Privacy Policy

This policy explains what personal data AptSpeak collects, why, and what rights you have over it. We’ve tried to write it in plain English rather than dense legal language.

1. Who we are

AptSpeak is operated by a sole trader based in Slovakia, in the European Union. For the purposes of data protection law, this sole trader is the “data controller” of the personal data described in this policy.

You can reach us about any privacy question or request at lekaipan259@gmail.com.

2. What data we collect

We collect data in three ways: what you give us directly, what we receive from Google if you sign in that way, and what is generated automatically as you use the site.

Account data. When you create an account, we (via our authentication provider, Supabase) store your email address and an encrypted password. We never see or store your password in plain text.

Google sign-in data. If you sign in with Google instead, Google shares your email address, name, and avatar URL with us. We store these to create and display your account.

Server logs. Our hosting provider, Vercel, automatically processes standard server logs for every request to the site, including your IP address, as part of running the infrastructure.

Analytics. We use Vercel Web Analytics, a privacy-friendly analytics tool that does not use cookies and does not track you across other websites. It gives us aggregate information, like which pages are popular, not individual profiles.

3. Why we process your data, and on what legal basis

We only process personal data where we have a valid legal basis to do so under the GDPR:

• Contract performance: account data (email, authentication details, Google profile data) is processed so we can create your account, let you log in, and provide the coaching and content you sign up for.
• Legitimate interest: server logs are processed to keep the site secure, prevent abuse, and diagnose technical problems. Analytics data is processed to understand how the site is used so we can improve it. In both cases, we’ve judged that this limited processing doesn’t override your own privacy interests.

4. Who we share data with

We don’t sell your personal data, and we don’t use it for advertising. We do share it with a small number of service providers (“processors”) who help us run the site:

• Supabase — our database, file storage, and authentication provider. Supabase stores your account data and any files (like downloadable learning materials) associated with the site.
• Vercel — our hosting provider. Vercel processes server logs and privacy-friendly analytics as described above.
• Google — if you choose to sign in with Google, Google processes your sign-in and shares the profile data described above with us, under Google’s own privacy policy.
• Calendly — session bookings happen on Calendly, which opens in a new tab. Any information you give Calendly to book a session (like your name and email) is collected and processed by Calendly directly, under its own privacy policy, not by us.

We do not currently process payments on this site, so no payment processor is listed here — this policy will be updated if that changes.

5. How long we keep your data

We keep your account data for as long as your account is active. If you ask us to delete your account, we delete or anonymize your account data, except where we’re required to keep something for a legitimate reason (like resolving a dispute). Server logs and analytics data are kept only for as long as needed for security, debugging, and understanding site usage, and are not kept indefinitely.

6. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• correct (rectify) inaccurate or incomplete data;
• delete (erase) your data, in certain circumstances;
• receive a copy of your data in a portable format (“data portability”);
• object to processing that’s based on our legitimate interest; and
• lodge a complaint with a supervisory authority — in Slovakia, this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky).

To exercise any of these rights, email us at lekaipan259@gmail.com.

7. Cookies

We only use cookies that are strictly necessary for the site to work: authentication cookies set by Supabase to keep you signed in. We don’t use advertising or tracking cookies, and our analytics tool doesn’t use cookies at all.

8. Children’s privacy

This service is not directed at, or intended for, children under the age of 16, and we do not knowingly collect personal data from children under 16.

9. Changes to this policy

If we make changes to this policy, we’ll update it on this page and update the “Last updated” date at the top.

10. Contact us

If you have any questions about this policy or how we handle your data, email lekaipan259@gmail.com.