GDPR Compliance

Our Commitment to GDPR

LinguaChats.ai is operated by Xotic Tech OÜ, Estonia, which is the data controller for your personal data. This page explains how we handle that data under the General Data Protection Regulation (GDPR). See our Privacy Policy for what we collect.

Legal Basis for Processing

We process your personal data on the following legal grounds:

• Contract: To provide your account, the API and the credits you buy
• Legitimate Interest: To secure the service and prevent fraud and abuse
• Legal Obligation: To comply with applicable laws, such as accounting rules

Your Rights Under GDPR

As a data subject, you have the following rights:

Right of Access

You can ask what personal data we hold about you and request a copy of it.

Right to Rectification

You can ask us to correct inaccurate or incomplete personal data.

Right to Erasure (Right to be Forgotten)

You can ask us to delete your account and personal data. Some records, such as purchase records, may be kept where the law requires it.

Right to Restrict Processing

You can ask us to limit how we use your personal data in certain situations.

Right to Data Portability

You can request a copy of the data you gave us in a structured, machine-readable format.

Right to Object

You can object to processing based on our legitimate interests.

How to Exercise Your Rights

To exercise any of your GDPR rights, including deleting your account, email us at support@linguachats.ai from the address linked to your account.

We will respond within one month (extendable by two further months for complex requests, in which case we will tell you). Requests are free of charge.

Data Protection Measures

We take the following measures to protect your data:

Technical Safeguards

• Encryption of data in transit
• API keys stored only as SHA-256 hashes; passwords managed by Supabase Auth
• No storage of prompt or completion text, only per-request metadata
• Card data handled entirely by Polar.sh, never by us

Organizational Measures

• Collecting only the data we need to run the service
• Restricting access to personal data to those who need it
• Using a small, named set of sub-processors (listed below)

Sub-processors and Data Transfers

We use the following sub-processors:

• Supabase: authentication and database
• Vercel: website and API hosting
• Novita.ai: model inference. Your prompts are sent to Novita.ai to generate completions.
• Polar.sh: payments. Polar is the merchant of record and handles card data, invoices, taxes and refunds under its own buyer terms.

Some of these providers may process data outside the European Economic Area (EEA). Where they do, transfers rely on safeguards recognized under GDPR, such as European Commission adequacy decisions or Standard Contractual Clauses.

Data Retention

We keep your personal data only for as long as needed to:

• Provide the service while your account is open
• Comply with legal obligations, such as accounting rules
• Resolve disputes and enforce our terms

When you delete your account, we delete your personal data unless we are legally required to keep it.

Complaints and Supervisory Authority

If you believe we have not handled your personal data in line with GDPR, please contact us first. You also have the right to lodge a complaint with:

• The Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), our lead supervisory authority
• The supervisory authority in the EU country where you live or work

Privacy Contact

We have not appointed a Data Protection Officer. For any privacy or GDPR question, or to exercise your rights, contact us at:

Email: support@linguachats.ai
Phone: +372 5781 9962
Subject: GDPR Inquiry
Address: Xotic Tech OÜ, Estonia

Updates to This Page

We will update this page when our practices or sub-processors change, and notify you by email of material changes.