Data processing: information under the GDPR
This page answers the questions the GDPR requires to be disclosed at the moment of collection: who processes the data, what exactly is collected, on what grounds, how long it is kept and what your rights are. In short: the site's own statistics contain no IP address, no cookies, no identifier of any kind, and third-party counters load only after your consent — never earlier.
Who processes data, and on what grounds
The data controller is Lingofly (Lingofly); contact is by email at support@lingofly.ai.
The site's own statistics contain no identifiers: no IP address, no cookies, no device fingerprint, no link between events. We describe it here because a field list is the simplest way to show it.
The traffic counters run on consent (art. 6(1)(a) GDPR): they do not load until you have pressed “I agree”, and a refusal is remembered the same way as consent. Consent is voluntary — if you refuse, the site works in full.
Which data is processed
| What | What exactly is recorded | What for |
|---|---|---|
| An on-page event | the page address, its kind (word, letter, topic), the section's language, the time to the second | to see which sections get read and where people leave for the app |
| A site search query | the string you typed — no longer than 64 characters — and the number of pages found | to see what the site is missing: a query with zero matches is the answer to that question |
| Your answer about the counters | a single “yes” or “no” in the browser's memory (localStorage), on your device | so we do not ask twice |
What the site does not record
- Your IP address — neither in the open nor as a hash. A hash of an address remains a pointer to a person if the set of addresses can be enumerated, and it can.
- Cookies and any persistent identifier. An event is linked neither to the one before nor to the one after: there is nothing to link it with.
- Where you came from — the referrer header is not kept.
- Recording your actions on the page — mouse movements, scrolling as a track, clicks on elements. None of that exists in our own analytics or in the settings of third-party counters.
- Data from the app. The site and the app are separate systems; lessons, streaks and payments live in the app and never travel to the site.
Counters and transfers outside the EU
The traffic counters — Yandex.Metrica and Google Analytics — are connected only after you consent. Until you press “I agree”, the browser does not contact their addresses at all: the page carries none of their tags, and the script is created only after the press.
If you agreed, the counter places its own identifiers on the device and processes data by its owner's rules — not by ours. Recording actions on the page (Metrica's webvisor and click map) is switched off by us explicitly.
A refusal is remembered the same way as consent: we will not ask a second time. To change your mind, clear the site's data in the browser settings — the question will then appear again.
If you consented, the counter's data goes to its owner and is processed by its rules: Yandex.Metrica on Yandex servers, Google Analytics in Google's infrastructure, including transfers outside the EEA. That is exactly what consent is asked for; refusal leaves you without both transfers.
Retention periods
Events are stored as files on the same server as the site and are deleted after 180 days — the server itself does this at the change of day, not a person following a reminder.
Separately from us, the publishing server keeps a technical log of requests (it contains IP addresses — that is how any web server works). It is not linked to the analytics events and is not used to watch people.
Rights under the GDPR
- Access (art. 15): find out what is being processed about you.
- Rectification (art. 16) and erasure (art. 17).
- Restriction of processing (art. 18) and objection (art. 21).
- Portability (art. 20) — for data you provided yourself.
- Withdrawal of consent at any time (art. 7(3)) — it does not affect the lawfulness of processing before the withdrawal.
- Complaint to a supervisory authority (art. 77) — in the country where you live.
No automated decisions
The site makes no automated decisions about you with legal or similar effects (art. 22 GDPR) and builds no profiles: there is nothing to build them from.
Frequently asked
Does the site set cookies?
The site's own part — not a single one. The only thing stored on your device is your answer about the counters in the browser's memory. If you agreed to the counters, it is they who place their identifiers.
Who is the data controller?
Lingofly (Lingofly). Letters about data processing go to support@lingofly.ai; the reply comes to the same address.
Is data transferred outside the EEA?
Only through the counters and only with your consent: Google Analytics processes data including outside the EEA, Yandex.Metrica on Yandex servers. Without consent, not a single request to their addresses happens.
Can I demand deletion of my data?
Withdrawing consent to the counters — yes, at any moment. As for statistics events, they are tied to a person by no field, so singling out yours is impossible: that is the price of our not recording an identifier.
What happens if I refuse?
Nothing changes: pages, recordings, trainers and search work the same. We simply will not learn which pages bring people in — and that is our problem, not yours.