Privacy Policy

Plain-language summary

This is a friendly recap, not a substitute for the full policy below. If anything here differs from a clause further down, the clause wins.

We are the data controller for your personal data and we take that responsibility seriously.
Three frameworks, strongest wins: UK GDPR, EU GDPR, and the Norwegian Personal Data Act — whichever gives you more protection applies.
We collect only what we need to run your account, teach you, take payment, and keep the service secure.
You are in control: access, correct, delete, export, restrict, or object — and withdraw consent at any time.
Payments go through Stripe; we never store full card numbers.

Questions or requests? Contact our privacy team — see section 8.

1. Data controller

The controller for personal data processed through Lingu English is Lingu Ltd (formerly Perfectly Spoken Ltd), registered in England and Wales under company number 09197891. Privacy contact: [email protected].

2. Applicable frameworks

This policy is written English-first for a global audience and applies the requirements of all of the following, whichever gives you the stronger protection:

UK GDPR and the Data Protection Act 2018 (UK users).
EU GDPR, Regulation (EU) 2016/679 (EU/EEA users).
The Norwegian Personal Data Act (personopplysningsloven), for users of lingu.no and Norwegian residents.

3. What we collect and why

Account data — name, email, country, password hash — to create and secure your account.
Learning data — placement results, progress, attendance, writing submissions, AI practice recordings — to deliver and personalise teaching.
Payment data — handled by Stripe; we store a token and billing metadata, not full card numbers.
Usage and device data — subject to the Cookie Policy and your consent.

4. Lawful bases

We rely on performance of a contract (delivering your plan), legal obligation (tax, accounting), legitimate interests (service security and product improvement, balanced against your rights), and consent (non-essential cookies, optional marketing). Under legal review — per-purpose lawful-basis table.

5. Your rights

You have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interests or for direct marketing. You may withdraw consent at any time without affecting prior processing. To exercise any right, contact [email protected]. You may also lodge a complaint with a supervisory authority — the ICO (UK), Datatilsynet (Norway), or your local EU/EEA authority.

6. International transfers

Where personal data is transferred outside the UK/EEA we rely on adequacy decisions or appropriate safeguards such as Standard Contractual Clauses with supplementary measures. Sub-processor list and transfer mechanisms: Under legal review — sub-processor and transfer register.

7. Retention

We keep personal data only as long as necessary for the purpose it was collected or as required by law (for example, accounting records). Specific retention periods: Under legal review — retention schedule.

8. Contact

Lingu Ltd
29a Crown Street, Brentwood, Essex, CM14 4BA, United Kingdom
Company number: 09197891 (England and Wales)
Privacy contact: [email protected]
See also the Legal & compliance centre, the Cookie Policy, the Data Processing Agreement, and the Terms of Service.

Plain-language summary

This is a friendly recap, not a substitute for the full policy below. If anything here differs from a clause further down, the clause wins.

We are the data controller for your personal data and we take that responsibility seriously.
Three frameworks, strongest wins: UK GDPR, EU GDPR, and the Norwegian Personal Data Act — whichever gives you more protection applies.
We collect only what we need to run your account, teach you, take payment, and keep the service secure.
You are in control: access, correct, delete, export, restrict, or object — and withdraw consent at any time.
Payments go through Stripe; we never store full card numbers.

Questions or requests? Contact our privacy team — see section 8.

2. Applicable frameworks

This policy is written English-first for a global audience and applies the requirements of all of the following, whichever gives you the stronger protection:

UK GDPR and the Data Protection Act 2018 (UK users).

EU GDPR, Regulation (EU) 2016/679 (EU/EEA users).

The Norwegian Personal Data Act (personopplysningsloven), for users of lingu.no and Norwegian residents.

3. What we collect and why

Account data — name, email, country, password hash — to create and secure your account.

Learning data — placement results, progress, attendance, writing submissions, AI practice recordings — to deliver and personalise teaching.

Payment data — handled by Stripe; we store a token and billing metadata, not full card numbers.

Usage and device data — subject to the Cookie Policy and your consent.

4. Lawful bases

5. Your rights