Privacy Policy
Last updated: 3 November 2026
This policy explains what VISTANOVA GLOBAL LIMITED ("we", "us") collects when you use the Fluentilo app and this website (together, the "service"), why, who helps us run it, and what choices you have. We keep it short on purpose. We collect only what the service needs, we do not show ads, and we do not sell your data.
Who we are
VISTANOVA GLOBAL LIMITED, 10 Iasonos Street, Court Dalia 3, Flat 17, 8041 Paphos, Cyprus. Contact: info@fluentilo.com.
Who the service is for
Fluentilo is for people aged 14 and over. We do not knowingly collect data from anyone younger. If you believe a child under 14 has an account, write to us and we will delete it.
What we collect
| What | Why | Where it lives |
|---|---|---|
| Email address and password (the password is stored only as a secure hash, we cannot read it) | Your account and logging in | Our account database |
| Date of birth | To confirm the age group the service is meant for | Our account database |
| Device information: a random install ID and the device model name (for example "Pixel 8") | To enforce the limit of two devices per account and let you manage them | Our account database |
| Your plan (free or premium) and when it ends | To unlock the right content | Our account database |
| Usage counters: how many lesson-file download links and AI feedback requests your account made each day | To protect the service from abuse and to control costs | Our account database |
| Invites and referrals: which invite or promoter link or code your account joined with, whether your first payment counted, and, if you invite friends, your invite code, when you accepted the Invite a friend terms and the free months you earned | To give rewards for invitations, to apply a promoter discount and to prevent abuse (Invite a friend terms). People who invited you see only counts, never your name or email | Our account database. Your invite code is also noted on your RevenueCat record |
| Promoters only (people we invite to promote Fluentilo): name, mobile number, email if given, city, where they promote, payout method and payout account number, and when they accepted the promoter agreement | To run the promoter programme and pay rewards (promoter agreement) | Our account database. The payout account number is stored encrypted |
| Website visits through an invite or promoter link: the time, the type of device and a scrambled (hashed) form of your internet address | To count visits once per hour without knowing who you are. We never store the address itself | Our account database |
| Your lesson progress, scores, settings and downloaded audio | To continue where you left off | On your phone only. We do not receive it. |
| Your voice, when you record yourself in a speaking checkpoint, and the text you write in a writing checkpoint | To give you feedback and a score | Sent to our AI provider (below) for that one request. We do not store it. The recording is deleted from your phone as soon as it is read, and it is not kept on our servers. |
We do not collect your location, contacts, photos or advertising ID. The app asks for the microphone only for speaking practice, and only when you start a recording.
We do not use advertising or tracking tools in the app or on this website, and the website sets no cookies.
Who helps us run the service
These companies process data for us, only to provide the service:
- Supabase: accounts and our database.
- Amazon Web Services (AWS): stores and delivers the lesson content and audio. Your account details are not sent there; a time-limited link is used for premium files.
- Google (Gemini API): gives AI feedback on your writing and speaking checkpoints. It receives only the text or audio of that attempt and our grading instructions, never your name or email.
- Resend: sends our emails (for example the confirmation when you delete your account).
- Google Play / Apple App Store: handle payments when paid plans are on sale. They tell us whether a subscription is active; we never see your card details.
- RevenueCat: connects the store's subscription records to your Fluentilo account. It receives your random account ID and the store's record of your purchase (which plan, when it started and ends). It does not receive your card details or your name.
These providers may process data outside your country. We ask each of them to protect it to a standard comparable to this policy.
How long we keep it
We keep your account data while your account exists. When you delete your account, your profile, devices, plan record and usage counters are deleted straight away. Encrypted backup copies of our account database expire after 30 days. We may keep a minimal record if the law requires it.
Your choices and rights
- Delete your account yourself in the app (Profile, then Delete my account), or by email, see how to delete your account.
- Change your email, password or date of birth in the app's Profile.
- Ask us for a copy of your data, or to correct it, by emailing info@fluentilo.com.
- Depending on where you live (for example in the EU, the UK or Bangladesh) you may have further rights, such as to object or to complain to your data protection authority. We will respect them.
Security
Connections are encrypted (HTTPS). Passwords are stored as hashes. Access to the database is limited by rules that let each account see only its own data. No system is perfectly secure, so please choose a strong password.
Changes
If we change this policy in a way that matters, we will update the date above and tell you in the app.