Privacy Policy
This document is provided in English only.
Last updated: [EFFECTIVE DATE]
This document is a carefully-scoped template, not legal advice, and has not been reviewed by an attorney. The bracketed placeholders below ([LEGAL ENTITY NAME], [BUSINESS ADDRESS], [KVK NUMBER], [EFFECTIVE DATE]) are intentionally left blank pending KvK registration and must be filled in with real information — never guessed at. The finished document should be reviewed by a Dutch-qualified attorney before it is relied upon or enforced.
This Privacy Policy explains what personal data the Shahrzād Persian-learning app (the "App") processes, why, and what choices and rights you have — in line with the EU General Data Protection Regulation (GDPR) and the Dutch Uitvoeringswet AVG.
The App is built to work fully without an account: if you use it as a guest, your learning progress stays only on your own device and is never sent to us. Creating an account is entirely optional, and only needed if you want your progress to sync across devices.
1. Who is responsible for your data
The data controller responsible for your personal data is:
[LEGAL ENTITY NAME] [BUSINESS ADDRESS] KvK number: [KVK NUMBER] Email: support@shahrzadonline.com
For any question about this Privacy Policy, or about how we handle your data, contact us at support@shahrzadonline.com or info@shahrzadonline.com.
2. Account information
If you create an account — via Google, Apple, or email, through our authentication provider Supabase — we collect the basic information your chosen sign-in method gives us: your email address, and, where the provider gives it to us, your name and profile picture.
Why: to create and manage your account and let you sign in.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) — this is the account you asked us to create, and having this information is necessary to provide it.
3. Learning and progress data
If you have an account, we store your course progress — completed lessons, streaks, XP, per-word strength, achievements, and similar — so it can sync across the devices you sign into. This is stored using Supabase, our database provider, in a table associated with your account.
If you don't have an account, this same data stays only in your device's local storage and never reaches us at all.
Why: to provide the core feature you're asking for when you create an account — not losing your progress when you switch devices.
Legal basis: performance of a contract (Article 6(1)(b) GDPR).
4. App settings and preferences
If you have an account, your in-app preferences (such as display language, audio settings, or your chosen color theme) are stored and synced alongside your progress data, for the same reason and on the same legal basis as Section 3 above.
5. Subscription and purchase information
In-app purchases are not yet live — the App's subscription system (an entitlement we call "shahrzad_app_pro", covering monthly, yearly, or lifetime access to the full course) is built but not yet enabled for purchase on any app store. Once it is enabled, purchases will be handled entirely by the Apple App Store or Google Play (see Section 9), and we will receive limited subscription/entitlement status information (active or not, which plan) through our subscription management provider, RevenueCat (see Section 10) — never your payment card details.
Why: to confirm which parts of the course you've unlocked.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) for confirming your entitlement, and compliance with a legal obligation (Article 6(1)(c) GDPR) for any transaction records we are required to keep for Dutch tax and accounting purposes.
6. Technical and security information
The App is hosted on Cloudflare's network. As with any web service, Cloudflare's infrastructure automatically processes limited technical data (such as IP address and request metadata) as part of delivering and securing the App — for example, to protect against abuse and keep the service reliable. We do not separately collect, combine, or analyze this data ourselves beyond what Cloudflare's standard infrastructure does.
Legal basis: legitimate interest (Article 6(1)(f) GDPR) in keeping the App secure and operational, which we consider does not override your own rights and interests given how limited this processing is.
7. We do not sell your data or use it for advertising
We do not sell, rent, or trade your personal data to anyone. We do not use your learning data, progress, or account information to build advertising profiles or to serve targeted or behavioural advertising, inside the App or anywhere else. The App does not contain third-party advertising.
8. Supabase
Supabase provides the authentication and database infrastructure described in Sections 2–4. Supabase processes this data on our behalf and under our instructions, strictly to provide the App's account and sync functionality — not for Supabase's own independent purposes.
9. Apple App Store and Google Play
Once purchases are enabled, any payment you make will be processed entirely by the Apple App Store or Google Play, depending on your device. Apple and Google handle your payment details according to their own privacy policies, not this one — we do not receive, see, or store your full card or payment details.
10. RevenueCat
Once purchases are enabled, RevenueCat, Inc. will manage subscription status on our behalf — telling the App whether you currently have an active entitlement — without giving us access to your payment details.
11. Cloudflare
Cloudflare hosts and delivers the App, as described in Section 6.
12. International data transfers
Supabase, RevenueCat, and Cloudflare are global service providers, and the exact locations where each processes data can depend on their own infrastructure and account configuration. Where any of them processes personal data outside the European Economic Area, that transfer is governed by that provider's own data processing terms and safeguards — we recommend reviewing Supabase's, RevenueCat's, and Cloudflare's own privacy and data processing documentation for their current specifics. We will update this section with more precise detail once this has been confirmed for our specific setup.
13. How long we keep your data
If you use the App as a guest, your data lives only on your device, and you control it entirely yourself — you can clear it at any time from within the App's Settings.
If you have an account, we keep your account and synced progress data for as long as your account stays active. The "reset progress" and "delete everything" options in Settings clear the data stored locally on your device. To delete your account and the data we hold about you on our servers (your account, progress, preferences and feedback), use "Delete my account" in Settings — it takes effect immediately and cannot be undone. You can also ask us to do it by writing to support@shahrzadonline.com. Either way, we keep nothing we are not required to, except for any information we are legally required to retain for longer (for example, financial records once paid subscriptions are live, which Dutch law requires businesses to keep for a set retention period for tax purposes).
14. Your rights under the GDPR/AVG
Depending on the processing involved, you have the right to:
- Access the personal data we hold about you
- Rectification of inaccurate or incomplete data
- Erasure of your personal data ("the right to be forgotten")
- Restriction of how we process your data in certain situations
- Data portability — receiving your data in a structured, machine-readable format
- Object to processing based on our legitimate interest (see Section 6)
- Withdraw consent at any time, where consent is the legal basis for processing — note that none of the processing described in this Policy currently relies on consent, so this mainly matters if that changes in future
- Lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your own EU member state
15. How to exercise your rights
Contact us at support@shahrzadonline.com or info@shahrzadonline.com. We may need to verify your identity before acting on a request. We will respond within one month, as required by Article 12(3) GDPR (extendable by a further two months for complex requests, in which case we'll tell you why).
16. Data security
We take reasonable technical and organizational measures to protect your data, including relying on the security measures Supabase and Cloudflare each provide as part of their services. That said, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.
17. Children and minors
The App does not currently include an age-verification or age-restriction mechanism, and is intended for a general audience interested in learning Persian rather than specifically for young children. If you are a parent or guardian and believe your child has given us personal data without your knowledge, please contact us at support@shahrzadonline.com so we can address it.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will let you know through the App or by other reasonable means before they take effect.