Privacy Policy

Last updated: 24 September 2026

This policy explains what personal data the Lautly app and the website lautly.com ("Lautly", "we", "us") process, why, on what legal basis, who receives it, how long it is kept, and what rights you have. It is written to meet Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller for your data is:

Sharmin Afroz
Bernsdorfer Str. 115
09126 Chemnitz
Germany
Email: sharmin.ahsan@hotmail.com

Lautly is not required to appoint a data protection officer. Questions about this policy or your data can be sent to the email above.

2. What we process, and why

2.1 Your account

When you sign in, we create an account identified by a random user ID. With Sign in with Apple, Apple gives us a stable identifier for you; we store only a keyed hash of it, never your Apple ID, name or email address. We also store your home time zone (so daily goals and streaks roll over at your midnight), when the account was created, and your subscription tier.

• Purpose: providing your account, sign-in and subscription.
• Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

2.2 Your learning progress

Your words, cards, review schedule, lesson progress, streaks and study minutes are stored on your device. They are not sent to our servers.

2.3 Your voice (pronunciation checks)

When you choose to have your speaking scored, the recording of that attempt is sent directly from your device to Microsoft Azure AI Speech in the European Union, which returns a pronunciation score. Our server only issues a short-lived access token for the request. Neither we nor Microsoft keep the recording after scoring; your score is stored on your device. Lautly asks for your permission before the first recording is sent, and you can withdraw it at any time in Settings › Privacy.

Your best take. In sound lessons, Lautly keeps one short recording (up to five seconds) of your best attempt at each sound, so you can hear yourself get it right. It is stored only on your device, is never uploaded to us or anyone else, and is left out of device backups unless you turn on Include my best takes in backups. You can delete these recordings at any time in Settings › Privacy, and they are deleted when you delete your account.

• Legal basis: your consent (Art. 6(1)(a) GDPR).

2.4 Photos and text you turn into cards

When you use "cards from a photo" or "cards from a topic or text", the photo or text is sent to our server, which passes it to Microsoft Azure (Azure AI Document Intelligence to read the text in a photo; Azure OpenAI to propose cards) in the European Union. The photo and text are used only to create the cards you asked for and are not stored. Lautly asks for your permission before the first photo is sent.

• Legal basis: your consent for photos (Art. 6(1)(a) GDPR); performance of the contract for text you submit (Art. 6(1)(b) GDPR).

2.5 Usage limits

To keep free features within their limits, we count how many pronunciation checks and card generations your account has used in the current period. We do not record what you said or wrote in these counters.

• Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse of paid services (Art. 6(1)(f) GDPR).

2.6 Purchases

Subscriptions and in-app purchases are processed by Apple under Apple's own terms and privacy policy. We receive only confirmation of what you are entitled to, never your payment details.

2.7 Technical data

Our servers record technical logs (time of request, request path, error codes) to keep the service secure and working. Logs do not contain your recordings, photos or the text you submit, and are kept for no longer than 30 days.

• Legal basis: our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

2.8 Usage events (only if you turn them on)

If you turn on Share anonymous usage in Settings › Privacy (it is off until you do), the app sends short events about how the course is used: which kind of exercise you answered, whether it was right, how long it took, which beat of a lesson you left, which Today card you opened, and whether you opened a reminder. Each event carries a random identifier made when the app was installed — not your account, name or email — the app version, and which version of an experiment you are in. Events never contain your voice, anything you typed or said, or any other free text. They are stored in our Microsoft Azure logs in the EU for no longer than 30 days and used only to improve the course. Turning the setting off stops them at once and deletes any not yet sent.

• Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

2.9 This website

When you visit lautly.com, the pages are delivered by Microsoft Azure Static Web Apps. To deliver them and to protect the service, Microsoft's servers process the technical data your browser sends with every request: your IP address, the date and time, the page requested and your browser's user agent. The website sets no cookies, uses no analytics or tracking, and loads nothing from other companies. We do not receive or keep these request logs ourselves.

• Legal basis: our legitimate interest in delivering a secure website (Art. 6(1)(f) GDPR).

2.10 What we do not do

We do not use advertising, we do not track you across other companies' apps or websites, we do not sell your data, and we do not make decisions about you that have legal or similarly significant effects by automated means.

3. Who receives your data

• Microsoft Ireland Operations Ltd. (Microsoft Azure) — hosting of our server and database, and the speech, vision and language services described above, as our processor under a data processing agreement. Processing for the app takes place in the Azure Sweden Central region (EU). The website is served from Microsoft's global network, so a page may be delivered from a location outside the EU.
• Apple Distribution International Ltd. — Sign in with Apple and payments, as an independent controller.

Where a provider may access data from outside the European Economic Area, the transfer is protected by the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

4. How long we keep it

• Account data: until you delete your account. Deleting your account (You › Account › Delete account) removes it from our servers immediately.
• Recordings, photos and submitted text: not stored after processing. Your best take of each sound (section 2.3) is kept only on your device until you delete it or your account.
• Usage counters: for the current limit period.
• Server logs: at most 30 days.
• Data on your device: until you delete it or the app.

5. Your rights

You have the right to:

• access your personal data, and receive a copy of it (Art. 15 GDPR);
• rectify inaccurate data (Art. 16);
• erase your data (Art. 17), which you can do yourself by deleting your account;
• restrict processing (Art. 18);
• data portability: receive your account data in a machine-readable format (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, without affecting processing done before withdrawal (Art. 7(3)), for example in Settings › Privacy;
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.

To exercise a right, email us at the address in section 1.

6. Children

Lautly is intended for learners aged 16 and over. If you are younger, a parent or guardian must agree to your use of the app and to the consents described above.

7. Security

Data in transit is encrypted with TLS. Access to our servers and cloud resources is restricted and secured with keys that are never included in the app.

8. Changes

If we change this policy, we will update the date at the top and, for significant changes, tell you in the app before they take effect.