Privacy Policy — LectiFluentia

1. Who We Are

LectiFluentia is a language learning web application, operated from Brazil, that allows users to upload texts in a foreign language, read them in an interactive reader, track vocabulary knowledge, and receive AI-generated word translations and reading assistance. We process personal data in accordance with Brazil's Lei Geral de Proteção de Dados (LGPD, Lei nº 13.709/2018).

Important summary: to provide translation and reading-assistance features, we transmit the words and the full texts you work with to third-party AI providers, which may be located outside Brazil (including the United States and the People's Republic of China). This is essential to the Service and is described in detail in Section 4. Please read it carefully before uploading content.

2. Information We Collect

2.1 Account Information (via Clerk): Authentication and identity management are handled by Clerk (clerk.com). When you register or sign in, Clerk collects your email address, your name (if provided), and OAuth profile data (if you sign in via a social provider such as Google). We receive a user identifier from Clerk and store a minimal user record in our database (user identifier, display name if you set one, your selected app/interface language, your known and learning languages and default known language, and account creation date). We do not store passwords.

2.2 Content You Upload: When you upload a text file, we store the file content (plain text or Markdown), the title you assign to the text, the source language you select for the text, and the date of upload. Uploaded texts are private to your account in the sense that they are not shared with, or made visible to, other users and are not publicly accessible. To generate translations and reading assistance, however, the content is transmitted to third-party AI providers as described in Section 4. We do not ourselves use your content to train any model.

2.3 Word Ratings: As you read and grade words, we store word rating records containing the word (normalised form), the source language of the word, the rating you assigned (1, 2, 3, or starred), and the date of last update. Word ratings are private to your account.

2.4 Usage and Technical Data: We may collect standard server-side technical data including IP addresses (processed by infrastructure and not persistently logged at the application layer), browser type and version, and error and diagnostic logs (retained for a short period for debugging). We do not currently operate client-side analytics.

3. How We Use Your Information

We use your information to provide and operate the Service (performance of contract), authenticate your identity and secure your account (performance of contract / legitimate interest), store your texts, word ratings, and learning progress (performance of contract), transmit your words and texts to AI providers to generate translations and reading assistance (performance of contract — see Section 4), diagnose errors and improve Service reliability (legitimate interest), and comply with legal obligations (legal obligation).

We do not use your data for automated decision-making or profiling in any way that produces legal or significant effects on you.

4. AI Processing of Your Words and Texts

4.1 What is sent, and why. Translation and reading-assistance features cannot function without sending your content to an AI provider. There are two flows: (a) Word translation — when a word translation is generated, we send the word (normalised form), a short surrounding context snippet, and the relevant language codes; and (b) Full-text reading assistance (e.g. Read Along / interlinear breakdowns) — we send the entire text you are working with. All content you upload may be sent in this way, regardless of whether it is otherwise private to your account; we do not treat private and non-private uploads differently for this purpose. We do not send your name, email address, or account identity to the AI provider.

4.2 Your consent and authorisation. By uploading content and using these features, you instruct and authorise us to transmit the relevant words and full texts — including any content you upload — to the AI provider or providers we use, as necessary to deliver the Service you have requested, and you authorise us to select and change those providers at our discretion (see 4.3). This processing is a core, non-optional part of the Service: if you do not wish your content to be transmitted to our providers, please do not upload it or use these features.

4.3 Who the providers are. We use one or more third-party AI providers of our choosing, and we may add, remove, or change them at any time at our sole discretion. The providers currently include Anthropic (United States), OpenAI (United States), Replicate (United States), and DeepSeek (People's Republic of China). Which provider handles a given request may vary, and your content may be processed by any of them on infrastructure located outside Brazil.

4.4 What happens once content is sent. Once your content has been transmitted to an AI provider, its handling is governed by that provider's own terms and privacy policy, and is outside our control. We cannot recall content already transmitted. The providers' practices differ in important ways: Anthropic and OpenAI state that they do not use API inputs or outputs to train their models by default and apply limited retention, typically around 30 days (see anthropic.com and openai.com). Replicate processes the inputs and outputs you submit in order to run model predictions and may retain them and use service-related data to operate and improve its platform (see replicate.com). DeepSeek stores data on servers in the People's Republic of China, and its terms currently permit the use of submitted inputs and outputs for model improvement and other purposes; data stored in China may be accessible to authorities under applicable local law (see deepseek.com). You should not upload content you are not comfortable sending to these providers under those conditions.

4.5 Cache. Generated word translations are stored by us as a shared, anonymised cache (keyed by word and language pair, containing no account identity) so the same translation can be reused for all users without repeated AI calls.

5. International Data Transfers

Providing the Service requires transferring your content to, and processing it in, countries other than Brazil — including the United States (Anthropic, OpenAI, Replicate) and the People's Republic of China (DeepSeek). These countries may not offer the same level of data protection as Brazil. Under the LGPD (Art. 33), we carry out these international transfers on the basis of your specific and highlighted consent, given when you upload content and use the AI-powered features, and/or other safeguards permitted by the LGPD. By using the AI-powered features you acknowledge and consent to these international transfers; if you do not consent, please do not use those features.

6. Sharing of Information

We do not sell your personal data. We do not share your data with third parties for advertising purposes.

We share data only in the following limited circumstances: Clerk receives your authentication data to manage sign-in and session management; our AI providers (currently Anthropic, OpenAI, Replicate, and/or DeepSeek) receive the words and full texts you process, together with language codes, to generate translations and reading assistance (see Section 4); infrastructure providers process data on our behalf under data processing agreements; and we may disclose data if required by law, court order, or to protect the rights and safety of users.

7. Data Retention and Your Right to Erasure

Account records, uploaded texts, and word ratings are retained while your account is active and deleted from our systems within 30 days of account deletion. The shared, anonymised AI translation cache is retained indefinitely as it contains no personal data. Server error logs are retained for up to 30 days.

We honour your right to erasure (right to be forgotten) with respect to data held on our systems. However, content that has already been transmitted to an AI provider is retained and handled according to that provider's policies and is outside our control; deleting your account or content from LectiFluentia does not retroactively erase copies the provider may hold. Where a provider offers a deletion mechanism, we will pass on a deletion request on your behalf upon request, but we cannot guarantee the provider will comply.

8. Your Rights

If you are in Brazil, the LGPD gives you the right to confirm the existence of processing; access your data; correct incomplete, inaccurate, or outdated data; request anonymisation, blocking, or deletion of unnecessary or excessive data or data processed in non-compliance with the law; request portability; request deletion of personal data processed with your consent; obtain information about the public and private entities with which we have shared your data; obtain information about the possibility of refusing consent and its consequences; and revoke consent at any time. Withdrawing consent to AI processing means we can no longer provide the translation and reading-assistance features.

To exercise these rights, or to reach us about any data-protection matter, use the contact details in Section 13. We will respond within the timeframes required by the LGPD. You also have the right to lodge a complaint with Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD).

Users in other jurisdictions may have additional rights. For example, California residents (CCPA) have the right to know what personal information we collect, to delete it, to opt out of its sale (we do not sell personal information), and not to be discriminated against for exercising these rights.

9. Data Security

We use industry-standard security measures to protect your data: all data is transmitted over HTTPS (TLS), authentication is managed by Clerk which implements industry-standard security controls, database access is restricted to application infrastructure only, and uploaded content is accessible only through authenticated, user-scoped API routes. Transmission to AI providers occurs over encrypted connections.

No method of transmission over the Internet or electronic storage is 100% secure. We strive to use commercially acceptable means to protect your data but cannot guarantee absolute security, and we do not control the security practices of the AI providers once your content reaches them.

10. Children's Privacy

The Service is not directed at children. Consistent with the LGPD (Art. 14), we do not knowingly process the personal data of children (under 12) without the specific and highlighted consent of a parent or legal guardian, and any processing of the data of children and adolescents is carried out in their best interest. Minors under 18 should use the Service only with the involvement of a parent or guardian (see the Terms of Service, Eligibility). If you believe a child has provided us with personal data without appropriate consent, please contact us and we will delete it promptly.

11. International Users

LectiFluentia is operated from Brazil by an independent developer and is intended primarily for users in Brazil. You are welcome to use it from other countries, but by doing so you understand and agree that your personal data will be processed in Brazil and transferred to the countries where our AI and infrastructure providers operate (including the United States and the People's Republic of China), as described in Sections 4 and 5.

We are a small, independent operation and do not maintain representatives, offices, or other establishments outside Brazil. Regardless of where you are located, we will make a good-faith effort to honour the core data-protection rights described in Section 8 — including access, correction, and deletion of your data — through the single contact channel in Section 13.

If you are in the European Economic Area or the United Kingdom: we rely on your explicit consent, given when you use the AI-powered features, for the international transfers necessary to provide the Service. If you are not comfortable with your data being transferred to and processed in these countries, please do not upload content or use the AI-powered features. If you are a California resident, please see the CCPA note in Section 8. Where your local law grants you mandatory rights beyond those described in this policy, we will respect those rights to the extent they apply to us.

12. Changes to This Policy

We may update this Privacy Policy from time to time, including if we add, change, or remove an AI provider. When we do, we will revise the date shown at the top of this page. We encourage you to review this policy periodically.

13. Contact

If you have questions or requests regarding this Privacy Policy, or wish to exercise your rights, please contact us — including for data-protection matters (the operator acts as the point of contact / Encarregado under the LGPD) — at: LectiFluentia, Email: contact@lectifluentia.com