Privacy Policy

1. Data we process

• Account data: name, email address, email-verification status, and account dates.
• Learning data: selected languages, preferences, card progress, review history, activity totals, and test results.
• Security data: session information, IP address, device or browser information, authentication records, and two-factor status.
• Communications: transactional email delivery information for verification, password reset, email changes, and deletion requests.

We do not use advertising cookies, behavioural advertising, or sell personal data.

2. Why we process data

• To create and operate your account and provide learning, review, and test features under Article 6(1)(b) GDPR.
• To authenticate users, prevent abuse, maintain security, diagnose failures, and improve reliability under our legitimate interests in Article 6(1)(f) GDPR.
• To meet legal obligations and respond to lawful requests under Article 6(1)(c) GDPR where applicable.

Review scheduling is automated, but it only determines when learning cards are shown. It does not produce legal or similarly significant effects.

3. Cookies and browser features

Multivocab uses strictly necessary cookies for sessions, authentication, security, and account features. The pronunciation feature uses your browser's speech-synthesis capability; its operation can depend on your browser, operating system, and configured voice provider.

4. Service providers and transfers

Data is shared only as needed with hosting, database, infrastructure, and email-delivery providers. Resend processes transactional email delivery. Providers act under their own contractual and security commitments.

A provider may process data outside the European Economic Area. Where required, transfers must rely on an applicable adequacy decision, Standard Contractual Clauses, or another lawful safeguard.

5. Retention and deletion

Account and learning data is kept while your account remains active. You can permanently delete it from Settings → Data after confirming through your email. Short-lived verification and deletion tokens expire automatically. Limited records may be retained where required by law, for security, or to establish or defend legal claims.

Deleted data may remain temporarily in protected infrastructure backups until their ordinary rotation. Backup copies are not used for normal product operation and are restored only for disaster recovery.

6. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You can download your account export or permanently delete your account from Settings → Data.

You may lodge a complaint with the Austrian Data Protection Authority or another competent supervisory authority. We may request reasonable identity verification before acting on a request.

7. Security

We use access controls, email verification, optional two-factor authentication, encrypted transport, security headers, and restricted database access. No internet service can guarantee absolute security; please use a unique password and protect your account credentials.

8. Children

Multivocab is not directed to children under 16. Do not create an account if you are under 16 unless a parent or legal guardian has authorised your use where permitted by applicable law.

9. Changes

We may update this policy at any time as the service or legal requirements change. The new version applies from the effective date shown above. Material changes will be communicated through the service or by email when appropriate.