implly Privacy Policy
1. Data Controller
The controller of your personal data is Paweł Kiełtyka, conducting business as Be Agile Paweł Kiełtyka, registered at ul. Zapolskiej 7/37, 43-100 Tychy, Poland, Tax ID (NIP) 6462702113 (EU VAT: PL6462702113), REGON 363948798 (the “Controller” or “we”), owner and operator of the website available at implly.com (the “Service” or “implly”).
Data-protection contact: contact@implly.com.
2. Data Protection Officer
The Controller has not appointed a Data Protection Officer (the conditions of Art. 37 GDPR do not apply). For all data-protection matters you may contact the Controller directly at contact@implly.com.
3. What data we process
In connection with your use of the Service we process:
- Account data: email address, preferred interface language, age declaration (adult / use under guardian supervision), consents you have given.
- Learning data: recordings of your voice, their transcripts, generated scenarios, reports, flashcards, and pronunciation/progress statistics.
- Technical & usage data: IP address, device and browser information (user-agent), login-session data, country derived from your IP, event logs, and AI-usage data (for internal billing and limits).
- Billing data: chosen plan and subscription status, and payment metadata. We do not store your payment-card data — it is handled by our payment operator, Stripe (see section 6).
- Contact/reports: the content of reports submitted via the “Report a problem” form or by email.
3.1. Voice recordings — special note
We use recordings of your voice solely for speech recognition (transcription) and pronunciation assessment in order to provide the Service. The audio file is deleted immediately after it is processed (transcribed); we keep only the transcript and analysis results needed to generate reports and track progress. We do not use your voice to uniquely identify you, and therefore we do not process biometric data within the meaning of Art. 9 GDPR.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| Creating and running an account, providing the learning services (transcription, reports, flashcards, pronunciation) | Performance of a contract — Art. 6(1)(b) GDPR | For the life of the account; after deletion — until limitation periods for claims expire |
| Handling payments and subscriptions, issuing accounting documents | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c) — accounting and tax law) | Billing records: 5 years from the end of the year in which the tax obligation arose |
| Security (anti-bot protection, abuse detection, error monitoring), operation and quality improvement | Legitimate interest — Art. 6(1)(f) GDPR | Logs and session data: up to 12 months; error data: up to 90 days |
| Statistical traffic analytics (Google Analytics 4) | Consent — Art. 6(1)(a) GDPR (Consent Mode v2) | Until consent is withdrawn; data in GA4 per the configured retention (14 months) |
| Cookieless analytics (Plausible) | Legitimate interest — Art. 6(1)(f) (aggregated data, no identification) | Aggregated statistics, indefinitely |
| Handling reports, complaints and correspondence | Legitimate interest (Art. 6(1)(f)) and legal obligation ((c)) for complaints | Until the matter is closed and limitation periods expire |
5. Is providing data mandatory
Providing data is voluntary, but providing your email and the necessary account data is a condition for concluding and performing the contract to use the Service — without it we cannot create an account or provide the services. Providing data for consent-based analytics (cookies) is entirely voluntary and does not affect access to the Service.
6. Recipients (processors)
We entrust data to the following providers, who process it only on our documented instructions under data-processing agreements (Art. 28 GDPR):
- Supabase — database hosting, authentication and file storage (region: Ireland, EU);
- Vercel — application hosting and delivery;
- AssemblyAI — speech recognition (transcription of recordings);
- Microsoft Azure (Azure AI Speech) — speech synthesis and pronunciation assessment (region: North Europe);
- OpenRouter (and the model providers it exposes) — content generation and translation via language models;
- Stripe — payment and subscription processing (payment operator; controller of card data);
- Resend — sending emails (transactional and sign-in);
- Cloudflare — anti-bot protection (Turnstile);
- Sentry — application error monitoring (region: EU — Germany);
- Google (Google Analytics 4) — statistical analytics (only after consent);
- Plausible Analytics — cookieless analytics;
- accounting/legal advisers and supporting-tool providers — to the extent necessary.
Data may also be disclosed to authorised state bodies where required by law.
7. Transfers outside the EEA
Some of our providers process data within the European Economic Area (e.g. Azure — North Europe, Sentry — EU, Supabase — Ireland). Some providers (e.g. Stripe, Google, Vercel, OpenRouter, AssemblyAI) may process data outside the EEA, including in the USA. In such cases the transfer is based on appropriate safeguards under Art. 46 GDPR — Standard Contractual Clauses (SCCs) approved by the European Commission or certification under the EU–US Data Privacy Framework (DPF). You may request a copy of the safeguards by contacting the Controller.
8. Your rights
You have the right to:
- access your data and obtain a copy (Art. 15);
- rectification (Art. 16);
- erasure — the “right to be forgotten” (Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time — without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
You can delete your account (with its data) at any time in account settings, and withdraw analytics consents via the “Cookie settings” button in the Service footer. To exercise the remaining rights, write to contact@implly.com.
9. Right to complain
If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
10. Automated decisions and profiling
We use AI models to generate content and to assess pronunciation and progress. However, we do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR.
11. Cookies and analytics technologies
The Service uses cookies and similar technologies based on the Polish Electronic Communications Law (PKE) and the GDPR. We categorise them as:
- Necessary (no consent required) — sign-in and session, security and anti-bot protection (Cloudflare Turnstile), payments (Stripe), remembering your language and cookie choice.
- Analytics — statistics (consent required) — Google Analytics 4, loaded only after consent (Google Consent Mode v2, default “denied”).
- Cookieless analytics — Plausible, operating without tracking or user identification (no consent required).
- Error monitoring — Sentry, processed for security and stability (personal data minimised; no Session Replay).
You give consent in the banner on your first visit (equally prominent “Accept” and “Reject” options). You can change or withdraw it at any time via “Cookie settings” in the footer — withdrawing is as easy as giving consent.
12. Security
We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including transport encryption (TLS), role- and rule-based access control (RLS), anti-bot protection, and data minimisation (including prompt deletion of audio recordings).
13. Minors
The Service is intended for persons who are at least 16 years old. Persons under 16 may use the Service only with the consent and under the supervision of a parent or legal guardian who is the account holder and accepts this Policy and the Terms. Paid contracts (subscriptions) may be concluded only by an adult with full legal capacity.
14. Changes to this Policy
We may update this Policy. We will notify you of material changes in advance (e.g. by email or a notice in the Service). The current version, with its effective date, is always available at implly.com/privacy.