Viglot Viglot
Get the App
← Back to home

Privacy Policy

Last updated: July 25, 2026

This privacy policy explains how Viglot ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our mobile application and website. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection law.

1. Data Controller

The controller responsible for data processing is:

Viktor Pergjoka
Kolonnenstr. 8
10827 Berlin, Germany
Email: info@viglot.com

2. What Data We Collect

2.1 Account Data

When you register, we collect:

Passwords are hashed by our authentication provider and are never stored by us in plain text.

2.2 Profile Data

To personalize your learning experience, we collect:

During registration, you may optionally provide additional personal details used to personalize AI-generated learning content. This data is provided with your consent and includes:

This personalization data is entirely optional. You may skip these steps during registration, and you can update or remove this information at any time through the app.

2.3 Learning Data

As you use the app, we collect data about your learning activity:

2.4 Conversation Data

When you use our conversation-based and speaking exercises:

2.5 Audio Data

During speech exercises and voice tasks, audio recordings of your speech are captured by your device and transmitted to Google's AI services for real-time transcription and pronunciation analysis. For pronunciation and short spoken-answer exercises, the audio passes through our servers in memory only (it is never written to disk or storage). For real-time voice conversation tasks, your microphone audio streams directly from your device to Google and does not pass through our servers at all. We do not permanently store your raw audio recordings. Audio is processed in real time and only the resulting transcriptions and scores are retained.

2.6 Device Data

2.7 Technical Data

2.8 In-App Usage Statistics

To understand how the app is used and to improve it, we collect pseudonymous usage events such as: which screens are opened, how long sessions last, which learning features are used, and whether sign-up or subscription flows complete. These events do not include your name, email address, payment details, or the content you type into the app.

Whether these statistics are collected is controlled by a toggle in Settings → App Settings. The default setting depends on the region indicated by the language you have chosen for the app interface:

For information about the processor and international transfers, see sections 4 and 5.

2.9 Push Notifications

We store a device-specific push notification identifier (provided by your operating system) alongside your account and your interface language so we can send review reminders and service-related messages to the correct device in your preferred language. The identifier is registered when you sign in, unless you have disabled push notifications in the app's Settings; whether notifications are actually displayed additionally depends on the notification permission you grant in your operating system. To deliver these messages, the identifier and message content pass through a third-party mobile-platform provider (based in the United States) whose push-relay service forwards them to Apple's and Google's push systems for delivery to your device; this provider also delivers over-the-air app updates. The identifier is rotated by your operating system from time to time; we delete it from our systems when you log out or disable push notifications in the app's Settings. If you uninstall the app, the identifier stops working, and in any case it is automatically deleted 180 days after the device was last seen (see section 5 for transfers and section 6 for retention).

The legal basis is contract performance (Art. 6(1)(b) GDPR) for service-related messages concerning your account or subscription, and our legitimate interest in reminding you of your scheduled reviews and supporting the learning progress you signed up for (Art. 6(1)(f) GDPR) for learning reminders. You can object to reminder notifications at any time (Art. 21 GDPR) by disabling push notifications in the app's Settings — which deletes the identifier from our systems — or in your device's operating system settings.

2.10 Website Data

Our website (viglot.com) uses only the data listed below. We do not use any advertising cookies, tracking pixels, social-media plugins, heatmap tools, or fingerprinting. All fonts and images on the website are served from our own hosting; no third-party font services or image delivery networks are loaded.

Hosting

The website is hosted by Google (Firebase Hosting). When you visit the site, your IP address is processed by Google, acting as our hosting provider, to deliver the pages and to ensure the security and stability of the service (server log data). The legal basis is our legitimate interest in the secure and efficient provision of the website (Art. 6(1)(f) GDPR). Our account-action pages (email verification and password reset) additionally load Google's Firebase authentication software, which is technically necessary to complete those actions (Art. 6(1)(b) GDPR). See section 5 for international transfers.

Strictly necessary storage (no consent required)

Analytics (only with your consent — Art. 6(1)(a) GDPR, § 25 TDDDG)

If — and only if — you click "Accept" on the cookie banner, we load Google Analytics 4 (GA4) to collect aggregated statistics about how visitors use the site (page views, referrer, approximate country derived from IP, device type). Until you consent, no Google Analytics script is requested from Google's servers, no GA cookies are set, and no data is sent to Google.

When consent is given, GA4 sets two first-party cookies:

We operate GA4 with Google Consent Mode v2 and with advertising features disabled: ad_storage, ad_user_data, and ad_personalization are always denied. No advertising cookies are set, no advertising pixels are used, and Google may not use the data for its own advertising purposes. Google LLC acts as our data processor; data may be transferred to the United States under the EU-US Data Privacy Framework (see section 5).

You can withdraw your consent at any time by clicking "Manage cookie preferences" in the footer of any page and selecting "Reject". This will stop further analytics collection in your browser. To delete previously stored GA cookies, clear your browser's cookies for viglot.com.

3. How and Why We Use Your Data

3.1 Providing the Service (Art. 6(1)(b) GDPR — Contract Performance)

We process your account, profile, learning, conversation, and audio data to:

3.2 Personalization Based on Consent (Art. 6(1)(a) GDPR — Consent)

The optional personal details you provide during registration (such as your interests, hobbies, occupations, and preferences) are processed based on your consent to personalize the topics, scenarios, and vocabulary in your AI-generated learning content. Some of these optional fields may reveal special categories of data within the meaning of Art. 9(1) GDPR (for example interests that allude to religious, political, or ethnic associations). Where you choose to provide such details, you give your explicit consent to their processing for this personalization purpose under Art. 9(2)(a) GDPR. Providing these details is entirely voluntary and the core learning service works without them.

You can withdraw your consent at any time by removing this data in the app settings. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. The core learning service continues to function without this personalization data.

3.3 Security and Abuse Prevention (Art. 6(1)(f) GDPR — Legitimate Interests)

We process device identifiers, IP addresses, and attestation tokens to:

We additionally screen the text you submit to our AI features for malicious instructions ("prompt injection") in order to keep those systems secure and functioning as intended.

Our legitimate interest is maintaining service security and preventing abuse. Device tracking is limited to a maximum of 1 active device per account and 2 accounts per device.

3.4 Crash and Error Diagnostics (Art. 6(1)(f) GDPR — Legitimate Interests)

We process the pseudonymous crash and error reports described in section 2.7 to detect, diagnose, and fix stability and security problems in the app. Our legitimate interest is keeping the app reliable and secure. The reports are tied only to an installation-scoped identifier, not to your account, and you can switch this off at any time via Settings → App Settings → Crash Reporting (Art. 21 GDPR right to object). For information about the processor and international transfers, see sections 4 and 5.

3.5 Trial Abuse Prevention (Art. 6(1)(f) GDPR — Legitimate Interests)

When you start a free premium trial, we record that a trial has been claimed on your device. This prevents a single device from repeatedly obtaining free trials by creating and deleting accounts.

What we process

The record contains neither of the identifiers themselves, nor any information that identifies you personally.

Legal basis. We process this data on the basis of our legitimate interest in preventing fraudulent abuse of our free trial offer (Art. 6(1)(f) GDPR, Recital 47). We have documented a balancing test which concluded that this processing does not override your fundamental rights and freedoms, because the data is pseudonymous, minimal, and retained for a limited period.

Retention. The record is automatically deleted 365 days after the trial was claimed.

Retention after account deletion. When you delete your Viglot account, we delete your personal data immediately. The trial-claim record is an exception: it is retained until the 365-day period ends, so that the trial cannot be re-claimed on the same device through repeated account creation. After this period, the record is deleted automatically. This retention is based on our overriding legitimate interest in fraud prevention: because the record remains necessary for that purpose, no obligation to erase it arises during the retention period (Art. 6(1)(f), Art. 17(1)(c), Art. 21(1) GDPR).

Your rights. The rights listed in section 7 apply. In particular:

4. Who We Share Data With

4.1 Cloud Infrastructure and AI Services

We use services provided by Google LLC as our primary cloud infrastructure and AI provider. Google acts as a data processor on our behalf for the following purposes:

Text prompts, audio recordings, and conversation data are sent to Google's services for processing. This AI processing takes place in Google data-center regions located in the European Union or the United States: we select the region for each feature in our service configuration and may change it from time to time (for example, for model availability, latency, or cost). You should therefore expect that some or all of this AI processing takes place in the United States at any given time. Google LLC is headquartered in the United States. International transfers are covered in section 5.

4.2 Additional AI Service Providers

We use additional third-party AI service providers (based in the United States) for image generation to create visual learning materials. These providers receive only the text prompts that describe the scene to be illustrated. They do not receive your account identifiers, conversation history, or audio recordings. Because a prompt can be derived from learning content you generated, it may occasionally reflect details you supplied; we minimise this and do not send direct identifiers. International transfers to these providers are covered in section 5.

4.3 Subscription and Purchase Management

We use a third-party subscription-management provider to verify and track your subscription and free-trial status across the Apple App Store and Google Play. This provider receives your pseudonymous account identifier, your entitlement status (whether you have an active subscription or trial), the purchase receipts and tokens issued by the app store, the product identifier, price, and currency of your purchase, and technical app and device information required to validate receipts. It does not receive your name, email address, or payment-card details. The actual payment is processed by the Apple App Store or Google Play, who act as the merchants of record and hold your billing details; we never receive or store your card data. This provider is based in the United States (see section 5).

4.4 No Sale of Data

We do not sell, rent, or trade your personal data to any third party. We do not share data with advertisers.

5. International Data Transfers

We store the core of your data — your account, profile, learning data, and generated media files — on cloud infrastructure located in the European Union. Our AI processing — text-content generation (exercises, explanations, and the evaluation of your practice exercises), speech transcription and pronunciation analysis, audio generation (text-to-speech), similarity search for cached content, and real-time voice conversation tasks, together with the associated text prompts, audio recordings, and conversation data — is performed by Google's Vertex AI in Google data-center regions located in the European Union or the United States. We select the region for each feature in our service configuration and may change it from time to time (for example, for model availability, latency, or cost); you should therefore expect that some or all of this AI processing takes place in the United States at any given time, under the safeguards set out below. In addition, a number of supporting services process data in the United States, including: authentication; crash and error diagnostics; device-integrity, configuration, and installation services; subscription and purchase management; push-notification delivery and over-the-air app updates; and image generation. Where any of these services process your data in, or route it to, the United States, your data is transferred there under the safeguards set out below.

For transfers to the United States we rely on the following safeguards (Art. 44 et seq. GDPR):

You can request a copy of the relevant safeguards by contacting us at info@viglot.com. For more information on the DPF, see the Data Privacy Framework website.

6. How Long We Store Your Data

When you delete your account, we delete your personal data from our systems: your profile, the courses, units, and scenarios you generated (including their voice and negotiation exercises), your conversation history, learning progress, placement test sessions, device records, push notification identifiers, and account-linked statistics. This deletion is carried out across several separate systems; in the rare event that a system is temporarily unavailable, any remaining records are removed by their automatic retention limits, so that no record is kept longer than the periods listed above. The one exception is the generated learning materials themselves — the individual practice phrases and the images and audio created for them — which are kept in a shared pool as educational content, de-identified and not linked to any user identifier, and reused across users. We rely on our legitimate interest (Art. 6(1)(f) GDPR) for retaining this de-identified content; where a generated phrase may still reflect optional personalization details you provided, we treat such residual data as covered by this retention.

The trial-claim hash described in section 3.5 is a separate exception: it is retained for up to 365 days after the trial was claimed even if you delete your account in the meantime, to prevent the trial from being re-claimed on the same device through repeated account creation. This retention is based on our overriding legitimate interest in fraud prevention (Art. 6(1)(f), Art. 17(1)(c), Art. 21(1) GDPR; see section 3.5).

7. Your Rights Under GDPR

As a data subject, you have the following rights:

To exercise any of these rights, contact us at info@viglot.com. We will respond within 30 days.

You also have the right to delete your account directly within the app (Settings → Delete Account), which initiates erasure of your personal data.

8. Right to Lodge a Complaint

If you believe that our processing of your personal data violates data protection law, you have the right to lodge a complaint with a supervisory authority. The competent authority for our location is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
10969 Berlin, Germany
www.datenschutz-berlin.de

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

10. AI and Automated Processing

Viglot uses artificial intelligence to generate learning content, evaluate pronunciation, and assess voice task performance. We want to be transparent about how AI processes your data:

These AI outputs are learning aids — they produce scores, feedback, and content recommendations to support your learning. They do not constitute automated decision-making that produces legal or similarly significant effects within the meaning of Art. 22 GDPR. Your profile data influences the topics generated but does not result in profiling that affects your access to the service or its features.

If you have concerns about any AI-generated evaluation or feedback, you can contact us at info@viglot.com to request a human review.

11. Children's Privacy

Viglot is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child under 16, please contact us at info@viglot.com and we will promptly delete the data.

12. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you through the app or by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

13. Contact

For any questions about this privacy policy or your personal data, contact us at:

Viktor Pergjoka
Kolonnenstr. 8
10827 Berlin, Germany
Email: info@viglot.com