Study Plan Generator, Dialog Generator, and Story Generator are powered by Google Gemini (Google LLC / Google DeepMind). When you interact with these features:

• Your prompts and context are transmitted to Google's Gemini API for processing.
• Google processes this data as a Data Processor on our behalf, under Google's API Terms of Service and Data Processing Addendum.
• AI conversation history is stored in your account on our Firestore database so you can review past sessions.
• We do not use your AI interactions to train our own AI models.

Google may process data on servers outside the EU/EEA. This transfer is covered by Standard Contractual Clauses (SCCs) as described in Section 9.

We use cookies and similar technologies to operate the platform, remember your preferences, and (with your consent) analyse usage. For full details — including a cookie inventory and how to manage your preferences — see our Cookie Policy.

You can update your cookie preferences at any time by clicking "Cookie Preferences" in the website footer.

We do not sell your personal data. We share data only in the following circumstances:

• With Service Providers (Processors): Firebase/Google (database, authentication, hosting), Google Gemini (AI processing), Paddle (payment processing), PayPal (payment processing), Netlify (web hosting and edge functions), and email delivery services. Each processor is bound by a Data Processing Agreement.
• With Language Centers: If you join a Language Center on the platform as a student, your learning progress, exercise scores, and placement test results are visible to that center's administrator and teachers.
• With Instructors: Instructors can see aggregate enrolment numbers and course ratings but do not have access to individual learner personal data beyond what learners voluntarily share.
• For Legal Compliance: We may disclose data to law enforcement, courts, or regulatory authorities if required by applicable law or to protect the rights, property, or safety of ArabeToDe, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. We will notify users via email and/or a prominent notice on the platform.

We retain personal data only as long as necessary for the purposes described above:

• Active accounts: Data is retained for the duration of the account.
• Deleted accounts: Account data is deleted within 30 days of a deletion request, except where we are required to retain it for legal or tax purposes (up to 7 years for financial records).
• AI conversation history: Retained for your active account. Deleted with your account or upon your request.
• Payment records: Retained for 7 years to comply with tax and accounting obligations.
• Support tickets: Retained for 2 years after closure.
• Analytics data: Retained in anonymised/aggregated form indefinitely; identifiable data is retained for a maximum of 13 months.
• Certificates: Issued certificates remain verifiable on the platform indefinitely for credential verification purposes, unless the certificate holder requests deletion.

ArabeToDe is operated internationally, and some of our processors are located outside the European Economic Area (EEA) and the United Kingdom, primarily in the United States.

For transfers from the EEA or UK to third countries, we rely on:

• Standard Contractual Clauses (SCCs) — the EU Commission-approved clauses for transfers to non-adequate countries.
• UK International Data Transfer Agreements (IDTAs) — for UK GDPR transfers.
• Adequacy Decisions — where the destination country has been deemed adequate by the EU Commission or UK ICO.

Depending on your location, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at support@arabetode.app. We will respond within 30 days (or 45 days for complex requests). You also have the right to lodge a complaint with your supervisory authority (e.g., the UK ICO at ico.org.uk or your national EU data protection authority).

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:

• Right to Know — request disclosure of what categories and specific pieces of personal information we collect, use, and share.
• Right to Delete — request deletion of personal information we have collected from you.
• Right to Correct — request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing — we do not sell your personal information or share it for cross-context behavioural advertising.
• Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information for purposes beyond those necessary to provide the service.
• Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, email us at support@arabetode.app with the subject "CCPA Rights Request".

ArabeToDe is intended for users who are 16 years of age or older. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child under 16 has created an account or provided us with personal data, please contact us immediately at support@arabetode.app and we will delete the information promptly.

For users aged 16–18, we recommend parental guidance when using AI-powered features and language exchange calls.

We implement appropriate technical and organisational security measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS).
• Firebase Security Rules to restrict unauthorised database access.
• Role-based access control (RBAC) for admin and center users.
• Email verification before account activation.
• Periodic security reviews and monitoring.

Despite these measures, no method of internet transmission or storage is 100% secure. If you discover a security vulnerability, please report it responsibly to security@arabetode.app.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or a prominent notice on the platform at least 14 days before the change takes effect. The updated policy will be posted on this page with a revised effective date.

Continued use of the platform after the effective date constitutes acceptance of the updated policy.

For privacy-related questions, requests, or concerns, contact our privacy team:

UK users have the right to complain to the ICO: ico.org.uk/make-a-complaint
EU users may contact their national supervisory authority.