Data Privacy Policy

1. Overview

Ivana ("we", "us", "our") operates the website www.ivana.hr and a Telegram bot that provides personalised Croatian-language tutoring to migrant workers and language learners. This policy explains what personal data we collect, why we collect it, and how we handle it.

2. Data we collect

• Account data: e-mail address, display name, language preference, and (when signing in via Telegram or Facebook) the provider user ID returned by the OAuth flow.
• Learning data: answers to onboarding questions, lesson progress, scores, words unlocked, and timestamps of activity.
• Technical data: IP address, browser user-agent, and basic request metadata, kept only for security and abuse-prevention purposes.
• Voice / image input: if you send a voice message or photo to the tutor, the file is transcribed or analysed by a third-party model and then deleted from our storage within 24 hours.

3. Why we collect it

• To create and operate your learner account.
• To personalise lessons, vocabulary suggestions, and progress tracking.
• To improve the tutor's response quality through aggregate, de-identified usage statistics.
• To comply with legal obligations.

4. Third-party processors

We use the following sub-processors. Each is bound by a Data Processing Agreement and operates under either EU GDPR or an equivalent adequacy framework:

• Supabase (database & authentication, EU region)
• Vercel (hosting & CDN)
• Anthropic, OpenAI, Groq, ElevenLabs (AI model providers)
• Telegram Messenger LLP (bot delivery, only when using Telegram channel)
• Meta Platforms, Inc. (only if you sign in via Facebook)

5. Retention

Account and learning data are retained while your account is active and for up to 12 months after deletion (for backup and audit purposes), unless legal obligations require longer storage. Voice and image inputs are deleted within 24 hours of processing.

6. Your rights

Under GDPR you have the right to access, correct, export, restrict, or delete your personal data. Requests can be sent to privacy@ivana.hr. For account deletion, see our Data Deletion page.

7. Contact

Data controller: ROMIC d.o.o., Zagreb, Croatia.
E-mail: privacy@ivana.hr