Privacy Policy

1. Data Controller

The data controller responsible for personal data processed on this website is:

SESSILE STUDIO LTD
71-75 Shelton Street, Covent Garden
London, WC2H 9JQ
United Kingdom
Represented by: Alper Yoruk
Email: info@hallokit.com

2. Data We Collect and Why

Account (Supabase)

To create and use your account we process your email address and a hashed password. The legal basis is performance of a contract (UK GDPR Art. 6(1)(b)). Data is stored with Supabase Inc. (USA), which is certified under the EU–US Data Privacy Framework and maintains Standard Contractual Clauses (SCCs) under UK GDPR Art. 46.

Payment Processing (Paddle)

Payments are handled by Paddle.com Market Ltd., acting as Merchant of Record. Paddle processes your payment details under Paddle's privacy policy. We receive only a purchase confirmation and your email address. Legal basis: performance of a contract (UK GDPR Art. 6(1)(b)).

Hosting (Vercel)

This website is hosted on Vercel Inc. (USA). Vercel processes your IP address and technical metadata (browser, operating system, referrer URL) for operational and security purposes. Legal basis: legitimate interest in stable service operation (UK GDPR Art. 6(1)(f)).

Text-to-Speech (Microsoft)

When you play German audio in a scenario, the phrase text is sent to our server and forwarded to Microsoft's speech synthesis service to generate the audio file. We do not attach your account details to these requests. Legal basis: performance of a contract when you use paid or free scenario features (UK GDPR Art. 6(1)(b)), or legitimate interest in delivering the service (UK GDPR Art. 6(1)(f)) for guest use.

Speech Recognition (Your Browser)

If you use speak-aloud practice, your browser's built-in speech recognition may process audio from your microphone. Depending on your browser, this processing may occur on your device or via your browser vendor's speech service (for example Google in Chrome). We receive only the transcript text returned to the page to score your answer; we do not store raw audio recordings. Legal basis: performance of a contract when you choose to use this feature (UK GDPR Art. 6(1)(b)).

Product Analytics (Supabase)

We store product usage events (for example scenario starts, completions, and checkout steps) in our Supabase database to understand how the service is used and improve it. These events may include your account ID when signed in, an anonymous session identifier when browsing as a guest, and your browser user-agent string. Legal basis: legitimate interest in operating and improving the service (UK GDPR Art. 6(1)(f)).

Marketing & Reminder Emails (Resend)

If you opt in, we process your email address to send practical German tips, follow-up learning emails, or appointment prep reminders. These are sent only with your explicit consent at the point of signup. We store your email address, consent status, and (for prep reminders) the scenario and appointment date you provide in our Supabase database. Outbound emails are delivered via Resend (Resend, Inc., USA), which processes your email address as our email service provider under their own privacy policy. Legal basis: consent (UK GDPR Art. 6(1)(a)). You can withdraw consent at any time by using the unsubscribe link in any marketing email or by contacting us at info@hallokit.com.

3. Cookies and Local Storage

We use only functional cookies necessary for the website to operate (for example session tokens for authentication and an anonymous analytics session identifier). No tracking or advertising cookies are set.

We also store small preference values in your browser's local storage (for example cookie-notice acceptance, practice settings, guest scenario progress, and dismissed tips). This data stays on your device and is not sent to us unless you take an action that syncs it to your account (for example saving progress while signed in).

4. Retention

Account data is retained for as long as your account remains active. Marketing email data is retained until you unsubscribe or ask us to delete it. Prep reminder data is deleted after the reminder is sent or the appointment date has passed. Upon account deletion request, personal data is removed within 30 days, unless we are required by law to retain it for longer (e.g. financial records may be kept for up to 6 years under UK tax law). To request deletion, contact info@hallokit.com.

5. Your Rights

Under UK GDPR you have the right to: access your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object (Art. 21). To exercise any of these rights, please contact us at: info@hallokit.com.

6. Complaints

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk.