Privacy Notice

1. Controller

The controller within the meaning of Art. 4(7) GDPR is: Akixa, owner Dipl.-Phys. Gerhard H. C. Scheffler, Seesener Straße 43, 10711 Berlin, Germany, email: hello@lingrada.app. No data protection officer is required by law (Art. 37 GDPR / § 38 BDSG not applicable).

2. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw any consent at any time with future effect (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority (Art. 77), in particular in the member state of your residence or the alleged infringement. The authority competent for our seat is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Alt-Moabit 59–61, 10555 Berlin. To exercise your rights, an email to hello@lingrada.app suffices.

3. Hosting (Vercel)

This website is operated on Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA; delivery may occur via servers in the USA and/or within the EU. On access, Vercel processes technically necessary access data to deliver content and keep operation secure and stable. Legal basis: Art. 6(1)(f) GDPR. A data processing agreement (DPA) is in place. For the transfer to the USA, see section 8.

4. Server log files

On each access, technically necessary data are processed (incl. IP address, date and time, requested resource, referrer URL, user agent), to the extent required for delivery, stability and security. Legal basis: Art. 6(1)(f) GDPR.

5. Translation (live audio)

When you use the live audio product, your live audio is routed in real time through LiveKit's real-time media infrastructure (LiveKit, Inc., USA) so it can reach the translation service and, where applicable, other listeners. As a rule, the audio is processed for translation in three steps by specialised processors: for speech recognition, the spoken audio is sent to Deepgram (Deepgram, Inc., USA) and converted to text there; that text is sent for translation to Google's Gemini interface (Google Ireland Ltd., Ireland, possibly Google LLC, USA); from the translated text, the speech-synthesis service Google Cloud Text-to-Speech (also Google) generates a synthetic voice. In certain cases the translation may instead be handled by a single speech-to-speech service from Google (Gemini), to which the audio stream itself is then sent. To reduce latency, this processing may additionally take place in a cloud region (Amazon Web Services) close to the speaker, which may be outside the EU/EEA; in that case the transfer relies on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). See section 8 for more on third-country transfers.

Translation and voice output are generated fully automatically by AI systems (AI translation); no person reviews the result before it is played. Listeners hear a synthetic voice, not the speaker's voice — unless they choose “Original”, the speaker's untranslated audio. Under the terms that apply to our paid access, Google does not use the submitted content to improve its products; it stores the content for a limited period to detect abuse (55 days for the Gemini interface) and uses it only for that purpose; Google uses this data to train AI models only for models that enforce its policies. We have opted out of Deepgram's use of the audio for model improvement, so Deepgram retains the audio only for as long as it needs to process the respective request. The translation service currently runs in the Amazon Web Services region Frankfurt am Main (eu-central-1).

For delivery to listeners, the translated audio track (a synthetic voice, not the speaker's original voice) is additionally provided as a sequence of short-lived audio segments via the infrastructure of Cloudflare, Inc. (San Francisco, California, USA): the segments are stored on Cloudflare R2 for delivery and deleted automatically after 1 day at the latest; as an alternative delivery path, the translated audio may be routed through Cloudflare's real-time infrastructure (Cloudflare Realtime). In addition, to enforce the listener limit included in the speaker's plan, we store short-lived pseudonymous presence entries for active listeners (a randomly generated listener ID and a timestamp — listeners need no account) in a Redis database provided by Upstash, Inc. (San Francisco, California, USA); these entries expire automatically within a few minutes of a listener stopping playback. See section 8 for more on third-country transfers.

The live audio product is in an early beta (early access) and is currently being rolled out with pilot guides. The details below apply once you use the live audio product.

6. Fonts

Fonts are served locally from our server (self-hosting via `next/font`). No data is transferred to Google Fonts or other third parties when the page loads.

7. Audience measurement (Vercel Web Analytics, cookieless)

For audience measurement we use Vercel Web Analytics, a cookieless analytics service provided by our hosting provider Vercel (see section 3). It loads a client-side script that collects aggregated usage data (e.g. the page viewed, referrer, approximate country-level origin, device type/browser). No cookies are set and no identifiers are stored on or read from your device; visitor counting uses a hash that rotates daily and is discarded after the day, so no profiles capable of identifying you are created and there is no cross-device or cross-site tracking. As no information is stored on or read from your device — and thus no access within the meaning of § 25(1) TDDDG occurs — no consent is required and no cookie banner is needed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement). On transfer to the USA, see section 8.

8. Third-country transfer (USA)

For the services in sections 3, 5, 10 and 11 (Vercel, LiveKit, Deepgram, Google, Cloudflare, Upstash, Clerk, Microsoft), processing involves providers with a US nexus. They base the transfer on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the providers are certified accordingly, additionally on the EU-US Data Privacy Framework (Commission adequacy decision). Despite these safeguards, access by US authorities cannot be entirely ruled out. For the live audio product (section 5), real-time processing of the audio stream may additionally take place in AWS regions outside the EU/EEA; this too relies on EU Standard Contractual Clauses.

9. Payment processing (Dodo Payments — Merchant of Record)

We use Dodo Payments as Merchant of Record (MoR) to handle payments. Dodo acts as the legal seller/merchant and handles payment processing and tax remittance. In this context Dodo processes the data required for payment (e.g. name, email, billing and payment data) under its own or joint responsibility. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The contracting party for the purchase and the entity responsible for payment processing is Dodo Payments Inc., a company organised under the laws of the US state of Delaware (Dover, Delaware, USA), where applicable together with its group companies (including in the United Kingdom). Where personal data is processed outside the EU/EEA in this context, this is based on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914); Dodo is currently not certified under the EU-US Data Privacy Framework. Details in Dodo's privacy policy: https://dodopayments.com/legal/privacy-policy.

10. Authentication (Clerk)

We use Clerk, Inc. (San Francisco, California, USA) as our authentication and account-management provider for guide sign-in (email code, and Google/Apple social sign-in). Clerk processes the data necessary for account creation and session management (e.g. email address, authentication tokens, sign-in method). Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for account-holders, otherwise Art. 6(1)(f) GDPR (legitimate interest in secure authentication). Where personal data is processed outside the EU/EEA in this context, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). If you have a paid subscription, we additionally store a technical reference linking your account ID to the subscription ID in a Redis database provided by Upstash, Inc. (see sections 5 and 8), so that your subscription can be cancelled reliably if you delete your account; this reference is deleted when the subscription ends. Legal basis: Art. 6(1)(b) GDPR.

11. Contact (email and contact form)

If you write to us by email or through the contact form, we process the details you provide (your email address and the content of your message, and with the form also the name you may give and the language of the page you sent it from) in order to handle your request. Legal basis: Art. 6(1)(b) GDPR where your request concerns the conclusion or performance of a contract, otherwise Art. 6(1)(f) GDPR (interest in responding to enquiries). Where the website opens a pre-filled email in your own mail program for this purpose, the entered data leave your device only when you send the email yourself.

Our mailbox is hosted on Microsoft 365 (Exchange Online), provided by Microsoft Ireland Operations Limited, Dublin, Ireland, as our processor. The contact form passes your details via our hosting provider Vercel (section 3) to Microsoft, which delivers them as an email to our mailbox. The website does not store the message and does not write its content to its logs.

To protect against messages sent automatically in bulk, we count how many messages are sent from one IP address. For this we store a hash of the IP address (not the address itself) together with a counter for at most one hour in a Redis database provided by Upstash, Inc. (see sections 5 and 8). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting this contact channel against abuse).

Retention: we delete your message as soon as it is no longer needed to handle your request, at the latest after three years, unless statutory retention obligations apply.

12. Cookies and browser storage

We set no cookies for advertising or analytics purposes (for our cookieless audience measurement, see section 7). The website uses only the following cookies and browser-storage entries; each serves solely a function you request yourself.

"NEXT_LOCALE" stores the language version you opened, so that a later visit without a language in the address appears in that language. The cookie is set only when this language version differs from your browser's language setting, and it is deleted when you close the browser.

"lingrada_currency" stores the currency you chose yourself in the pricing overview (euros or US dollars, value "EUR" or "USD"). The cookie is only set when you switch the currency. Until you choose one, the currency and, where one exists, a local price follow the country that our hosting provider Vercel derives from your IP address each time a page is loaded. That country is not stored on your device. Retention: 12 months.

Only on the sign-in and sign-up pages and in the guide area does the website load the authentication service Clerk (section 10). Clerk sets the cookies "__client" and "__client_uat", which link your browser to your sign-in session (lifetime up to 10 years; after you sign out they no longer hold an active session), and, once you are signed in, "__session", which holds a short-lived sign-in token valid for about one minute and renewed continuously. To protect the sign-in service against automated access, Cloudflare, Clerk's network provider, also sets "__cf_bm" (30 minutes) and "_cfuvid" (until you close the browser).

In the guide area, your browser stores the name and languages of your last session in local storage (entry "lingrada:lastSetup"), so you need not enter them again next time; the entry remains until you delete it in your browser. While a tab is open, session storage also holds the permission to end a running session and any PIN you entered as a listener; both are deleted when you close the tab.

Legal basis: storing this information on your device and reading it are strictly necessary to provide the functions you request (display in your chosen language and currency, sign-in, restoring your last settings); no consent is required for this (§ 25(2) no. 2 TDDDG). Where personal data are processed in the process, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in a functional and secure website), and Art. 6(1)(b) GDPR for sign-in.

13. Retention

We store personal data only as long as necessary for the respective purposes or as required by statutory retention periods (log files: short-term; payment data: statutory periods; cookies and browser storage: see section 12).

14. Changes to this notice

We update this privacy notice when our data processing changes. Last updated: 21 October 2026.