This policy explains what personal data Slova collects when you use getslova.com, app.getslova.com and our apps, why we use it, who helps us process it and what rights you have. It is our privacy notice under the EU and UK General Data Protection Regulation (GDPR). If you are in Türkiye, you also have the rights given by Law No. 6698 on the Protection of Personal Data (KVKK).
1. Who is responsible
The data controller is the sole proprietor who operates Slova in Türkiye. Contact: info@getslova.com. Write to this address for any question or request about your data.
2. What we collect and why
| Data | When | Why | Legal basis |
|---|---|---|---|
| Name, email address, your answers in the sign-up questions (languages, level, goals, interests, how much time you have), the language of the page and the plan prices you were shown | When you join the waitlist at /start/ | To keep your place, tell you when you can start and prepare a learning path that fits your answers | Your request to join (steps before a contract); your consent, which you can withdraw at any time |
| Account details from your sign-in provider: name, email address, profile picture and a user ID | When you sign in to the app | To create and secure your account | Performance of our contract with you |
| Learning data: lessons done, progress, saved words, settings, the topics and prompts you enter and the material generated for you (text, images, audio) | While you use the app | To provide the lessons and tools and keep your work | Performance of our contract with you |
| Subscription details from Paddle: plan, status, country, amounts, and a customer ID | When you buy or change a subscription | To give you the plan you paid for and handle support, cancellations and refunds | Performance of our contract; legal obligations (tax and accounting records) |
| Messages you send us | When you email us | To answer you | Our legitimate interest in responding; performance of our contract |
| How you found us: the campaign tags in the link you followed (utm_ tags) and the ad click ID (gclid, gbraid or wbraid) | When you arrive at /start/ from an ad or a tagged link and then join the waitlist | To see which campaigns and ads bring people who join, and to spend our advertising where it works | Our legitimate interest in measuring our advertising |
| Advertising measurement by Google and Meta: cookie identifiers, the page visited, whether you joined the waitlist, and device and browser data | When you open our home page or /start/ | To measure which Google and Meta ads lead to sign-ups (conversion tracking) | Our legitimate interest in measuring our advertising |
| Technical data: IP address, browser and device type, request logs, error logs | On every visit | To deliver the site, keep it secure, stop abuse and fix errors | Our legitimate interest in running a secure service |
We do not collect payment card details: Paddle collects them directly at checkout. The free level test at /test/ runs in your browser; your answers stay on your device unless you continue to the waitlist, which then receives only the level you reached.
We do not sell your personal data for money, and there are no ads inside Slova. We do advertise Slova on other platforms; section 6 explains the cookies we use for that and how you can limit them.
3. Who processes your data for us
We use these service providers. They process personal data on our instructions and only to provide their service to us. We choose the AI models and providers behind the tools and may change them; when we do, we update this list.
- Cloudflare, Inc. (United States): hosting, network and security, storage of the waitlist and of files you create, email routing.
- Google LLC / Google Ireland: Firebase Authentication and Firestore (accounts and learning data), the Gemini API (the voices that read lessons and the tutor aloud), Google Fonts (fonts on our pages) and the email inbox where our messages arrive.
- OpenAI, L.L.C. (United States): AI text for lessons and learning material, image generation and speech to text.
- DeepSeek (People’s Republic of China): AI text for live practice — Roleplay, the speaking tutor, Felix chat and word look-ups — and for learning paths. It receives what you type or say in those features, with the lesson context it needs; never your name, email address or account details.
- Paddle.com Market Limited (United Kingdom) and its affiliates: payments, tax, invoicing and payment support. Paddle is our reseller and Merchant of Record and acts as an independent controller for the payment data it collects; see Paddle’s privacy notice.
- Google Ireland Limited / Google LLC (Google Ads): measuring which of our Google ads lead to sign-ups. Google uses advertising cookies on our home page and sign-up pages for this, and it acts as an independent controller for the data its tags collect; see how Google uses information from sites that use its services.
- Meta Platforms Ireland Limited / Meta Platforms, Inc. (Meta Pixel): measuring which of our ads on Facebook and Instagram lead to sign-ups. The pixel on our home page and sign-up pages records a page view and a sign-up, and Meta acts as an independent controller for the data it collects; see Meta’s privacy policy.
If we add another advertising or analytics partner, we list it here first.
When you use an AI tool, the prompt and the context needed to answer it are sent to the relevant AI provider. Each provider uses it to produce the answer and may keep it for a limited time under its own terms, for example to detect abuse. We do not use your content to train AI models. Please do not enter sensitive personal information, such as health data, into the AI tools.
We may also disclose data where the law requires it, to protect our rights or the safety of others, or to a successor if Slova is transferred, in which case this policy continues to apply.
4. Transfers outside your country
Our providers process data in the United States, the European Union, the United Kingdom and, for DeepSeek, China, so your data may be transferred outside Türkiye and outside the European Economic Area. For the United States we rely on the safeguards the law requires, such as the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework where the provider is certified. China has no adequacy decision: DeepSeek receives only the text of the live practice and learning-path requests described above, never your name, email address or account details. If you do not want that, you can use the rest of Slova without those features.
5. How long we keep data
- Waitlist data: until you have an account or ask us to remove it, and at most 24 months after you sign up.
- Account and learning data: while your account exists. After you ask us to delete your account we erase it within 30 days, except backups, which are overwritten within a further 30 days.
- Subscription and invoice records: as long as tax and commercial law requires, usually 10 years in Türkiye.
- Technical logs: up to 30 days, longer only when needed to investigate a security incident.
- Campaign tags and ad click IDs saved with a waitlist entry: as long as that entry.
- Your cookie choice: 12 months, after which we ask again. Google’s advertising cookies: up to 90 days.
6. Cookies and similar technologies
Cookies are small files a website saves in your browser. Here “similar technologies” means your browser’s local and session storage and the tags that read them. We use three kinds:
| Kind | What it does | What we use now | Your choice |
|---|---|---|---|
| Necessary | Runs the Service: keeps you signed in, remembers your language and lets you resume a test or sign-up | The sign-in cookie on app.getslova.com and storage in your browser | Always on, because the site needs them; you can still delete them in your browser |
| Analytics | Counts visits and shows us how pages are used | None at the moment | Nothing to turn off |
| Advertising | Measures which ads bring people to Slova and lets ad platforms use that to show and improve ads | The Google tag and the Meta Pixel on our home page and on /start/: cookies such as _gcl_au and _gcl_aw (Google) and _fbp (Meta), each kept up to 90 days, and the ad click ID kept for your visit | Block or delete them in your browser, or use the settings below |
On getslova.com these advertising tags run on the home page and on the sign-up pages (/start/).
To limit advertising: your browser’s cookie settings, the advertising settings of your phone (“Limit Ad Tracking” or “Delete advertising ID”), Google’s ad settings, Meta’s ad preferences, and the industry opt-out pages of the EDAA in Europe and the DAA in the United States.
7. Your rights
Depending on where you live, you have the right to:
- know whether we process your data and get a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to certain processing, including processing based on our legitimate interests;
- receive the data you gave us in a portable format;
- withdraw consent at any time, without affecting processing done before;
- claim compensation for damage caused by unlawful processing.
To use them, email info@getslova.com from the address linked to your account. We answer within 30 days and free of charge. You can also complain to a supervisory authority: in the EU the data protection authority of your country, in the UK the Information Commissioner’s Office, and in Türkiye the Personal Data Protection Authority.
If you live in the United States: some state laws, such as California’s, count using advertising cookies to measure or target ads as “sharing” personal information. We use the Google tag and the Meta Pixel for this on our home page and sign-up pages; you can opt out with the browser and ad settings in section 6. We do not sell personal information for money, and we do not knowingly share the personal information of anyone under 16.
8. Security
Data is encrypted in transit and at rest with our providers. Access to your learning data is limited to your own signed-in account and to us when it is needed to run or support the Service. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
9. Children
Slova is not intended for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has given us personal data, contact us and we will delete it.
10. Changes
We will post any update here with a new date. If a change significantly affects how we use your data, we will tell you by email or in the app before it applies.