1. Introduction
Flubi operates a WhatsApp-first language learning beta. This policy explains how we collect, use, and protect information when you join the waitlist, activate a beta invite, and learn through WhatsApp. For GDPR purposes, Flubi is the controller for the beta account, waitlist, learning, support, and operational data described below.
2. Information We Collect
- Waitlist email: used for beta invites and important beta updates.
- WhatsApp phone number: used as your learning account identity after activation.
- Invite and attribution data: invite codes, start links, signup source, and conversion status.
- WhatsApp interactions: messages, button/list selections, message IDs, and account/support requests needed to operate the service.
- Learning progress: level, lessons, quizzes, streaks, reminders, feedback prompts, and dialog-practice progress.
- Voice and audio data: voice messages may be processed for transcription or pronunciation features. Generated lesson audio URLs are stored so WhatsApp can play lessons.
- Operational data: logs, masked identifiers, metrics, audit events, errors, security signals, and correlation IDs.
3. How We Use Information
- To provide WhatsApp lessons, quizzes, reminders, dialog practice, and progress summaries.
- To manage beta access, waitlist invitations, onboarding, account requests, and support.
- To generate, store, deliver, and improve language-learning scripts and audio lessons.
- To protect the service, prevent abuse, troubleshoot failures, and maintain audit records.
4. Legal Bases for Processing
Where GDPR applies, we rely on the following legal bases depending on the activity:
- Contract or pre-contract steps: waitlist signup, beta invite activation, account creation, lessons, quizzes, reminders, progress, and support needed to provide the beta service you request.
- Consent: optional beta participation acceptance, optional voice/audio transcription or pronunciation features when enabled, and optional communications where consent is required.
- Legitimate interests: service security, abuse prevention, debugging, reliability monitoring, audit logs, and product reliability analysis, balanced against your privacy rights.
- Legal obligation: records we must keep or actions we must take to comply with applicable law.
5. Service Providers
We do not sell your personal information. We may use providers for:
- WhatsApp messaging through Meta/WhatsApp.
- Email delivery for waitlist and beta invite messages.
- Hosting, database, object storage, CDN, backups, observability, and alerting.
- AI, speech, and TTS features such as script generation, voice transcription, pronunciation assessment, conversation assistance, and generated lesson audio.
- Payment infrastructure may remain configured for future use, but the beta is free and does not require checkout or a subscription.
6. International Transfers
Some providers may process data outside your country or outside the European Economic Area. Where GDPR applies, we aim to use appropriate transfer safeguards such as adequacy decisions, standard contractual clauses, or equivalent contractual and technical measures provided by our processors.
7. Voice and Audio
User voice messages and generated lesson audio are different. User voice messages may be fetched from WhatsApp and sent to speech providers when voice features are enabled. Generated lesson and dialog audio is educational content stored in object storage and may be served through public or CDN URLs so WhatsApp can play it.
8. Security and Retention
We use security controls such as HTTPS, webhook signature validation in non-local environments, admin authentication, CSRF protection for admin actions, production secret checks, masked logging where available, and privacy-safe operational metrics. We keep beta data only as long as needed to provide and operate the service, handle requests, comply with obligations, and protect the beta. We review or delete data when it is no longer needed for those purposes.
9. Your Choices and Requests
You can request access, export, correction, deletion, restriction/object where applicable, reminder pause/resume, progress reset, or support through WhatsApp where available or by contacting us.
During beta, some export and deletion requests may be fulfilled with admin assistance rather than fully automated tooling.
If you are in the EU/EEA, you may also have the right to lodge a complaint with your local data protection authority.
10. Children's Privacy
Flubi is not intended for children under 16 in the EU/EEA or under 13 elsewhere. If local law requires a higher minimum age, that higher age applies. We do not knowingly collect information from children below the applicable minimum age.
11. Contact Us
Questions or privacy requests: privacy@flubi.app