Effective date: 7 September 2026

This Privacy Policy explains how Govori collects, uses, shares, and protects your personal data when you use the Govori language-learning application and related websites (together, the Service). It also explains the rights you have over your data under the EU General Data Protection Regulation (GDPR) and Slovenian data-protection law.

1. Who we are

The controller responsible for your personal data is:

GOVORI d.o.o.
Reginčeva ulica 8, 4000 Kranj, Slovenia

For any privacy question or to exercise your rights, contact us at support@govori.app.

2. The data we collect

We collect only the data we need to provide a personalised language course and to keep the Service working. The categories below reflect what the application actually stores.

Account data

• Your email address, first name, last name, and display name.
• Your authentication details, handled by our authentication provider. When you register with an email and password, the password is stored by that provider in hashed form and is never visible to us. Where a third-party sign-in option is offered, we receive only the basic identifiers that option returns.
• Your preferences, such as your native language, interface language, audio and voice settings, chosen session length, the grammatical forms you prefer for talking about yourself, your light or dark theme choice, and your time zone.
• Your subscription status. Paid tiers are not offered yet; where a payment identifier field exists it is unused until paid plans launch.

Learning data

• Your course selections, chosen topics and interests, and your current position in the curriculum.
• Your progress and mastery records, including how many attempts you made at each concept, which answers were correct, the specific errors you made, and an estimate of your proficiency. This is what lets the Service adapt to you.
• Records of your study sessions, including timing, the steps and concepts you covered, and summaries of what you practised.
• Your answers to placement questions and whether each was correct.
• The calendar days on which you practised, used to show your practice streak.
• Any vocabulary you flag and any problem reports you submit through the app.

Conversation-practice data

• When you use conversation practice, the text of your side of the conversation is processed to generate replies and feedback. A transcript is held only temporarily so the Service can produce your practice summary and progress measures. Once that analysis is complete, the raw transcript is purged and only the summary, the aggregate measures (such as accuracy, words used, and how many turns you took in the target language), and per-turn feedback notes are kept as your durable progress record.

Technical and analytics data

• Product-analytics and session-replay data collected through our analytics provider (for example, pages viewed and in-app actions). Text you type into answer and input fields is masked before it is recorded.
• Error and diagnostic data collected through our error-monitoring provider when something goes wrong, so we can fix it. This is configured not to include user-identifying personal data by default.
• Internal product signals we record about how the teaching pipeline behaved during your sessions, used to detect and fix problems.

3. How we use your data, and our lawful bases

4. Who we share your data with

We do not sell your personal data. We share it only with the service providers (processors) that help us run the Service, each acting under a data-processing agreement and only on our instructions. These are:

We may also disclose data where required by law, or to protect our rights, users, or the Service.

5. International transfers

Your account, preferences, and learning data are stored in the European Union. Our database and authentication provider, Supabase, hosts this data on Amazon Web Services in the eu-west-1 region (Ireland); this applies to both our production and staging environments. Mistral AI is also based in the European Union.

Where any provider stores or processes personal data outside the European Economic Area (EEA), that transfer relies on appropriate safeguards under the GDPR, namely the European Commission's Standard Contractual Clauses or an adequacy decision covering the destination country. In particular, our analytics provider, PostHog, processes data on infrastructure in the United States; that transfer is covered by Standard Contractual Clauses, and this analytics and session-replay collection takes place only with your consent.

6. How long we keep your data

We keep your account and learning data for as long as your account is active. Raw conversation transcripts are held only until your practice summary and measures have been produced, then purged. Internal informational product signals are deleted automatically after 180 days.

You can ask us to delete your account and personal data at any time by contacting support@govori.app. When you do, we will permanently delete your personal data within 30 days, except anything we are required by law to retain.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• restrict how we process your data;
• receive your data in a portable, machine-readable format (portability);
• object to processing based on our legitimate interests;
• withdraw any consent you have given, at any time, without affecting processing that already took place.

To exercise any of these rights, email support@govori.app. You also have the right to lodge a complaint with the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblaščenec), www.ip-rs.si.

8. Children

The Service is not directed to children. You must be at least 16 years old to create an account and use the Service. If we learn that we have collected personal data from a child below this age without appropriate consent, we will delete it.

9. How we protect your data

Access to your data is restricted so that you can read and change only your own records, enforced at the database level. Data is transmitted over encrypted connections. We limit who and what can access personal data to what is needed to run the Service.

10. Changes to this policy

We may update this policy as the Service evolves. When we make a material change, we will update the effective date above and, where appropriate, notify you in the app. Please review this page from time to time.