Privacy Policy

This Privacy Policy describes how Settlebuddy Technologies (“Language Lab”, “we”, “us” or “our”) collects, uses and protects your personal information when you use language-lab.io and our related services (the “Services”). We are the data controller for this information and are committed to handling it responsibly and in accordance with the data-protection laws that apply to you — including the EU and UK GDPR, India’s Digital Personal Data Protection Act, US state privacy laws (such as the CCPA/CPRA), Brazil’s LGPD, Canada’s PIPEDA and Quebec Law 25, Australia’s Privacy Act, Japan’s APPI, South Korea’s PIPA, South Africa’s POPIA and Switzerland’s FADP.

Settlebuddy Technologies is a micro-enterprise registered under India’s MSME framework; our full registered details are set out in our Legal Notice. You can reach us at [email protected]. This policy explains your choices and rights; where the law requires your consent for something, we ask for it separately (for example in our cookie banner) rather than treating your use of the site as consent.

Grievance Officer (India). For users in India, you can reach our Grievance Officer under the Digital Personal Data Protection Act at [email protected].

When you create an account or use the Services, we collect information such as your name and email address, and any details you choose to add to your profile (for example your target language, level, and learning goals). If you contact us, we keep a record of that correspondence.If you choose to sign in with Google, we receive basic profile information (such as your name and email address) to create and secure your account. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.To provide the Services we process the content and activity you generate as you learn — your progress, saved items, practice answers, and the messages you exchange with our AI conversation partner (see section 5). If you use speech, the text transcribed from your speech is processed as described in section 5.When you visit the Services, we automatically collect standard technical information such as your device type, browser, IP address (including for bot protection) and general location (country), and how you interact with the site, using cookies and similar technologies as described in our Cookie Policy.

We use your information to:

• provide, maintain and secure the Services and your account;
• run the AI conversation and learning features you use, and remember your progress;
• respond to your requests and provide customer support;
• communicate with you about the Services and, where you have opted in, send you updates;
• where you have given a separate opt-in, tell you about other Settlebuddy Technologies products relevant to your move (such as SettleBuddy, our relocation assistant) — you can withdraw this at any time;
• with your consent, understand how the Services are used and improve them; and
• comply with our legal obligations and protect against fraud and abuse.

Where the GDPR applies, we process your personal data on a basis appropriate to each purpose: performance of a contract (to run your account and the learning and conversation features you ask for); your consent (for optional analytics, session replay and advertising, and for marketing emails — each of which you may withdraw at any time); our legitimate interests (to keep the Services secure and prevent abuse); and compliance with legal obligations.

No automated decisions about you. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Sonia and our learning features are teaching tools — they do not decide anything about your rights, eligibility, pricing or access to the Services.

The Services include an AI conversation partner (“Sonia”) and other AI-assisted learning features. When you use them, we process the messages you send — the text you type and, if you speak, the text transcribed from your speech.

Two voice features, handled differently. With the AI tutor (Sonia), your browser converts your speech to text on your device; your raw voice audio for this feature is not sent to us or to our AI provider — only the resulting text is. With the Pronunciation Coach, a short audio clip is uploaded to our servers to score how you pronounce a word; it is processed only to give you that feedback, is notused to identify you (it is not biometric identification data), and is not sold or used to train models.

You are talking to an AI, not a person. Sonia is an automated system. Sonia’s replies are generated by a trusted third-party AI provider, which processes your messages under its terms solely to produce the response. Sonia’s voice is synthesised on our own servers, so your conversation text is not sent to a third party for speech. We do not use your conversations to build advertising profiles about you or to train AI models. Our lesson content itself is prepared in advance by automated tools that receive no personal data.

Please don’t share sensitive details. Because you can type freely, please avoid entering sensitive information (such as health, financial, political or government-ID details) in conversations — we do not ask for it and you do not need to provide it to learn.

We do not sell your personal information for money, and we share it only as needed to run the Services, under appropriate confidentiality and data-protection terms. (Some advertising cookies may count as a “sale” or “sharing” under certain US state laws — see section 10.) Our main providers are:

• Hosting, delivery & bot protection: Cloudflare (site delivery, security and Turnstile bot checks).
• Accounts & database: Supabase (sign-in and data storage, EU region).
• Sign-in: Google (if you choose Google sign-in).
• AI replies: a trusted third-party AI provider (Sonia’s voice is generated on our own servers) — see section 5.
• Analytics & session replay (with your consent): PostHog, hosted in the EU — see section 7.
• Advertising (with your consent): Meta, Google and LinkedIn — see section 8.

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a business transfer.

If you consent to analytics, we use PostHog (hosted in the European Union) to understand how the Services are used and to record session replays — playbacks of on-page interactions that help us fix problems and improve the experience. In these recordings, all on-screen text and everything you type is masked, so passwords, messages and other content you enter are never captured, and we record only a sample of sessions. We act as the controller and PostHog as our processor under a data-processing agreement. This happens only with your consent (session replay is part of the Analytics choice in our banner), you can withdraw it at any time, and the data is kept only as long as needed for these purposes.

If you consent to marketing, we use advertising and measurement pixels from Meta, Google and LinkedIn to measure our campaigns and reach relevant audiences. For the data collected through these pixels, we and the relevant platform act as joint controllers; each platform then processes that data for its own purposes under its own privacy policy. We do not knowingly enable advertising features that profile people under 18. You can withdraw this consent at any time from Cookie settings (in the footer) or the Cookie Policy.

International transfers: Meta, Google and LinkedIn are certified under the EU–US Data Privacy Framework, which we rely on (with standard contractual clauses as a fallback) for transfers to the United States.

We are based in India and some of our providers operate outside your country or region, including outside the European Economic Area — for example our sign-in and advertising partners in the United States and our third-party AI provider, while our accounts, analytics and hosting providers (Supabase, PostHog, Cloudflare) operate within the EEA. Where we transfer personal data internationally we rely on appropriate safeguards— standard contractual clauses, and (for our US advertising partners) the EU–US Data Privacy Framework — in line with applicable law.

If you are a US resident, your state law (for example California’s CCPA/CPRA, and laws in Virginia, Colorado, Connecticut, Texas and others) may give you the right to know, access, correct and deleteyour personal information, and to opt out of its “sale”, “sharing” or use for targeted advertising.

We do not sell your information for money. However, our use of advertising cookies (Meta, Google, LinkedIn) may be considered a “sale” or “sharing” under these laws. To opt out, use Cookie settings (in the site footer and on our Cookie Policy page) to turn off Marketing, or email us. We also honour the Global Privacy Control (GPC) browser signal automatically — if your browser sends it, we keep advertising cookies off without any further action from you. We do not use sensitive personal information for purposes that would require a separate right to limit.

We use cookies and similar browser-storage technologies to run the Services, remember your preferences and — with your consent — measure usage and advertise. You can manage your choices at any time. See our Cookie Policy for full details.

We keep different categories of data for different periods:

• Account & profile (name, email, learning preferences): while your account is active; deleted or anonymised within about 90 days of account closure.
• Learning progress & saved items: while your account is active.
• AI conversation content: kept only as needed to give you continuity, and deleted on account closure; our AI provider may retain prompts for a limited period under its own terms for safety, abuse-prevention and legal compliance.
• Analytics & session replay: up to 12 months.
• Advertising cookies: for the durations listed in our Cookie Policy (roughly 3–24 months).
• Consent records: for as long as needed to prove consent, plus any applicable limitation period.
• Support correspondence: up to 24 months.

When a period ends, data is deleted or anonymised. We keep information longer only where the law requires it (for example tax or accounting rules). You can ask us to delete your account and associated data at any time.

If you are in the EU/EEA or UK, you have the right to access, correct, delete and exportyour personal information, to object to or restrict certain processing, and to withdraw consent at any time (without affecting processing already carried out). To exercise any right, email [email protected]; we respond within the timeframes required by law. You may also complain to your local supervisory authority (listed by the European Data Protection Board) or, in the UK, the Information Commissioner’s Office.

You may access, correct, update and erase your data, withdraw consent, and nominate another person to exercise your rights if you die or become incapacitated. You can give, manage or withdraw consent with us directly or, where available, through a registered Consent Manager. Raise any grievance with our Grievance Officer at [email protected]; if unresolved, you may approach the Data Protection Board of India.Wherever you live, you can email us to exercise your local rights and complain to your national regulator:

• United States: see section 10.
• Brazil (LGPD): confirm, access, correct, anonymise or delete, and port your data — regulator: ANPD.
• Canada (PIPEDA / Quebec Law 25): access, correction and consent withdrawal; Quebec adds de-indexing and portability — regulators: OPC, or Quebec’s CAI.
• Australia (Privacy Act / APPs): access and correction — regulator: OAIC.
• Japan (APPI): disclosure, correction and cessation of use — regulator: PPC.
• South Korea (PIPA): access, correction, deletion and suspension — regulator: PIPC.
• South Africa (POPIA): access, correction, deletion and objection — regulator: the Information Regulator.
• Switzerland (FADP): access, correction and deletion — regulator: the FDPIC.

We use appropriate technical and organisational measures to protect your information, including encryption in transit, access controls and secure authentication. While no method of transmission or storage is completely secure, we work to safeguard your data and will notify you and the relevant authorities of any data breach as required by law.

You must be at least 16 to create an account yourself. If you are under 16, a parent or guardian must set up and manage the account for you. The digital-consent age varies by country — for example 13 in the US and UK, 13–16 across the EU, and 18 in India, South Africa and Brazil — and we apply whichever rule is stricter for you.

Because several countries treat everyone under 18 as a child, we apply the strongest protection to any account held by someone under 18: we switch off behavioural analytics, session replay, profiling and targeted advertising entirely for that account, regardless of cookie choices. We do not knowingly collect data from children below the applicable age. If you believe a child has used the Services without the required parental consent, contact us and we will remove the data.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for significant changes, take reasonable steps to notify you and, where required, ask for your consent again.

If you have any questions about this policy, your personal information, or to raise a grievance, contact Settlebuddy Technologies at [email protected]. Our full registered details are set out in our Legal Notice.

See also: Cookie Policy · Terms · Refund Policy · Legal Notice