Privacy policy

1. Data controller

The data controller for Lang-age learner and visitor personal data is Quduratech.

Privacy and support contact: [email protected]. WhatsApp / mobile: +44 7988 958486. Correspondence address: Teesside Freeport Business Hub, Wilton International, Redcar, TS10 4RG, United Kingdom.

Where an organization (school, employer, or training partner) enrolls you under a seat license, that organization may act as an independent controller or joint controller for roster and enrollment data it provides. In those cases, we process such data on the organization’s instructions and within the Lang-age organization portal boundaries.

2. Scope

This Policy applies to personal data processed through Lang-age consumer apps, the marketing website, learner accounts, and organization portals operated by Quduratech.

It does not cover third-party websites or services that we do not control, even if linked from the Services.

3. Personal data we collect

We collect the following categories of personal data, depending on how you use Lang-age:

• Account data: name or preferred name, email address, password (stored as a secure hash), language preference, and account role.
• Profile and preferences: CEFR level or placement result, learning goals, writing tone preferences, agent personality settings, and notification preferences.
• Learning and assessment data: lesson progress, practice attempts, scores, placement responses, skill gap indicators, XP/streaks, and related performance metadata.
• Voice and audio: microphone recordings or audio clips you submit for speaking tasks, pronunciation practice, placement speaking sections, or conversations with Lingo. Audio is processed to provide transcription, scoring, and feedback.
• Writing and chat content: text you submit in writing tasks, translator tools, and AI agent conversations.
• Device and technical data: device type, operating system, app version, approximate region derived from network signals, IP address, crash logs, and diagnostic events needed to operate and secure the Services.
• Payment and commercial data: purchase history, subscription status, product identifiers, and limited billing metadata from app stores or payment processors. We do not store full payment card numbers on Lang-age servers when payments are processed by Google Play, Apple, or a PCI-compliant processor (such as HyperPay where configured).
• Organization data (if applicable): organization name, seat allocation, enrollment lists, admin contacts, and progress reports for licensed learners.
• Support communications: messages you send to support or privacy contacts, and related ticket metadata.

4. Sources of data

We obtain personal data directly from you; automatically from your device when you use the Services; from your organization if you are enrolled under a seat license; and from payment platforms when you buy digital products.

5. How we use personal data

We use personal data to:

• Create and manage accounts, authenticate users, and provide the Services.
• Run adaptive placement assessment and generate CEFR-oriented level estimates and learning paths.
• Deliver lessons, practice, feedback, gamification, and Lingo agent interactions.
• Process speaking and writing submissions using AI models and evaluation pipelines (including speech recognition and language assessment components where enabled).
• Process purchases, unlock level phases or entitlements, prevent fraud, and manage subscriptions.
• Send service notices, security alerts, and (with your consent or as permitted by law) learning reminders and product updates.
• Monitor reliability, debug errors, improve content quality and model performance, and maintain security.
• Comply with legal obligations, respond to lawful requests, and enforce our Terms of Service.
• Provide organization admins with enrollment and progress reporting for their licensed learners only.

6. AI processing

Lang-age uses artificial intelligence and automated processing to score responses, estimate level, generate feedback, route adaptive content, and power Lingo conversations.

AI outputs (including CEFR estimates, scores, and feedback) are educational tools, not official government or exam-board certifications, and may contain errors. Human review may be used for quality assurance or dispute handling.

Voice and text content you submit may be processed by our systems and by infrastructure providers that host our models or APIs under contractual confidentiality and security obligations. We do not sell your learning content as a standalone product.

7. Legal bases (where applicable)

Depending on your location and applicable law (including the Saudi Personal Data Protection Law — PDPL — and other Gulf or international privacy laws), we process personal data on one or more of the following bases: performance of a contract (providing the Services you request); consent (for example optional notifications or certain optional features); legitimate interests (securing and improving the Services, preventing abuse), balanced against your rights; and legal obligation.

8. How we share personal data

We do not sell personal data. We may share personal data only as follows:

• Service providers: cloud hosting, databases, analytics/crash reporting, email delivery, AI inference hosting, and customer support tools, under contracts that restrict use to providing services to us.
• Payment and app platforms: Google Play, Apple App Store, and payment processors as needed to complete transactions and validate entitlements.
• Organizations: if you learn under an organization license, designated admins may see enrollment status and learning progress for seats they manage.
• Legal and safety: when required by law, court order, or to protect rights, safety, and security of users, Quduratech, or the public.
• Business transfers: in connection with a merger, acquisition, or asset sale, subject to appropriate confidentiality protections.

9. International processing

We may process and store personal data on servers in the Kingdom of Saudi Arabia, the Kingdom of Bahrain, and/or other regions where our providers operate. Where data is transferred across borders, we apply appropriate contractual and technical safeguards consistent with applicable law.

10. Retention

We retain personal data only as long as needed for the purposes described in this Policy, including to provide the Services, maintain accounts, resolve disputes, enforce agreements, and meet legal, tax, and accounting requirements.

When you delete your account, we scrub personal identifiers and revoke sessions as described in Section 12. Certain anonymized or aggregated analytics, audit logs required for security/compliance, and legally required records may be retained for longer periods.

Organization-owned roster data may remain under the organization’s control until the organization requests removal or the license ends, subject to law.

11. Security

We implement administrative, technical, and organizational measures designed to protect personal data, including encryption in transit (TLS), access controls, hashed passwords, and session revocation on account deletion.

No method of transmission or storage is completely secure. You are responsible for keeping your credentials confidential and for the devices you use to access Lang-age.

12. Your rights and account deletion

Subject to applicable law, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to withdraw consent where processing is consent-based.

You may delete your Lang-age account and request erasure of personal data:

• In the app: Settings → Privacy → Delete account & data (type DELETE to confirm).
• On the web: https://lang-age.uk/en/delete-account (or the /ar/delete-account page for Arabic).
• By email: [email protected] with subject “Account deletion request”, using your account email.

12.1 What deletion covers

Upon a verified deletion request, we revoke active sessions and scrub personal account fields (including email and profile preferences). Our target completion window is within seventy-two (72) hours; in-app deletion is typically executed immediately.

Data deleted or disassociated from your identity includes account profile data, authentication sessions, notification preferences, and personal learning artifacts linked to your user id, subject to technical constraints and legal holds.

We may retain: anonymized analytics; records needed for legal, tax, fraud-prevention, or security audit purposes; and organization-managed enrollment records that your organization controls.

13. Children

Lang-age is intended for users aged 18 and over, unless an organization enrolls younger learners under appropriate parental or guardian consent and applicable education rules. We do not knowingly collect personal data from children under 13 for consumer sign-up. If you believe a child has provided personal data improperly, contact [email protected] and we will take appropriate steps.

14. Cookies and similar technologies

Our websites may use cookies or local storage for essential site operation, language preference, and theme preference. You can control cookies through your browser settings. Disabling essential cookies may affect site functionality.

15. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes will be communicated through the Services or by email where appropriate. Continued use after an update constitutes acceptance of the revised Policy, except where applicable law requires additional consent.

16. Contact

Email: [email protected]

WhatsApp / mobile: +44 7988 958486

Address: Lang-age / Quduratech, Teesside Freeport Business Hub, Wilton International, Redcar, TS10 4RG, United Kingdom.

Related pages: Terms of Service (/terms) and Delete Account (/delete-account).