Privacy Notice

1. Controller

The controller within the meaning of Art. 4(7) GDPR is: Akixa, owner Dipl.-Phys. Gerhard H. C. Scheffler, Seesener Straße 43, 10711 Berlin, Germany, email: hello@lingrada.app. No data protection officer is required by law (Art. 37 GDPR / § 38 BDSG not applicable).

2. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw any consent at any time with future effect (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority (Art. 77), in particular in the member state of your residence or the alleged infringement. The authority competent for our seat is the Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI), Alt-Moabit 59–61, 10555 Berlin. To exercise your rights, an email to hello@lingrada.app suffices.

3. Hosting (Vercel)

This website is operated on Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA; delivery may occur via servers in the USA and/or within the EU. On access, Vercel processes technically necessary access data to deliver content and keep operation secure and stable. Legal basis: Art. 6(1)(f) GDPR. A data processing agreement (DPA) is in place. For the transfer to the USA, see section 8.

4. Server log files

On each access, technically necessary data are processed (incl. IP address, date and time, requested resource, referrer URL, user agent), to the extent required for delivery, stability and security. Legal basis: Art. 6(1)(f) GDPR.

5. Translation (live audio)

When you use the live audio product, your live audio is routed in real time through LiveKit's real-time media infrastructure (LiveKit, Inc., USA) so it can reach the translation service and, where applicable, other listeners. As a rule, the audio is processed for translation in three steps by specialised processors: for speech recognition, the spoken audio is sent to Deepgram (Deepgram, Inc., USA) and converted to text there; that text is sent for translation to Google's Gemini interface (Google Ireland Ltd., Ireland, possibly Google LLC, USA); from the translated text, the speech-synthesis service Google Cloud Text-to-Speech (also Google) generates a synthetic voice. In certain cases the translation may instead be handled by a single speech-to-speech service from Google (Gemini), to which the audio stream itself is then sent. To reduce latency, this processing may additionally take place in a cloud region (Amazon Web Services) close to the speaker, which may be outside the EU/EEA; in that case the transfer relies on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). See section 8 for more on third-country transfers.

For delivery to listeners, the translated audio track (a synthetic voice, not the speaker's original voice) is additionally provided as a sequence of short-lived audio segments via the infrastructure of Cloudflare, Inc. (San Francisco, California, USA): the segments are stored on Cloudflare R2 for delivery and deleted automatically after 1 day at the latest; as an alternative delivery path, the translated audio may be routed through Cloudflare's real-time infrastructure (Cloudflare Realtime). In addition, to enforce the listener limit included in the speaker's plan, we store short-lived pseudonymous presence entries for active listeners (a randomly generated listener ID and a timestamp — listeners need no account) in a Redis database provided by Upstash, Inc. (San Francisco, California, USA); these entries expire automatically within a few minutes of a listener stopping playback. See section 8 for more on third-country transfers.

The live audio product is in an early beta (early access) and is currently being rolled out with pilot guides. The details below apply once you use the live audio product.

6. Fonts

Fonts are served locally from our server (self-hosting via `next/font`). No data is transferred to Google Fonts or other third parties when the page loads.

7. Audience measurement (Vercel Web Analytics, cookieless)

For audience measurement we use Vercel Web Analytics, a cookieless analytics service provided by our hosting provider Vercel (see section 3). It loads a client-side script that collects aggregated usage data (e.g. the page viewed, referrer, approximate country-level origin, device type/browser). No cookies are set and no identifiers are stored on or read from your device; visitor counting uses a hash that rotates daily and is discarded after the day, so no profiles capable of identifying you are created and there is no cross-device or cross-site tracking. As no information is stored on or read from your device — and thus no access within the meaning of § 25(1) TDDDG occurs — no consent is required and no cookie banner is needed. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement). On transfer to the USA, see section 8.

8. Third-country transfer (USA)

For the services in sections 3, 5 and 10 (Vercel, LiveKit, Deepgram, Google, Cloudflare, Upstash, Clerk), processing involves providers with a US nexus. They base the transfer on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the providers are certified accordingly, additionally on the EU-US Data Privacy Framework (Commission adequacy decision). Despite these safeguards, access by US authorities cannot be entirely ruled out. For the live audio product (section 5), real-time processing of the audio stream may additionally take place in AWS regions outside the EU/EEA; this too relies on EU Standard Contractual Clauses.

9. Payment processing (Dodo Payments — Merchant of Record)

We use Dodo Payments as Merchant of Record (MoR) to handle payments. Dodo acts as the legal seller/merchant and handles payment processing and tax remittance. In this context Dodo processes the data required for payment (e.g. name, email, billing and payment data) under its own or joint responsibility. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). The contracting party for the purchase and the entity responsible for payment processing is Dodo Payments Inc., a company organised under the laws of the US state of Delaware (Dover, Delaware, USA), where applicable together with its group companies (including in the United Kingdom). Where personal data is processed outside the EU/EEA in this context, this is based on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914); Dodo is currently not certified under the EU-US Data Privacy Framework. Details in Dodo's privacy policy: https://dodopayments.com/legal/privacy-policy.

10. Authentication (Clerk)

We use Clerk, Inc. (San Francisco, California, USA) as our authentication and account-management provider for guide sign-in (email code, and Google/Apple social sign-in). Clerk processes the data necessary for account creation and session management (e.g. email address, authentication tokens, sign-in method). Legal basis: Art. 6(1)(b) GDPR (performance of a contract) for account-holders, otherwise Art. 6(1)(f) GDPR (legitimate interest in secure authentication). Where personal data is processed outside the EU/EEA in this context, this is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). If you have a paid subscription, we additionally store a technical reference linking your account ID to the subscription ID in a Redis database provided by Upstash, Inc. (see sections 5 and 8), so that your subscription can be cancelled reliably if you delete your account; this reference is deleted when the subscription ends. Legal basis: Art. 6(1)(b) GDPR.

11. Contact

If you contact us by email, we process the details you provide (in particular your email address and the content of your message) in order to handle your request. Legal basis: Art. 6(1)(b) GDPR where your request concerns the conclusion or performance of a contract, otherwise Art. 6(1)(f) GDPR (interest in responding to enquiries). Where the website opens a pre-filled email in your own mail program for this purpose, the entered data leave your device only when you send the email yourself.

12. Retention

We store personal data only as long as necessary for the respective purposes or as required by statutory retention periods (log files: short-term; payment data: statutory periods).

13. Changes to this notice

We update this privacy notice when our data processing changes. Last updated: 22 July 2026.