AISimilate

This Privacy Policy covers the AISimilate public web app, account creation, sign-in, password recovery, adaptive lessons, vocabulary tools, learner reports, support communications, and related security operations.

1. Controller and scope

AISimilate is operated by s4p OÜ (Reg: 17415128, VAT: EE102945199), registered at Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145. For privacy requests, complaints, or formal data-protection inquiries, contact support@s4p.eu.

For ordinary direct-use accounts, AISimilate acts as the data controller because it determines the purposes and means of processing for account administration, learning delivery, support, and security. If AISimilate is later offered through a separately negotiated institutional or enterprise arrangement, a specific contract or data-processing agreement may define a different role for certain processing activities.

2. Categories of personal data

Identity and account data, such as email address, hashed password, verification status, user role, and account lifecycle metadata.
Sign-in and device-security data, such as session identifiers, refresh-session records, sign-in timestamps, IP and user-agent metadata, abuse indicators, audit timestamps, and browser-side session-persistence choices such as whether you asked AISimilate to remember the device.
Profile and learning-preference data, such as declared level, native language, target language, daily goals, feedback settings, and exercise preferences.
Learning activity data, such as lesson answers, quiz responses, timing, bookmarks, flashcard states, translations, progress scores, readiness metrics, and learner reports.
Imported learning-source data, such as pasted text, public source URLs, extracted source excerpts, generated study guides, vocabulary sets, and lessons created from imported material.
Speaking-practice data, such as submitted transcripts, browser or device speech-confidence signals, timing, and speaking-match evaluation metadata. AISimilate does not require permanent storage of raw learner audio for the current speaking-practice flow.
Reminder, share, and export data, such as reminder cadence and time, browser push-subscription records, notification-delivery metadata, report-export requests, time-limited share-link scopes, and link revocation state.
AI-related content and metadata, such as prompts, lesson-generation input, coaching requests, generated content, token usage, latency, and failure or abuse signals needed to operate the feature.
Support and communications data, such as emails, help requests, and related troubleshooting notes.
If you choose Google sign-in, Google account identity claims needed to authenticate you, such as your email address, Google subject identifier, and email-verification status.
If you accept optional analytics, Google Analytics website usage data, such as page paths, referrers, browser and device details, approximate geography, analytics client identifiers, and related event metadata.

3. Sources of personal data

Directly from you when you create an account, sign in, edit your profile, submit learning answers, or contact support.
Automatically from your browser and device when sessions are created, requests are sent, abuse controls run, or preferences are stored.
From Google, if you choose Google sign-in and Google returns authentication claims needed to identify your account.
From AISimilate service activity and internal inferences generated from your learning interactions, progress, and settings.

4. Purposes and GDPR legal bases

Contract performance, GDPR Article 6(1)(b): account creation, authentication, lesson delivery, vocabulary practice, progress tracking, and service support.
Legitimate interests, GDPR Article 6(1)(f): platform security, fraud and abuse prevention, debugging, service resilience, rate limiting, and defending legal claims.
Legal obligations, GDPR Article 6(1)(c): statutory retention, lawful requests from authorities, and compliance obligations that apply to the operator.
Consent, GDPR Article 6(1)(a): optional analytics or similar tracking when you accept Google Analytics in the relevant browser context.

AISimilate does not rely on consent for technologies that are strictly necessary to keep your session active, protect the platform, or store your cookie-notice acknowledgement.

5. AI features and human review

AISimilate uses AI-assisted generation for certain learning and coaching features. To deliver those features, requests may be processed through AISimilate-managed infrastructure and external AI model or API providers selected by the operator. Operational records can include provider, model, token usage, latency, and failure state where that information is generated and needed to operate, secure, and improve the service.

AISimilate processes learner prompts and outputs to deliver the requested feature. Where reasonably necessary, related records may also be reviewed for quality assurance, service reliability, safety checks, abuse prevention, and legal compliance. Human review remains necessary before using outputs in high-impact contexts.

If you import source material, AISimilate may process the submitted text or fetched page content to extract vocabulary, summaries, and lesson assets. If you use speaking practice, AISimilate processes the submitted transcript and speaking-match metadata for feedback, but the current product flow is designed so that raw learner audio does not need to remain stored as a long-term account record.

6. Processors, recipients, and international transfers

We do not sell personal data. We disclose personal data only where reasonably necessary to run AISimilate, provide requested features, comply with law, or protect rights and safety.

Hosting, infrastructure, database, and security providers.
Transactional email providers used for verification and password recovery.
AI model or API providers needed for lesson and coaching features.
Google, if you choose Google sign-in.
Google Analytics, if you accept optional analytics.
Professional advisers, insurers, auditors, or authorities where legally required.

Some providers may process data outside the EEA, including in the United States. Where that happens, AISimilate relies on applicable GDPR Chapter V safeguards such as adequacy decisions, Standard Contractual Clauses, or comparable supplementary measures where required.

7. Retention and deletion

Account and profile data: retained while the account is active and for a limited post-closure period needed for restoration requests, fraud review, disputes, and limitation periods.
Authentication and security records: typically retained for short to medium operational windows, often between 30 and 180 days, unless a longer period is required for active incidents, abuse review, or legal defense.
Learning history and generated lesson records: retained while your account is active and for a limited period afterward where needed for continuity, recovery, or dispute handling.
Imported learning sources and derived study assets: retained while the related account and import remain active, or until you delete the imported source, subject to short operational and backup windows.
Speaking-practice transcripts and evaluation records: retained as part of learning history where needed to show progress and recent speaking attempts, while raw learner audio is not retained as a required long-term artifact for the current feature.
Notification preferences, browser push subscriptions, report-export requests, and report-share links: retained until revoked, expired, or no longer operationally necessary.
Support records: typically retained for up to 24 months after the issue is resolved unless a longer period is justified.
Cookie-notice acknowledgement and other browser-side preference records: stored in your browser until you clear or replace them.
Google Analytics cookies, if accepted: stored according to the Google Analytics cookie configuration, with default GA4 expiration of up to 2 years unless cleared sooner.

Deletion may be delayed where data is subject to legal hold, unresolved security review, fraud investigation, or backup-cycle constraints. When retention is no longer justified, data is deleted or anonymized where reasonably feasible.

You can request deletion from inside the Android app under Settings or from the public deletion page at /delete-account. A successful deletion request removes the active account, learner profile, lessons, progress, vocabulary state, and active sessions from the live service.

8. Your rights

Subject to GDPR conditions and applicable exemptions, you may request access, rectification, erasure, restriction, objection, portability, and withdrawal of consent for consent-based processing.

We may request reasonable identity verification before disclosing or deleting data. Requests should be sent to support@s4p.eu. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon). Requests are handled within applicable legal time limits, subject to identity verification and any lawful exemption.

9. Security and confidentiality

Transport encryption in deployed environments, together with authentication controls.
Server-side session records, refresh-token rotation, and access controls.
Logging, monitoring, rate limiting, and abuse-detection workflows.
Role-based access and need-to-know restrictions for operational access.
Backups and recovery procedures intended to reduce integrity and availability risks.

The current web client keeps sign-in continuity in browser session storage by default. If you explicitly choose to keep the device signed in, AISimilate will additionally store sign-in data in browser local storage until sign-out, expiry, or manual clearing. You should avoid enabling remembered-device sign-in on shared or untrusted devices.

10. Children, sensitive data, and high-risk use

AISimilate is not intended for unlawful use by children who cannot validly use the service under applicable law. Do not submit special-category data, medical data, legal files, government identifiers, passwords belonging to others, payment card data, or other highly sensitive third-party data unless you have a documented lawful basis and a workflow explicitly intended for it.

AI outputs may be incomplete or inaccurate. Human review remains required before relying on the service in legal, HR, medical, financial, credit, safety, or similarly high-stakes contexts.

11. Automated decision-making

AISimilate personalizes lessons, sequencing, support depth, and related learning flows using account settings, activity history, and progress signals. In the ordinary course of the public web app, AISimilate does not use solely automated decision-making that produces legal effects or similarly significant effects on you within the meaning of GDPR Article 22.

12. Contact and changes

Privacy contact: support@s4p.eu

We may update this policy when AISimilate, its subprocessors, legal requirements, or security controls change. Material changes are reflected on this page with a revised date.

Legal entity: s4p OÜ | Reg: 17415128 | VAT: EE102945199

This policy is written to explain AISimilate data practices transparently. It is not legal advice for third parties or their independent compliance obligations.