1. Introduction

This Privacy Policy explains how personal data is collected, used, disclosed, transferred, retained and deleted when you use the LatinBox mobile application (Google Play package name com.tommy.italian), our website, and any related services (together, the "App" or the "Service").

The App is available to users worldwide. This Policy is written to meet the requirements of, among others, the EU and UK General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP), the California Consumer Privacy Act as amended by the CPRA, other U.S. state privacy laws, Brazil's LGPD, Canada's PIPEDA, the Australian Privacy Act, and the Israeli Protection of Privacy Law, 5741-1981. Section 12 sets out additional rights that apply depending on where you live.

The data controller (in some jurisdictions, "business" or "data fiduciary") responsible for your personal data is:

EEA / UK representative under GDPR Article 27: [name and address of your appointed representative, if you have one].

If you do not agree with this Policy, please do not use the App.

2. The personal data we collect

2.1 Data you provide to us

• Account data: first and last name, email address, phone number, a hashed password, and a profile picture if you choose to upload one.
• Learning profile: the language you are studying, your self-declared level, your goals and your learning preferences.
• Content you create: exercise answers, test results, notes, and questions you submit to teachers or to support.
• Communications: the content of emails, chat messages, calls and contact-form submissions, including any information you choose to include.
• Transaction data: purchase records, subscription type and status, purchase dates, and invoices. We do not collect or store full payment card numbers. Payments are processed by the third-party processors listed in Section 6.

2.2 Data collected automatically

• App activity: lessons viewed, exercises completed, scores and progress, session duration and frequency, screens and features used.
• Device and technical data: device model and manufacturer, operating system and version, device language, time zone, screen resolution, app version, network carrier and connection type.
• Identifiers: an internal user ID, an app installation ID, and the Google Advertising ID (remove the advertising ID if the App contains no advertising or ad-attribution SDK).
• IP address and the approximate location derived from it (country, region or city level) for security, fraud prevention, pricing and content localisation. We do not collect precise GPS location.
• Diagnostics: crash logs, error reports, and performance and stability metrics.
• Push notification tokens, where you have enabled notifications.

2.3 Data from third parties

• Sign-in providers: if you register using Google or Apple sign-in, we receive your name, email address and a provider user ID. We do not receive your password. (Delete if third-party sign-in is not offered.)
• App stores and payment providers: confirmation of purchases, subscription status, refunds and chargebacks.

2.4 Device permissions

The App may request the permissions below. You can decline or revoke any of them in your device settings; some features may then be unavailable.

• Storage / media files – to download lessons for offline use and to upload a profile picture.
• Microphone – for pronunciation and speaking exercises. Recordings are used only to provide and improve that feature and are not used for advertising. (Delete if the App has no speaking exercises.)
• Notifications – for study reminders and service updates.

We do not access your precise location, contacts, calendar, SMS messages, call logs, photos beyond those you explicitly select, or the list of apps installed on your device.

2.5 Sensitive data

We do not intentionally collect special categories of personal data (such as health, biometric, racial or ethnic origin, religious beliefs, political opinions or sexual orientation). Voice recordings, where used, are processed only for speech-practice feedback and are not used to identify you biometrically. Please do not include sensitive information in free-text fields or support messages.

3. How and why we use your data

Where we rely on legitimate interests, we have assessed that our interest in operating, securing and improving the Service is not overridden by your rights and freedoms. You may object to this processing as described in Section 11.

4. Cookies, SDKs and similar technologies

Our website uses cookies and local storage, and the App uses software development kits (SDKs) that perform similar functions. We use them to keep you signed in, remember your preferences, measure how the Service is used, diagnose faults, and — where applicable — measure marketing performance.

Where required by law, we ask for your consent before setting non-essential cookies or activating non-essential SDKs, and you may withdraw that consent at any time. You can also clear or block cookies in your browser, and reset or limit ad tracking through your device's operating system settings. Blocking these technologies may affect how the Service functions.

5. Automated decision-making

We use automated logic to adapt lesson difficulty and recommend content based on your progress. This does not produce legal effects concerning you or similarly significantly affect you, and we do not carry out profiling for that purpose. We do not make automated decisions about pricing eligibility, account termination or credit.

6. How we share your data

We share personal data only as described below, and we require every service provider to process it solely on our documented instructions, under written contracts including GDPR Article 28 terms where applicable.

6.1 We do not sell your data

We do not sell personal data for money, and we do not share personal data for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA and comparable U.S. state laws. We have not sold or shared personal data in the preceding twelve months, and we do not knowingly sell or share the personal data of anyone under 16.

7. International data transfers

We are established in Israel, and our service providers operate data centres in a number of countries, including the United States and within the European Union. Your personal data will therefore be transferred to, and processed in, countries other than your own, where data-protection laws may differ from those in your jurisdiction.

For transfers from the EEA, the United Kingdom or Switzerland, we rely on one or more of the following safeguards: the European Commission's adequacy decision covering Israel; the EU Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss addendum where relevant; supplementary technical measures such as encryption in transit and at rest; and, where applicable, derogations under Article 49 of the GDPR. For transfers from other jurisdictions we apply equivalent contractual and technical safeguards, including the Israeli Privacy Protection Regulations (Transfer of Data Abroad), 5761-2001.

You may request a copy of the relevant safeguards by emailing info@latinbox.io.

8. Retention

When a retention period ends, we delete the data or irreversibly anonymise it.

9. Security

We maintain technical and organisational measures appropriate to the risk, including encryption in transit using TLS/HTTPS, encryption at rest with our cloud providers, one-way hashing of passwords, role-based access controls limiting staff and processor access to what is necessary, periodic backups, logging and monitoring of security events, and vendor due diligence. No internet or storage system is completely secure, and we cannot guarantee absolute security. If a personal data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority and affected users as required by applicable law.

10. Children

The App is not directed to children under 13, and we do not knowingly collect personal data from them. In the EEA, where the digital age of consent is between 13 and 16 depending on the member state, users below the applicable age may use the Service only with the consent of a holder of parental responsibility. Users under 18 should use the Service and make purchases only with the involvement of a parent or guardian.

If you believe a child has provided us with personal data without the required consent, contact info@latinbox.io and we will delete the data promptly.

11. Your rights and how to exercise them

Subject to your jurisdiction, you may have the right to: access the personal data we hold about you and receive information about how we process it; correct inaccurate or incomplete data; delete your data; restrict or object to processing, including profiling and direct marketing; receive your data in a portable, machine-readable format and have it transmitted to another controller; withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal; and lodge a complaint with a supervisory authority.

To exercise any right, email info@latinbox.io from your registered address, or use the in-app options described in Section 11.1. We respond within 30 days (or within the shorter period required by your local law), and may extend this where permitted, telling you why. To protect your privacy, we may need to verify your identity before acting on a request. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive, and we will never discriminate against you for exercising them.

Where permitted, you may use an authorised agent to submit a request on your behalf; we may ask for proof of their authority and for you to verify your own identity directly.

11.1 Deleting your account and data

You can delete your account and the personal data associated with it:

• In the App: Settings → My Account → Delete Account. (Confirm this path exists — Google Play requires an in-app deletion route and a public account-deletion URL.)
• By emailing info@latinbox.io from your registered email address.

Deletion removes your account details, learning progress and the content you created. Data we are legally required to keep — principally billing and tax records — is retained for the periods in Section 8 and is not used for any other purpose. Backups are purged on their normal rotation cycle.

12. Region-specific disclosures

12.1 EEA, United Kingdom and Switzerland

The rights in Section 11 apply to you in full under the GDPR, the UK GDPR and the Swiss FADP. You may lodge a complaint with your national data protection authority, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner. Providing account data is necessary to enter into a contract with us; without it we cannot supply the Service.

12.2 California

Under the CCPA as amended by the CPRA, you have the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and be free from discrimination. As stated in Section 6.1, we do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. In the past twelve months we have collected the following statutory categories:

Retention is described in Section 8. To make a request, email info@latinbox.io. California residents may also request information under the "Shine the Light" law about disclosures to third parties for their direct marketing purposes; we make no such disclosures.

12.3 Other U.S. states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have rights to confirm, access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale and certain profiling. We do not conduct targeted advertising or sales as defined by those laws. We honour opt-out preference signals such as Global Privacy Control where technically supported. If we decline a request, you may appeal by replying to our decision email; if the appeal is denied, you may contact your state attorney general.

12.4 Brazil

Under the LGPD you may confirm the existence of processing, access your data, correct it, request anonymisation, blocking or deletion of unnecessary or excessive data, request portability, obtain information about our data-sharing, and withdraw consent. Requests go to info@latinbox.io, and you may complain to the ANPD.

12.5 Canada

Under PIPEDA and equivalent provincial laws you may access and correct your personal information and withdraw consent, subject to legal and contractual restrictions. You may complain to the Office of the Privacy Commissioner of Canada.

12.6 Australia and New Zealand

We handle personal information in accordance with the Australian Privacy Principles and the New Zealand Privacy Act. You may request access and correction, and complain to the OAIC or the New Zealand Privacy Commissioner if you are not satisfied with our response.

12.7 Israel

Under the Protection of Privacy Law, 5741-1981 and its regulations, you may inspect data held about you, request correction or deletion of data that is incorrect, incomplete, unclear or out of date, and complain to the Israeli Privacy Protection Authority. Marketing messages are sent in accordance with Section 30A of the Communications (Telecommunications and Broadcasts) Law, 5742-1982, and can be stopped at any time.

12.8 Other jurisdictions

Where the law of your country grants you rights beyond those described here — including under Japan's APPI, South Korea's PIPA, India's DPDP Act, South Africa's POPIA, the UAE and Saudi data protection laws, and similar regimes — we will honour those rights on request. Contact us at info@latinbox.io.

13. Third-party links and services

The Service may link to third-party websites, stores and services. This Policy does not apply to them, and we are not responsible for their privacy practices. Please review their policies before providing personal data.

14. Changes to this Policy

We may update this Policy from time to time. The current version is always available at this URL with a revised "Last updated" date. For material changes we will provide notice by email or through a prominent in-app message before the change takes effect, and where required by law we will seek your consent. Continued use of the Service after an update means you accept the revised Policy.

15. Contact us

We aim to resolve any privacy concern directly. You always retain the right to complain to your local supervisory authority.