Privacy notice

1. Who is responsible

Duendillo is operated by its developer. Full contact details of the person responsible will be added here before Duendillo opens to the public. Until then, use "Contact support" in the Help menu.

2. Which data we process

Account data: your email address, your name, your password (stored only as a secure hash) and, if you sign in with Google, your Google account ID.

Settings: app language, translation language, Spanish variant, time zone and learning preferences.

Learning data: your answers, with their time, correctness and duration; texts you write and recordings you make in speaking exercises.

Technical data: logs of requests and errors, needed to run and protect the service.

3. Why we process it

To provide the service you signed up for (contract): your account, adaptive exercises and reviews, progress, groups and messages.

To send you emails you need, such as account confirmation and password reset.

To keep the service secure and working (legitimate interest).

To measure and improve how well Duendillo teaches, with aggregated statistics (legitimate interest; you can object, see below).

4. Learning statistics

We calculate aggregated statistics from learning data, such as how many learners come back, how much they remember over time and how accurately the app predicts forgetting. Statistics never contain your name or email address, and groups of fewer than 10 learners are not shown. Aggregated results may be published, for example in a master's thesis.

We do this on the basis of our legitimate interest in improving the app. You can object at any time in Profile → Settings → Privacy; your data is then left out of these statistics from that moment on.

5. AI providers

For AI features we send only what the feature needs, such as the text of your answer or a recording, never your name or email address.

Text marking, conversations, speech recognition and search are provided by OpenAI (USA). Speech synthesis and pronunciation assessment are provided by Microsoft Azure in the EU. Data sent to providers outside the EU is protected by the safeguards required by the GDPR. We ask for your consent before you use an AI feature for the first time.

6. How long we keep data

Recordings are deleted after 90 days; the transcript and the mark remain.

Account data is kept until you delete your account. Your answer history is then kept only under an anonymous ID (see the next section).

7. Deleting your account and exporting your data

You can download your personal data and delete your account in your profile.

When you delete your account, your personal data is deleted: email address, name, messages, texts and recordings. The history of your answers (correct or not, when and how fast) is kept under an anonymous ID that cannot be linked to you, so that the learning statistics and the adaptive models stay accurate.

8. Your rights

You have the right to access your data, correct it, delete it, restrict its processing, receive it in a portable format and object to its processing. You can withdraw a consent at any time; this does not affect processing that took place before.

You also have the right to lodge a complaint with a data protection supervisory authority.

9. Where and how data is stored

Our servers and databases are located in Microsoft Azure data centres in the European Union. Connections are encrypted, and passwords are stored only as secure hashes.

10. Changes to this notice

If we change this notice in an important way, we will let you know in the app or by email.