Privacy Policy
Last updated: September 2026
What we collect, why, who processes it, and the rights you have over it.
1. Who is responsible for your data
Midsentence ("we", "us") is a language practice application operated by Sébastien Postansque, a sole proprietorship (Jednoosobowa Działalność Gospodarcza) registered in Poland.
Registered address: Aleja 3 Maja 7A/54, 00-401 Warsaw, Poland
Contact: [email protected]
We are the data controller: we decide why and how your personal data is processed, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Polish data protection law.
2. What we collect
Account data. Your email address (used to sign you in with a one-time code and to contact you about the service), your name, the language you are learning, the language you want explanations in, and any note you write about yourself for the tutor.
Learning content. The messages you type, transcripts of what you say, the replies generated for you, the conversations and scenarios you choose, and the notes and cards you save. Every conversation is with artificial intelligence, not a person, and no human reads them.
Moderation records. If a situation you write is refused, or the AI declines a request, we record the time, the reason and a short extract, so that we can enforce our terms and meet the obligations our providers place on us.
Voice. When you speak, the audio is sent to our speech-to-text provider to be transcribed. We keep the transcript, not the recording. Audio is not stored on our servers.
Subscription data. Your subscription status and identifiers from Paddle, our payment provider. We never see or store your card details; Paddle handles payment entirely.
Technical data. IP address, device and browser type, and request logs, collected automatically for security and to keep the service working.
3. Why we are allowed to process it
- To perform our contract with you (Art. 6(1)(b) GDPR): running your account, conversations, notes and subscription.
- Your consent (Art. 6(1)(a)): using your microphone. Your browser asks you first, and you can revoke it at any time in your browser settings.
- Our legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, and improving it using aggregated, anonymised usage.
- Legal obligations (Art. 6(1)(c)): keeping billing records for as long as tax and accounting law requires.
4. What we use it for
- To sign you in and run your account
- To hold conversations with you, generate replies, and produce your notes
- To transcribe your speech and, where you choose voice, to read replies aloud
- To send login codes and service emails
- To manage your subscription and confirm payment status
- To detect and prevent abuse and security incidents
We do not use your data for advertising or profiling, we do not make automated decisions about you, and we do not use your conversations to train AI models.
5. Who processes it on our behalf
We share data only with the providers below, each bound by a contract to process it solely on our instructions.
| Provider | Purpose | Data |
|---|
| Hetzner Online GmbH | Hosting (Germany, EU) | All service data, stored in the EU |
| Anthropic PBC | Generating replies and notes | Conversation text and your tutor settings |
| ElevenLabs Inc. | Speech to text, text to speech | Audio you speak; text to be read aloud |
| Paddle.com Market Ltd | Payments (merchant of record) | Email address; Paddle handles card details |
| Resend Inc. | Login codes and service email | Email address and message content |
| Cloudflare Inc. | DNS, CDN and protection from attacks | IP address and request metadata, in transit |
We do not sell, rent or trade your personal data.
6. Transfers outside the EU
Your data is stored in the European Union. Some providers above are based in the United States or the United Kingdom. Transfers to them rely on the safeguards the GDPR requires: Standard Contractual Clauses and, where the provider participates, the EU-U.S. Data Privacy Framework. The United Kingdom benefits from an adequacy decision of the European Commission.
7. How long we keep it
- Account data, conversations and notes: for as long as your account exists. Deleted within 30 days of you deleting your account.
- Voice recordings: not retained. Only the transcript is kept, with your conversation.
- Billing records: up to 5 years after the subscription ends, as Polish tax and accounting law requires.
- Technical logs: at most 90 days.
8. How we protect it
- All traffic is encrypted in transit (TLS 1.2 or higher)
- Data is stored on servers in the EU, with access limited to what is needed to run the service
- Sign-in uses one-time codes sent to your email, so there is no password to steal
- We keep transcripts, not audio
No system is perfectly secure. If a breach were to put your rights at high risk, we would notify you and the supervisory authority within 72 hours, as the GDPR requires.
9. Your rights
If you are in the European Economic Area, the United Kingdom or Switzerland, you can ask us to:
- Give you a copy of the data we hold about you
- Correct data that is wrong or incomplete
- Delete your data (you can also delete your account yourself, in settings)
- Restrict how we use it while a concern is resolved
- Hand it over in a portable, machine-readable format
- Stop processing that relies on our legitimate interests
- Withdraw consent, for example for microphone use, at any time
Write to [email protected] and we will answer within 30 days. If you are not satisfied, you can complain to the Polish supervisory authority:
Urząd Ochrony Danych Osobowych (UODO)ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl
10. Cookies
We use only strictly necessary cookies and local storage: one to keep you signed in, and one to remember your preferences such as light or dark mode. No tracking, analytics or advertising cookies. Because these are exempt under Article 5(3) of the ePrivacy Directive, no cookie banner is needed.
11. Children
Midsentence is not intended for anyone under 16. We do not knowingly collect data from children under 16 and will delete it if we learn we have. If you think a child has given us data, please tell us at [email protected].
12. California residents
If you live in California, the CCPA gives you additional rights. We do not sell personal information. You may ask what we collect, ask for it to be deleted, and you will not be treated differently for doing so. Contact [email protected].
13. Changes to this policy
If we make a material change to how we handle your data, we will tell you by email or with a clear notice in the app at least 14 days before it takes effect. The date at the top shows when this policy was last revised.