Privacy policy

VERBATICA — PRIVACY POLICY

How we collect, use and protect personal data in the Verbatica app and web platform.

Operator: LANGUAGEUP ARTIFICIAL INTELLIGENCE L.L.C, a limited liability company incorporated under the laws of the United Arab Emirates, trade licence No. 1260247 (Commercial Register No. 2128649), with its registered office at Office No. M2-57, Abdulrahman Mohammed Taher Mohammed Wali Building, Al Raffa, Dubai, United Arab Emirates (“LanguageUp”, the “Company”, “we”, “us” or “our”), operating the Verbatica service.

Effective date: 15 June 2026. Version: 2.0.

1. Introduction

1.1. This Privacy Policy explains how LANGUAGEUP ARTIFICIAL INTELLIGENCE L.L.C, as the data controller, processes personal data of users of the Verbatica mobile application (iOS and Android), the web platform and website at verbatica.ai (together, the “Service”).

1.2. We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”) and its implementing regulations. Where users located in the European Economic Area or the United Kingdom use the Service, we also take into account the requirements of the EU/UK General Data Protection Regulation (“GDPR”) to the extent applicable.

1.3. Questions about this Policy and requests regarding your data may be addressed to privacy@verbatica.ai.

2. Personal Data We Collect

2.1. Account data: name or nickname; e-mail address; identifiers received from sign-in providers (Sign in with Apple, Google); password hash (we never store plain-text passwords); profile settings, interface language, target language and learning level.

2.2. Learning data: answers to exercises and tests; writing submissions; messages exchanged with the AI conversation partner; vocabulary lists; progress, scores, streaks and error statistics.

2.3. Voice data: voice recordings you make in speaking exercises and pronunciation assessment, and transcripts generated from them. Recordings are processed in real time solely to generate transcripts and pronunciation feedback and are not stored after processing (see Section 8).

2.4. Payment data: subscription plan, transaction identifiers, purchase history and billing country. Payments are processed by Apple, Google or our payment service providers; we do not receive or store full payment card numbers.

2.5. Technical data: device type and model, operating system, app version, browser type, IP address, approximate location derived from IP, language settings, unique device or installation identifiers, crash logs and diagnostic data, and usage events within the Service.

2.6. Communications: the content of your messages to our support team and related metadata.

2.7. Cookie data: data collected through cookies and similar technologies on the Web Platform, as described in the Verbatica Cookie Policy.

2.8. We do not intentionally collect special categories of personal data (such as data revealing health, religion or biometric identification data) and ask you not to include such information in your User Content.

3. Sources and Methods of Collection

3.1. We collect personal data: (a) directly from you, when you register, fill in your profile, complete exercises, record audio, make purchases or contact support; (b) automatically, through the App, the Web Platform, cookies and similar technologies; and (c) from third parties, namely sign-in providers (Apple, Google) and app stores or payment providers (limited transaction confirmation data).

4. Purposes and Legal Bases of Processing

4.1. We process personal data for the following purposes and on the following legal bases (PDPL; for EEA/UK users, the corresponding GDPR bases are indicated):

• Providing the Service (account creation, lessons, exercises, AI chat, speech features, progress synchronisation across devices) — performance of a contract with you.
• Processing payments and managing subscriptions — performance of a contract; compliance with legal obligations (tax, accounting).
• Customer support — performance of a contract; our legitimate interest in resolving issues.
• Service analytics and improvement (understanding feature usage, fixing errors, improving learning content and AI quality) — our legitimate interest in improving the Service; consent where required for non-essential cookies or SDKs.
• Security and abuse prevention (fraud detection, enforcement of usage limits, protection of accounts) — our legitimate interest; compliance with legal obligations.
• Communications about the Service (transactional and service messages) — performance of a contract; legitimate interest.
• Marketing communications (newsletters, offers, push notifications of a promotional nature) — your consent, which you may withdraw at any time.
• Compliance with law (responding to lawful requests of competent authorities, record-keeping) — compliance with legal obligations.

4.2. Where processing is based on consent, you may withdraw consent at any time with effect for the future; this does not affect the lawfulness of processing carried out before withdrawal.

5. AI Processing

5.1. To provide AI features (the AI conversation partner, automated feedback, speech recognition and text-to-speech), the content you submit to those features (text messages, exercise answers, voice recordings and related context such as your learning level) is processed by AI models, including models hosted by third-party AI providers acting as our processors.

5.2. We contractually require such providers to use the data only to provide the service to us and not to use your content to train their general-purpose models, unless you have given separate explicit consent.

5.3. AI features may produce automated evaluations of your answers and pronunciation. These evaluations are used solely for educational feedback and adaptive learning within the Service and do not produce legal or similarly significant effects on you.

6. Disclosure of Personal Data

6.1. We do not sell personal data. We disclose personal data only to the following categories of recipients, to the extent necessary:

• Service providers (processors): cloud hosting and infrastructure providers; authentication and analytics services (including Google Firebase); AI model providers; speech-recognition and text-to-speech providers; e-mail and push-notification delivery services; customer-support tools; payment service providers. Processors act under our instructions and data-processing agreements.
• App stores and payment providers: Apple and Google process in-app purchases as independent controllers under their own privacy policies.
• Professional advisers and auditors, under confidentiality obligations.
• Competent authorities, where disclosure is required by applicable law or a binding order.
• A successor entity, in connection with a merger, acquisition or sale of assets, subject to this Policy continuing to apply or to notice of a new policy.

6.2. An up-to-date list of our key sub-processors is available on request at privacy@verbatica.ai.

7. International Data Transfers

7.1. Our service providers may be located outside the United Arab Emirates (including in the European Union, the United Kingdom, the United States and the Russian Federation). Where personal data is transferred outside the UAE, we do so in accordance with Articles 22 and 23 of the PDPL: to jurisdictions ensuring an adequate level of protection, or subject to appropriate safeguards (including contractual clauses imposing data-protection obligations on the recipient), or on another basis permitted by the PDPL.

7.2. For data of EEA/UK users transferred to countries without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum/IDTA, as applicable) together with supplementary measures where necessary.

8. Data Retention

8.1. We retain personal data only for as long as necessary for the purposes described in this Policy:

• account and learning data — for the life of the account and deleted or anonymised within 90 days after account deletion, except where longer retention is required by law or for the establishment, exercise or defence of legal claims;
• voice recordings — not retained: they are processed in real time to generate transcripts and pronunciation feedback and are deleted upon completion of processing; transcripts follow the retention period for learning data;
• payment and transaction records — for the period required by applicable tax and commercial legislation;
• support correspondence — for up to 24 months after the ticket is closed;
• technical logs — typically for up to 12 months.

8.2. Backup copies are deleted in accordance with our backup rotation schedule within a reasonable period after the deletion of the primary data.

9. Security

9.1. We apply appropriate technical and organisational measures to protect personal data, including encryption of data in transit, access controls and the principle of least privilege, logging, environment segregation, pseudonymisation where feasible, and staff confidentiality obligations.

9.2. In the event of a personal data breach likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, affected users, in accordance with the PDPL and other applicable law.

10. Your Rights

10.1. Subject to the conditions and exceptions of applicable law, you have the right to:

• receive confirmation of whether we process your personal data and obtain access to it and to information about the processing;
• request rectification of inaccurate or incomplete data;
• request erasure of your data;
• request restriction of processing and object to processing, including processing based on legitimate interests;
• receive your data in a structured, commonly used, machine-readable format (data portability), where technically feasible;
• withdraw consent at any time, where processing is based on consent;
• object to direct marketing at any time, including via the unsubscribe link in e-mails or notification settings;
• not be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you.

10.2. To exercise your rights, contact privacy@verbatica.ai or use the tools in your account settings (including account deletion). We may need to verify your identity. We respond within the time limits set by applicable law.

10.3. You also have the right to lodge a complaint with the UAE Data Office or, for EEA/UK users, with your local data-protection supervisory authority.

11. Children

11.1. The Service is not directed at children under 13. Users aged 13 to 17 may use the Service only with the consent and under the supervision of a parent or legal guardian. If we become aware that we have collected personal data of a child under 13 without verifiable parental consent, we will delete it. Parents and guardians may contact us at the address in Section 1.3.

12. Cookies and Similar Technologies

12.1. Our use of cookies, SDKs and similar technologies on the Web Platform and in the App is described in the Verbatica Cookie Policy, available on the Web Platform. You can manage non-essential cookies through the cookie banner and your settings.

13. Changes to This Policy

13.1. We may update this Policy from time to time. Material changes will be notified through the App, the Web Platform or by e-mail before they take effect. The effective date of the current version is shown at the top of this Policy.

14. Contact

Data controller: LANGUAGEUP ARTIFICIAL INTELLIGENCE L.L.C, Office No. M2-57, Abdulrahman Mohammed Taher Mohammed Wali Building, Al Raffa, Dubai, United Arab Emirates. Privacy contact: privacy@verbatica.ai.