In short: we collect only what we need to run Lisaany — your email, your learning progress, and basic technical data. We never sell your personal information, we never show ads, and you can delete your account and data at any time by emailing admin@lisaany.com.
Lisaany ("Lisaany", "we", "us", "our") operates the website at lisaany.com, the Lisaany mobile applications for Android and iOS, and related content and services (together, the "Services"). Lisaany is the data controller responsible for the personal information described in this Privacy Policy.
This policy applies to everyone who uses the Services, wherever they are located. It explains what information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have. By using the Services you acknowledge that you have read this policy. If you do not agree with it, please do not use the Services.
Our Services are governed by this policy together with our Terms & Conditions.
We collect information in three ways: information you give us, information generated when you use the Services, and information from the platforms that distribute our apps.
| Category | Examples | Required? |
|---|---|---|
| Account information | Email address; password (stored only as a one-way cryptographic hash by our authentication provider) | Yes, to create an account |
| Profile and preferences | Display name (optional); learning goal; interface language; notification preferences | Optional |
| Communications | The content of messages you send us (support requests, feedback, deletion requests) | Optional |
| Category | Examples |
|---|---|
| Learning data | Lessons and units completed, quiz answers and scores, vocabulary review schedules, streaks, XP, time spent in the Services |
| Technical and device data | App version, operating-system version, device model, screen size, language setting, IP address (used transiently for security and to deliver content), crash and error reports |
| Usage data | Which features and screens are used, timestamps of sessions, and diagnostic events that help us fix problems |
If you purchase a subscription through Google Play or the Apple App Store, we receive a confirmation of the purchase (such as a purchase token, product identifier, subscription status and expiry date) so we can unlock Premium features. We do not receive your card number, billing address or full payment details from any payment provider.
The Services do not access your precise location, contacts, photos, camera, microphone, calendar or files. We do not collect government identifiers, biometric data, health data, or other special categories of personal information, and we ask you not to include such information in messages to us.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects, and we do not use it to build advertising profiles.
Where data-protection law (such as the EU/UK GDPR) requires a legal basis, we rely on the following:
| Purpose | Legal basis |
|---|---|
| Providing the Services and managing your account and subscription | Performance of our contract with you |
| Security, fraud prevention, service improvement, aggregated analytics | Our legitimate interests in operating, protecting and improving the Services, balanced against your rights |
| Marketing communications; optional features | Your consent, which you may withdraw at any time |
| Tax, accounting and legal compliance | Compliance with legal obligations |
We do not sell your personal information, and we do not share it with third parties for their own marketing.
We share personal information only in the following circumstances:
Companies that process data on our behalf and under our instructions, bound by contractual confidentiality and data-protection obligations:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Authentication, database and storage of accounts and learning progress | United States / EU |
| Cloudflare | Website hosting, content delivery, audio file delivery, security (DDoS protection) | Global network |
| Stripe | Payment processing for purchases made on the website | United States / EU |
| Google Play / Apple App Store | App distribution, in-app purchases and subscriptions | United States |
| Capgo | Delivery of lesson-content updates to the mobile apps | EU |
| Email delivery provider | Sending account and support emails | United States / EU |
We may disclose information if we believe in good faith that it is necessary to comply with a law, regulation, court order or lawful governmental request; to enforce our Terms; or to protect the rights, property or safety of Lisaany, our users or the public.
If Lisaany is involved in a merger, acquisition, financing, reorganisation or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or in the use of your personal information, and of any choices you may have.
We share information with third parties when you ask us to or otherwise consent.
We may share information that cannot reasonably be used to identify you — for example, the percentage of learners who complete a module.
Payments on the website are processed by Stripe; purchases in the Android app are processed by Google Play; purchases in the iOS app are processed by Apple. Your payment details are entered directly with the payment provider and are handled under that provider's privacy policy: Stripe, Google, Apple. We never see or store your full card number. We retain records of transactions (amount, date, product, and a provider transaction reference) as required for accounting and to resolve disputes.
In addition to the information described above, our mobile apps:
Deleting your account and data. You may delete your account, and all personal information and learning data associated with it, at any time by emailing admin@lisaany.com from the email address on the account with the subject line "Delete my account". We will confirm and complete the deletion within 30 days, except for records we are legally required to keep (see Section 10). Uninstalling the app removes locally stored data from your device but does not delete your account.
Our website uses only strictly necessary cookies and browser storage: to keep you signed in, remember your preferences and progress, protect against fraud, and balance load on our servers. We do not use advertising cookies, cross-site tracking or third-party analytics cookies. Because we use no non-essential cookies, no cookie consent banner is required; you can still block or delete cookies in your browser settings, though some features may then stop working. We do not currently respond to browser "Do Not Track" signals because we do not track you across sites.
Lisaany operates internationally and our service providers are located in several countries, including the United States and the European Union. Your information may therefore be transferred to, stored and processed in a country other than your own, where privacy laws may differ. Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, adequacy decisions, or the EU-U.S. Data Privacy Framework where the recipient is certified. You may contact us for more information about these safeguards.
| Data | Retention period |
|---|---|
| Account and learning data | For as long as your account is active. Deleted within 30 days of an account-deletion request. |
| Inactive accounts | Accounts with no sign-in for 36 months may be deleted after we email you a notice. |
| Transaction records | 7 years, as required by tax and accounting law. |
| Support correspondence | Up to 24 months after the matter is resolved. |
| Technical logs and crash reports | Up to 90 days, unless needed longer to investigate a security incident. |
| Backups | Deleted data may persist in encrypted backups for up to 35 days before being overwritten. |
We use administrative, technical and physical safeguards designed to protect your information, including encryption in transit (TLS/HTTPS) and at rest, hashed passwords, access controls limited to personnel who need access, and reputable infrastructure providers with independent security certifications. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law. Please use a strong, unique password and contact us immediately if you suspect unauthorised access to your account.
Depending on where you live, you may have the right to:
To exercise any of these rights, email admin@lisaany.com. We will verify your identity (usually by confirming control of the account email) and respond within 30 days, or sooner where the law requires. We will not discriminate against you for exercising your rights. You may also authorise an agent to make a request on your behalf, subject to verification.
You have the rights described in Section 12 under the GDPR, UK GDPR and Swiss FADP. You may complain to the supervisory authority in the country where you live or work, or where an alleged infringement occurred.
We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. You may withdraw consent subject to legal or contractual restrictions, and you may complain to the Office of the Privacy Commissioner of Canada.
In the past 12 months we have collected the categories of personal information described in Section 2 and disclosed them to the service providers described in Section 5 for business purposes. We do not sell or "share" personal information as those terms are defined under the California Consumer Privacy Act, and we do not use or disclose sensitive personal information for purposes that require a right to limit. California residents have the rights to know, delete, correct and non-discrimination described in Section 12.
We process personal information in accordance with the Saudi Personal Data Protection Law (PDPL) and its implementing regulations. Where the PDPL requires consent for a particular processing activity, we will obtain it, and you may withdraw it at any time.
If your local law grants you additional rights, we will honour them. Please contact us.
The Services are intended for a general audience and are not directed at children under 13 (or the age of digital consent in your country, if higher). We do not knowingly collect personal information from children below that age without verifiable parental consent. Learners under 18 should use the Services with the involvement of a parent or guardian, who may contact us to review, correct or delete a child's information. If you believe a child has provided us with personal information without appropriate consent, email admin@lisaany.com and we will delete it promptly.
The Services may contain links to third-party websites, apps or services (for example, WhatsApp support, app stores, or educational resources). We are not responsible for the privacy practices of those third parties, and this policy does not apply to them. We encourage you to read their privacy policies.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we do, we will revise the effective date and version number above. If a change materially affects how we use your personal information, we will give you reasonable advance notice — for example, by email or a notice within the Services — and, where required by law, seek your consent. We encourage you to review this page periodically. Previous versions are available on request.
Questions, requests or complaints about this policy or our handling of your information may be sent to:
Lisaany — Privacy
Email: admin@lisaany.com
Address: Madina Munawwarah, Kingdom of Saudi Arabia
Website: lisaany.com
We aim to acknowledge every privacy request within 5 business days and to resolve it within 30 days.