Privacy Policy

Who is responsible for your data

The data controller is the operator of NativeSpeaker, identified below. We are established in the United States and provide this service to users in Poland and the wider EU. You can contact us at any time about your data using the details at the end of this policy.

What data we collect

• Account data — your email address, an encrypted (hashed) password, your language preference, and, if you sign in with Google, the basic profile information Google provides.
• Teacher profile data — anything you choose to publish: your name, description, photo, hourly rate, contact details, website, the languages and qualifications you list, and your location (city, region and approximate coordinates). This information is public by design, so please only publish what you are comfortable sharing.
• Messages — the content of messages sent through the site's contact forms, and the sender's email address, so that teachers can reply.
• Payment data — we record which subscription you bought, when it starts and ends, the amount, and a link to your invoice. Card details are entered directly with our payment provider and never reach our servers.
• Technical data — IP address, browser type, and the pages you visit, recorded in an activity log used for security, abuse prevention and troubleshooting.

Why we use it, and on what legal basis

• To provide the service — creating your account, publishing your profile, running searches and delivering messages. Legal basis: performance of a contract with you.
• To review profiles before they go live, including an automated check that helps us detect spam and inappropriate content. A human reviews profiles that are flagged; automated checks alone do not permanently block your profile. Legal basis: our legitimate interest in keeping the marketplace safe and accurate.
• To take payment for Premium listings and Featured boosts and to issue invoices. Legal basis: performance of a contract, and compliance with tax and accounting obligations.
• To send service emails you would expect — confirming your address, resetting your password, notifying you about your profile status and new messages. Legal basis: performance of a contract and our legitimate interest in keeping you informed.
• To understand how the site is used so we can improve it, using privacy-focused analytics hosted in the EU. Legal basis: our legitimate interest in improving the service.
• To keep the site secure — rate limiting, spam prevention and the activity log. Legal basis: our legitimate interest in protecting the service and its users.

Who we share data with

We do not sell your personal data. We share it only with the service providers we need to run the site, each of which processes it on our instructions:

• Stripe — payment processing, invoicing and tax calculation.
• Resend — delivery of the service emails described above.
• PostHog (EU region) — product analytics.
• Anthropic or OpenAI — the automated profile review described above. Only the profile content being reviewed is sent; it is not used to train their models.
• hCaptcha — protecting forms from automated abuse.
• Google Maps — address and city suggestions when you type a location.
• Our hosting provider — operating the servers and encrypted backups.

We may also disclose data where we are legally required to do so.

International transfers

We are based in the United States, so your data is processed outside the EEA. Where data is transferred out of the EEA, we rely on the safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses. Our analytics data is hosted in the EU.

How long we keep it

We keep your account and profile data for as long as your account exists. If you delete your account, your profile is hidden immediately and the account is permanently erased after 30 days. Records we must keep for tax and accounting purposes — such as invoices — are retained for the period required by law, even after your account is deleted.

Your rights

Under the GDPR (RODO) you have the right to access your data, to correct it, to have it erased, to restrict or object to how we use it, and to receive a copy in a portable format. Where we rely on your consent, you may withdraw it at any time. Most of this you can do yourself from your dashboard; otherwise contact us and we will action it.

If you believe we have handled your data improperly, you may complain to your local data protection authority — in Poland, the President of the Personal Data Protection Office (UODO).

Cookies

We use cookies that are necessary for the site to work, such as keeping you signed in. See our Cookie Policy for details. Cookies

Security

Passwords are stored hashed, traffic is encrypted in transit with HTTPS, and backups are encrypted before they leave our servers. No system is perfectly secure, but we take reasonable measures to protect your data.

Changes to this policy

We may update this policy from time to time. Any changes will be published on this page with a new 'last updated' date.

Contact us

For any question about this policy or your personal data, contact us at [email protected].