This policy explains what personal data Vocabulary Companion collects when you use our service, how we use and share it, how long we keep it, and how you can access or delete it. We have written it to reflect what our service actually does — not a generic template.
Contents
1. Who we are
Vocabulary Companion is a vocabulary-learning service delivered inside messaging apps (such as Instagram Direct Messages). It is operated by:
One On One Tests Preparation Ltd
Beeri 28, Herzliya, Israel
Contact / data-protection inquiries: support@vocabularycompanion.com
We are the controller responsible for your personal data under Brazil's Lei Geral de Proteção de Dados (LGPD) and, where applicable, comparable laws such as the GDPR and CCPA. For payments, our payment provider Polar acts as Merchant of Record (see section 5).
2. What we collect
We collect only what we need to run the learning service in a chat. Specifically:
- Your messaging identity. The account identifier that the messaging platform (e.g. Meta / Instagram) gives us when you message us, so we can recognize you across sessions. We do not collect your name, email address or phone number through the chat.
- Your messages. The content of the messages you exchange with the bot, which is what the lessons and quizzes are made of. We automatically mask common personal identifiers (such as email addresses, phone numbers, CPF numbers and street addresses) if they happen to appear in message text.
- Your learning data. Your answers, progress, streaks, spaced-repetition schedule, and any level, goal or preference you tell the bot.
- How you arrived. Which invitation link or campaign brought you to the chat (a campaign/creative reference), so we understand which channels work.
- Eligibility question. During the conversation we may ask you an eligibility question and record your answer. We do not collect or store your date of birth or your exact age.
- Payment information. If you subscribe, our payment provider Polar collects and processes your payment details. We never receive or store your card data. From the transaction we keep only minimized facts — order/checkout reference, amount, currency, product, and status — and your billing email address, which we store encrypted.
- Operational logs. Standard technical logs needed to run and secure the service (for example request metadata and error information).
3. How and why we use your data
We use your data for the following purposes, each with a legal basis under the LGPD (Art. 7 / Art. 11):
| Purpose | Legal basis |
|---|---|
| Deliver the lessons, quizzes and spaced-repetition practice you asked for | Performance of the service requested by you / your consent |
| Personalize your learning schedule and difficulty | Legitimate interest / consent |
| Process your subscription and provide access | Performance of a contract |
| Record and respond to your answer to an eligibility question | Legitimate interest / your consent |
| Operate, secure, debug and improve the service, and prevent abuse | Legitimate interest |
| Meet legal, tax and accounting obligations | Compliance with a legal obligation |
We do not sell your personal data, and we do not use it for third-party advertising.
4. Automation & AI
Vocabulary Companion is an automated bot, and we tell you so the first time you talk to it. Your lessons, quizzes and grading are produced by our own software from a fixed, pre-written content library and a rule-based learning engine.
To help understand what you type and to help generate some conversational replies, we use third-party AI services, provided via OpenRouter as a sub-processor (see section 5). When we do this, the relevant message content is sent to that provider under a no-training, zero-retention arrangement — it is not used to train AI models and is not retained by the provider — and routing is restricted to data centers in the United States and the European Union.
5. Who we share your data with
We share data only with the service providers we need to run the product. Each processes data on our behalf under its own terms:
- Meta Platforms (Instagram / Messenger). The messaging platform through which you reach us; your messages pass through Meta to be delivered to and from you.
- Polar. Our payment provider and Merchant of Record, which handles checkout, billing and applicable taxes. Polar — not us — processes your card details.
- OpenRouter. AI processing of message content to help understand and generate responses, under a no-training / zero-retention arrangement, with routing restricted to the United States and European Union.
- Cloudflare. Stores our encrypted database backups and hosts media content.
- Google (Drive). A second, independent location for our encrypted backups.
- Our hosting provider. Runs the servers on which the service operates.
We also use internal operational alerting (e.g. Slack) to monitor the service; those alerts contain only an internal, non-identifying reference and never your message content or your identity. We may also disclose data if required by law or to protect our rights and users' safety.
6. How long we keep your data
- Message content: we anonymize the content of your conversations on a rolling 90-day basis, so older message text no longer identifies you.
- Learning progress and de-identified analytics: kept while your account is active and, in de-identified/aggregate form, afterwards, to operate and improve the service.
- Payment and billing records: kept as long as required by applicable tax and accounting law.
- Backups: encrypted and rotated on short retention windows; data you delete is removed from live systems immediately and ages out of backups on their normal cycle.
7. Your rights
Under the LGPD (and, where applicable, the GDPR/CCPA) you have the right to: confirm we process your data; access it; correct it; request its deletion or anonymization; obtain information about how we share it; and withdraw consent or object to certain processing. To exercise any of these, contact us using section 8 below. We respond within the timeframes the LGPD requires (an immediate simplified confirmation, and complete information within 15 days).
8. How to delete your data
You can ask us to delete your data at any time, in either of two ways:
- In the chat: send the bot a message such as “delete my data” (or, in Portuguese, “apagar meus dados”).
- By email: write to support@vocabularycompanion.com from, or referencing, the account you used.
When you make this request, we anonymize the content of your conversations, stop contacting you, and remove operational notes about you. Some records may be retained where the law requires it (for example minimized payment/accounting records), and de-identified data that can no longer be linked to you may be kept for analytics. We handle every request manually within the LGPD timeframe described in section 7. Full instructions are also on our Data Deletion page.
9. International data transfers
We are based in Israel, and the service providers listed in section 5 may process data in countries outside Brazil, including in Israel, the European Union and the United States. Where your data is transferred internationally, we rely on the legal bases and safeguards permitted under the LGPD (Art. 33), such as your consent and contractual protections with our providers.
10. Security
We protect your data with measures including encrypted transport (HTTPS), cryptographic verification of incoming messages, encryption at rest of your billing email, and encrypted, access-controlled backups. No method of transmission or storage is ever completely secure, but we work to protect your information and to limit what we collect in the first place.
11. Changes & contact
We may update this policy as the service evolves; the “last updated” date at the top will always reflect the current version, and material changes will be reflected here. For any privacy question or request, contact:
One On One Tests Preparation Ltd
Beeri 28, Herzliya, Israel
support@vocabularycompanion.com