1. Who we are
The Hakso English School Oy, a company registered in Finland, is the data controller for personal data collected through Waterwheel Village. We are responsible for deciding how and why your data is processed.
2. Data we collect
- Account data: email address, password (stored hashed), display name, and — if you sign in with Google — your Google account identifier and profile information you allow.
- Profile data: optional details you provide such as native language, learning goal, English level, and marketing-consent choice.
- Learning data: chapter progress, vocabulary you save, messages you send to villager characters, and "facts" the villagers remember about you to personalise conversations.
- Subscription data: your subscription status, plan, and billing-period dates (Paddle handles the actual payment data — see below).
- Technical data: IP address, browser type, device, and basic usage logs needed to operate the service securely.
3. Why we use it
- To create your account and provide the learning service (contract).
- To personalise your conversations with villager characters and remember your progress (contract).
- To keep the service secure, prevent fraud and abuse, and improve performance (legitimate interests).
- To send transactional emails (account, billing, support) — based on contract.
- To send occasional product news, only if you opted in to marketing communications (consent — you can withdraw at any time).
- To comply with legal obligations (tax, accounting, lawful requests).
4. Who we share it with
- Paddle.com Market Ltd — our Merchant of Record. Paddle processes payments, manages subscriptions, and handles tax compliance and invoicing on our behalf. See Paddle's privacy notice.
- Hosting and infrastructure providers (Lovable Cloud, which uses Supabase, and Cloudflare for serving the site) — to store data and run the application.
- AI providers (Google and OpenAI via the Lovable AI Gateway, and ElevenLabs for voice) — to power the villager chat and audio features. Your messages are sent to these providers solely to generate responses.
- Professional advisers (legal, accounting) and authorities where required by law.
We do not sell your personal data.
5. International transfers
Some of our service providers are based outside the EEA (for example in the United States). When data is transferred outside the EEA, we rely on safeguards such as Standard Contractual Clauses or adequacy decisions to protect it.
6. How long we keep it
We keep your personal data for as long as your account is active and for a reasonable period afterwards to comply with legal, accounting, or reporting obligations. When data is no longer needed it is deleted or anonymised.
7. Your rights
Under the EU General Data Protection Regulation (GDPR) you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- ask us to erase your data ("right to be forgotten");
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent;
- lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.
We aim to respond to requests within one month. Contact us through our support channel to exercise any of these rights.
8. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, access controls, and row-level security on our database. No system is perfectly secure, but we work continuously to keep your data safe.
9. Cookies
We use a small number of essential cookies and local storage to keep you signed in and remember your preferences. We do not currently use advertising or third-party tracking cookies. If that changes we will update this notice and ask for your consent where required.
10. Changes to this notice
We may update this notice from time to time. Material changes will be announced in the app or by email.
11. Contact
For privacy questions, contact The Hakso English School Oy through our support channel. For payment-related privacy questions, contact Paddle at paddle.net.