Privacy Policy
Last updated: 26 August 2026
Unreviewed draft
This page is a first-pass draft written ahead of legal review. It has not been checked by a qualified lawyer and should not be relied on as final until it has.
This policy explains what personal data Gesprek collects, why, and what rights you have over it. It is written to match how the product actually works today, not a generic template.
Our registered address below is missing its postal code and city — flagged here rather than guessed at, and pending confirmation before this page leaves draft status.
1. Who controls your data
The controller of your personal data is Applied Minds (eenmanszaak), KVK 42069132, VAT 487327056B01, registered at Klabots 22, the Netherlands. You can reach us at support@gesprek.org.
2. What data we collect
Account details (email, password hash); profile and learning preferences; your learning progress, including free-text practice answers; if you subscribe, billing name, address and a payment reference (card details themselves go straight to our payment processor and never reach us); if you enable push reminders, your device’s push endpoint and chosen reminder times; if you contact us or apply to teach, the details you submit in that form.
3. Why we process it, and on what legal basis
Providing the service and tracking your learning progress: performance of our contract with you. Billing and invoicing: contract, plus our legal obligation to keep invoices for 7 years under Dutch tax law. Transactional email (confirmation, password reset): contract — these are not optional and cannot be turned off while your account is active. Push reminders and marketing email: your consent, withdrawable at any time. Responding to a teacher enquiry, and improving the product from in-app feedback: our legitimate interest, each backed by a written assessment weighing that interest against your rights. Keeping the service secure: legitimate interest — rate-limiting data is held only in memory and is never written to disk.
4. Who we share it with
We share data only with the processors needed to run the service, each under a data processing agreement: Hetzner (hosting the database and API, Nuremberg, Germany), Cloudflare (DNS, CDN, and audio file storage), Vercel (hosting the web app), Microsoft Azure (converting lesson text to speech — no learner data is sent), Anthropic (drafting lesson content for staff review — no learner data is sent), Scaleway (sending transactional email from an EU-based sender), and, once you subscribe, Stripe (billing and EU VAT). We do not sell your data, ever.
5. Data transferred outside the EU
Our infrastructure runs in the EU by default — Hetzner Nuremberg, Vercel Frankfurt, Scaleway Paris, and EU regions for Cloudflare and Stripe. Where a processor is headquartered outside the EU, we rely on their EU-region hosting together with Standard Contractual Clauses.
6. How long we keep it
We keep your account and learning data for as long as your account is active. If you delete your account, it is disabled for 30 days — during which you can restore it — and then anonymised: your email, password, and any free-text answers or messages are permanently removed, while learning-history rows may be kept, no longer linked to you, to improve how the app teaches. Invoices are kept 7 years, as Dutch tax law requires.
7. Your rights
You can ask to access, correct, export, restrict, or erase your personal data, and you can object to or withdraw consent for any processing based on it. Some of these are already self-service — editing your profile, deleting your account — and some are still handled by emailing support@gesprek.org, with a response inside one month as the law requires. You can stop sharing your progress with a teacher at any time from your cohort settings, with immediate effect.
8. Complaining to a supervisory authority
You can lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in whichever EU country you live in.
9. Automated decision-making
Gesprek chooses what to show you next based on your own past answers — the same kind of spaced-repetition logic language apps have used for years. It shapes your practice queue, not any legal or similarly significant decision about you, so it is not automated decision-making in the sense the law regulates.
10. Cookies
Cookies and similar technologies are covered in full in our Cookie Policy.
11. Children’s data
Direct signup is for learners aged 16 and over — the age of consent the Netherlands has set for this kind of service. Younger learners can only use Gesprek through a school that has arranged it with us; in that case, the school — not Gesprek — is the controller for its pupils’ data, and we act only as its processor under a separate written agreement.
12. Contact
For anything in this policy, email support@gesprek.org.
Questions about this page can be sent to support@gesprek.org