Privacy Policy

1. Who is responsible for your data

ClevroLab is an educational project run by a private individual, Denys (contact: clevrolab@gmail.com), who is the controller of your personal data within the meaning of the EU General Data Protection Regulation (GDPR).

For any questions about your data, write to clevrolab@gmail.com. No data protection officer (DPO) has been appointed: the law does not require one for a project of this size.

2. What data we process

• Account data: email; your password, which we store only as a cryptographic hash, never in plain text; nickname (display name), avatar and profile description, if you added them; the date and version of the Terms of Use and of this policy that you accepted. When you sign in with Google, Google gives us your email, name, profile photo and Google account ID.
• Learning data: saved words and collections, answers in exercises and tests, English level, goals and daily plan, XP, day streaks, achievements, dates and hours of activity.
• Telegram (only if you connected the bot): your Telegram ID, reminder settings, a log of reminders sent and of clicks on them.
• Material you add: texts, links and PDF files in “Learn from Anything”, the text of pages we fetch from your links, as well as feedback, survey answers and messages to support.
• Browser extension (if you installed it): the ID, title and duration of YouTube videos, but only those on which you use the extension panel; words and subtitle lines that the extension sends for translation and analysis; for a saved word, the sentence it came from and the moment in the video; video session statistics; actions on the word review screen (opening it, changing filters, saving words, a survey being shown and your answers) and feedback you write in the extension. The extension works only on youtube.com and clevrolab.com. To save words to your account, it uses your sign-in on the website and keeps your sign-in token, your account name, email and avatar, and panel settings in the extension’s storage. Data from the extension goes only to the ClevroLab server (api.clevrolab.com).
• Technical data: IP address, browser and device type, time and addresses of requests (server logs of our hosting providers); how you signed up (email, Google or Telegram); service usage events linked to your account, such as “onboarding completed”.
• Microphone (shadowing): the recording of your voice stays in your browser and is not sent to us. Speech recognition, where available, is done by the browser itself; in Google Chrome the audio for it is processed by Google.

We do not collect payment data. We do not ask for and do not knowingly collect special categories of data (about health, religious or political beliefs, etc.). Please do not include them in texts you upload.

3. Why and on what legal basis

• Your account, saving progress, learning features, emails with a code to set or reset your password: performance of our contract with you, that is, our Terms of Use (Art. 6(1)(b) GDPR).
• Telegram reminders: your consent (Art. 6(1)(a)). You turn them on when you connect the bot and can turn them off at any time.
• Leaderboard: your nickname, avatar, level and XP are visible to other users and site visitors. Basis: our legitimate interest in a competitive element of learning (Art. 6(1)(f)). See the “Leaderboard” section below for details.
• Security, rate limiting, preventing abuse: legitimate interest (Art. 6(1)(f)).
• Improving the service using de-identified statistics (cookieless Vercel Web Analytics, internal activity counters): legitimate interest (Art. 6(1)(f)). You can object by writing to us.
• Attribution (UTM tags and the site you came from) and PostHog product analytics: only with your consent in the cookie banner (Art. 6(1)(a)). You can withdraw consent at any time.
• Browser extension: translation and level of words from subtitles, saving a word together with its sentence and the moment in the video (so you can later watch it in context), video statistics on the website, signing in to your account with the token, your name and avatar in the extension window so you can see who is signed in: performance of the contract (Art. 6(1)(b)). Actions on the word review screen: legitimate interest in improving this feature (Art. 6(1)(f)). We do not track keystrokes or any activity outside the extension’s interface.
• Feedback and surveys: legitimate interest in improving the service. Participation is voluntary.
• Complying with legal obligations and defending legal claims: Art. 6(1)(c) and 6(1)(f).

We do not sell your data, do not share it with advertisers and do not show ads.

The service automatically estimates your level and selects words, exercises and a plan for you. These recommendations have no legal or similarly significant effects on you (Art. 22 GDPR).

4. Leaderboard

The leaderboard shows your nickname and points (XP), as well as your avatar and English level. It is visible to other users and site visitors.

By default, if you sign in with Google, your nickname is taken from the name in your Google account. For new accounts it is your first name and the first letter of your surname, for example “Olena K.”. You can change your nickname or remove your avatar at any time in your profile.

Basis: our legitimate interest in a competitive element of learning (Art. 6(1)(f) GDPR).

5. Who else receives data

We use the following providers. Hosting providers process data on our behalf under their data processing agreements.

• Vercel Inc. (USA): website hosting and Vercel Web Analytics.
• Railway Corporation (USA): server and database hosting.
• Cloudinary: storage of uploaded avatars.
• Google: Google sign-in; sending emails via Gmail; thumbnails of YouTube videos in your dictionary, loaded from img.youtube.com (Google receives your IP address when they load); speech recognition in Chrome.
• Telegram: delivering the bot’s messages. Telegram processes your Telegram account data on its own, under its own policy.
• PostHog Inc. (USA): product analytics, only with your consent. It is currently turned off. If we turn it on, PostHog will receive your actions on the site and your email, to link events to your account.
• Websites you link to in “Learn from Anything”: our server fetches the page on its own behalf; these sites do not receive your IP address.
• Public authorities: only where the law requires it.

Links to YouTube, Telegram, TikTok and Instagram lead to third-party sites with their own privacy rules. We do not embed their players or widgets on our pages.

6. Transfers outside the EEA

Some providers are located in the USA or process data there. Such transfers rely on the European Commission’s adequacy decision for companies certified under the EU-U.S. Data Privacy Framework, or on the standard contractual clauses (SCCs) included in the providers’ data processing agreements.

7. How long we keep data

• Account and learning data: for as long as the account exists.
• After a deletion request: we delete the account and the data linked to it within 30 days. Residual copies in hosting backups are overwritten in the normal course.
• Server logs: for the period set by the hosting provider.
• Support correspondence, feedback: no longer than needed to reply to you and improve the service.
• Inactive accounts: if you do not sign in for 3 years, we may delete the account after emailing you first.
• Attribution in the browser: until you close the tab.

8. Your rights

You have the right to: get a copy of your data; correct inaccurate data; request erasure; restrict processing; receive your data in a machine-readable format (portability); object to processing based on legitimate interest; withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before it.

Some data can be changed in your profile. For everything else, including deleting your account, write to clevrolab@gmail.com from the address linked to your account. We will reply within one month. In complex cases this period can be extended by two more months, and we will let you know. We may ask you to confirm that the account is yours.

You can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place. Users from Ukraine can also contact the Ukrainian Parliament Commissioner for Human Rights. But please write to us first at clevrolab@gmail.com: we will try to resolve the issue.

9. Security

Data is transmitted only over HTTPS. Passwords are stored only as a hash. Access to the database is restricted, and the rate of requests to the server is limited. No protection is 100% guaranteed. If a breach occurs that puts your rights at risk, we will notify the competent supervisory authority and, where the law requires it, you.

10. Age

ClevroLab is intended for people aged 16 and over. If you are younger, do not create an account. If you learn that a child under 16 has created an account, write to us and we will delete it.

11. Cookies

Which cookies and browser storage we use, and how to change your choice, is described in the Cookie Policy.

12. Changes to this policy

We will notify you of material changes on the website or by email before they take effect. The effective date of the current version is shown at the top of the page.