Privacy Policy
Last updated: 5 September 2026
Who we are
Vocatua is operated by Gleb Loumer, an individual entrepreneur (trabalhador independente) based in Marmelete, Portugal (NIF 312883013). For any question about this policy or your data, contact hello@vocatua.com.
What we collect
Account data: email address, and preferences you set (interface language, translation language, learning target language, theme, timezone).
Learning data: your CEFR level and progress, the topics you choose to read about, the lessons generated for you, the words you flag while reading, your translations, review history, and streak/statistics.
Usage data: basic technical logs of core actions (e.g. lesson generated, word reviewed) used to operate and improve the service. We do not use this data to build public analytics or ad profiles.
Cookies: strictly necessary cookies to keep you signed in, and — only with your consent — analytics cookies to help us understand how the app is used. See “Cookies” below.
Learning reminder emails: if you haven't practiced in a while, we may send you a reminder email related to your own learning activity (e.g. a streak or a review that's due). These are operational to the service you've signed up for, not third-party marketing — we don't send promotional content through this channel. You can opt out or ask us to change the frequency at any time by contacting hello@vocatua.com.
Why we process it, and on what legal basis
We process account and learning data because it's necessary to provide the service you've signed up for (GDPR Art. 6(1)(b), performance of a contract). Where we use optional cookies, we rely on your consent (Art. 6(1)(a)), which you can withdraw at any time in Settings → Legal & Privacy.
Who we share it with
We use the following processors to run Vocatua. None of them are permitted to use your data for their own purposes.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, hosting | Data stored in the EU region |
| Vercel | Application hosting | Frankfurt (fra1), EU region |
| Google (Gemini API, paid tier) | Lesson text and translation generation | Global (Google's infrastructure) |
| Google Cloud Text-to-Speech (paid tier) | Audio generation | Global (Google's infrastructure) |
| Resend | Transactional and service emails (e.g. account confirmation, learning reminders) | United States (SCCs + EU-US Data Privacy Framework) |
Content sent to Google (topic text for lesson generation, AI-generated text for audio and translation, and words you tap to translate) does not include your name, email, or account identifiers.
We're on the paid tier of Google's Gemini API and Google Cloud Text-to-Speech, which means content you send is not used to train Google's models. Google may retain some content briefly for abuse and policy-violation monitoring, separate from training — this is standard across paid API providers, not something specific to Vocatua.
We do not sell your data, and we do not share it with advertisers.
International transfers
Storing data in an EU region is a technical setting, not by itself a complete answer to where your data legally may go — so here's the fuller picture. Supabase and Google are not EU-based companies, so our use of them is an international transfer under GDPR regardless of which region we select for storage. This is covered through each provider's Data Processing Agreement, which incorporates Standard Contractual Clauses approved by the European Commission as the legal safeguard for the transfer.
How long we keep your data
We keep your data for as long as your account is active. If you delete your account, we mark it for deletion immediately and permanently remove your personal data within 30 days, except where we're required to keep limited records for legal or accounting reasons.
Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your data
- Export your data in a portable format
- Object to or restrict certain processing
- Withdraw consent at any time, without affecting past processing
To exercise any of these rights, contact hello@vocatua.com. We'll respond within one month. You also have the right to lodge a complaint with Portugal's data protection authority, the CNPD (www.cnpd.pt).
Children
Vocatua is not directed at children under 13. In line with Portuguese law (Lei 58/2019), we don't knowingly collect data from anyone under 13.
Security
Your data is stored in the EU and transmitted over encrypted connections. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data.
Changes to this policy
If we make material changes to this policy, we'll notify you in the app before they take effect.