Privacy Notice

1. Controller. Brava Capital BV ("we", "us") acts as the data controller for the personal data collected via the Words4.me service. Contact: support@words4.me.

2. Categories of personal data we collect.

• Account data — email address, hashed password, chosen languages, UI preferences.
• Learning data — words you add, training results, spaced-repetition schedule.
• AI interaction data — words, sentences and prompts you submit to AI features (translation, sentence generation, the Mia assistant), and the outputs returned to you.
• Usage/telemetry — pages visited, session duration, device/browser info, IP address.
• Support messages — content you send to us.

3. Purposes and legal basis.

• Providing and personalising the service, including AI-assisted features (contract performance).
• Account authentication and security (legitimate interest, legal obligation).
• Product analytics and improvement (legitimate interest).
• Customer support (contract performance).
• Compliance with legal obligations (legal obligation).

4. Data sharing / subprocessors. We share personal data with carefully selected service providers who act on our behalf:

• Paddle.com Market Ltd — Merchant of Record for the sale of our products, subscription management, payments, tax compliance and invoicing.
• Supabase — database and authentication hosting.
• Cloudflare — application hosting and content delivery.
• Lovable AI Gateway (and its upstream model providers, incl. Google) — processing of AI prompts and outputs. Prompts and outputs are used to serve your request and are not used by us or by these providers to train foundation models.
• Professional advisers and authorities where required by law.

4a. AI processing. When you use an AI feature, the words, sentence or prompt you submit — together with limited context needed to produce a good response — is sent to the Lovable AI Gateway and processed by the underlying model provider. AI interaction data is retained only as long as needed to deliver the feature, respond to support requests, and detect abuse.

5. International transfers. Some subprocessors are located outside the EEA. We rely on the European Commission's Standard Contractual Clauses and/or adequacy decisions to safeguard such transfers.

6. Retention. Account and learning data are kept for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where a longer retention is required by law (e.g. financial records — typically 7 years).

7. Your rights (GDPR). You have the right to access, rectify, erase, restrict processing, port and object to processing of your personal data, and to withdraw consent at any time. You may lodge a complaint with your local supervisory authority. To exercise your rights contact support@words4.me; we respond within one month.

8. Security. We apply appropriate technical and organisational measures including encryption in transit, encryption at rest, access controls, audit logging and least-privilege database policies.

9. Cookies. We use strictly necessary cookies for authentication and session management. We do not use advertising or third-party tracking cookies.

10. Changes. We may update this notice. Material changes will be communicated via the service.