1. Who is responsible
The controller for the processing described here is Lingut AI, operating the Lingut German exam preparation platform at deutschtrainer.lingut.ai. You can reach us at support@lingut.ai.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, phone number, display name, password hash | Creating and securing your account, signing you in | Contract (Art. 6(1)(b)) |
| Target exam, level, exam date, mother language, interface language | Personalising practice content and AI feedback | Contract (Art. 6(1)(b)) |
| Exam and practice attempts, answers, scores, progress | Delivering the learning service and your progress reports | Contract (Art. 6(1)(b)) |
| Writing submissions and AI feedback | Automated grading and written feedback | Contract (Art. 6(1)(b)) |
| Speaking audio recordings and transcripts | Speaking practice, automated assessment, your own playback in the diary | Contract (Art. 6(1)(b)) |
| Vocabulary diary, AI coach plans, AI assistant conversations | Study coaching, spaced repetition, in-app support | Contract (Art. 6(1)(b)) |
| Support tickets and messages | Answering your requests | Contract (Art. 6(1)(b)) |
| Subscription, payment and invoice records | Billing, and statutory accounting retention | Contract and legal obligation (Art. 6(1)(b), (c)) |
| Technical error reports (masked) | Keeping the platform secure and working | Legitimate interest (Art. 6(1)(f)) |
| Session replay and performance tracing | Diagnosing usability and performance problems | Consent (Art. 6(1)(a)) |
| Referral / affiliate attribution cookie | Crediting the partner who referred you | Consent (Art. 6(1)(a)) |
We do not sell personal data, we do not run advertising networks, and we do not build advertising profiles. We do not knowingly collect data from children under 16 without parental consent.
3. AI processing of your work
Lingut uses AI to grade writing, run the speaking examiner, generate study plans and power the in-app assistant. This means the text you write, the audio you record and the questions you ask the assistant are transmitted to our AI processors (see section 4) to produce your result. Your work is not used to train third-party models. Automated grading is a scoring and feedback aid, not a decision with legal effect — you can always request human review via support.
4. Processors and international transfers
We use the following processors. Where a processor operates outside the EU/EEA, the transfer is covered by the EU Standard Contractual Clauses and the provider's supplementary safeguards.
| Processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Hosting, database, authentication, file storage | All account and learning data | EU / see provider terms |
| Stripe | Card payments and subscriptions | Email, billing details, payment status | EU / US (SCCs) |
| Anthropic | AI grading, coaching and assistant | Your submitted text and prompts | US (SCCs) |
| ElevenLabs | Speech synthesis and speech recognition | Speaking audio and transcripts | US (SCCs) |
| Sentry | Error monitoring, and session replay with consent | Masked technical diagnostics | US (SCCs) |
AI models are presented in the product under the name "LingutAI"; the underlying processors are the ones listed above.
5. Cookies and local storage
- Strictly necessary — your sign-in session and security tokens. These do not require consent and cannot be disabled.
- Functional local storage — interface language, chosen level and other preferences, stored on your device to avoid flicker.
- Analytics (consent) — Sentry performance tracing and masked session replay.
- Referral attribution (consent) — a 30-day
lingut_refcookie identifying the partner who referred you.
Nothing in the last two categories runs until you agree. .
6. How long we keep data
- Account and learning data: for as long as your account exists.
- Speaking recordings: 12 months.
- AI conversation and assistant history: 24 months.
- Technical error logs: 90 days.
- Inactive accounts: flagged after 24 months, notified by email, deleted after 30 months.
- Invoices and payment records: retained for the statutory period required by tax law, even after account deletion.
7. Your rights
Under the GDPR you have the right to:
- Access your data and receive a copy (Art. 15, 20) — available instantly under Settings → Delete account → Export my data.
- Correct inaccurate data (Art. 16) — editable in Settings.
- Have your data erased (Art. 17) — available instantly under Settings → Delete account.
- Restrict or object to processing (Art. 18, 21), including our legitimate-interest processing.
- Withdraw consent at any time (Art. 7(3)), without affecting processing already carried out.
- Lodge a complaint with your national supervisory authority (Art. 77).
Institution, partner and representative accounts can exercise the same rights from their own dashboard, or by writing to support@lingut.ai. We respond within one month.
Students enrolled by an institution
Where an institution buys seats and enrols you, the institution is a separate controller for the enrolment data it supplies and for the progress reports it receives. Requests about that relationship should be directed to your institution.
8. Security
Data is encrypted in transit (TLS) and at rest. Access is enforced per-row in the database, so one user's records are not reachable by another. Speaking recordings live in a private bucket accessible only to their owner. Administrative access is restricted to named accounts with role-based authorisation.
9. Changes
If we change this policy in a way that affects consent, the cookie banner is shown again so you can make a fresh choice. See also our Terms of Service and Imprint.