Privacy Policy
We explain what information Orbilingua needs, where it is processed, and how you can control it.
Effective: August 29, 2026 · Version 2026-08-29
1. Controller and scope
Brujala LLC, located in Manchester, New Hampshire, United States, is responsible for the processing described in this Policy. It applies to the Orbilingua extension, website, account, synchronization, billing, and artificial-intelligence features for users in countries where the service is available.
2. Account and security data
We process your email, Argon2id-protected credentials, account identifier, verification status, sessions, accepted Terms and Privacy versions, and the time and source of acceptance. We also process IP address, approximate country, user agent, session identifiers, and abuse signals for as long as needed for authentication, protection, and usage limits. Website cookies are essential to maintain your session and are not used for advertising.
3. Learning data and chosen content
The extension may store word states, cards, templates, review results, streak, languages, preferences, and synchronization metadata. A card may include the word, sentence, explanation, selected audio, URL, title, platform, and subtitle timestamps you chose to keep. Full pages are not automatically sent as a browsing history.
4. Local processing
Preferences, installed dictionaries, display name, and local progress copies remain in extension storage. Context images are created only when you choose to add one to a card; their WebP pixels stay on that device and are not synchronized. Tab audio is captured only after a visible action and is not continuously recorded; if you save it to a card, that selected clip becomes part of the synchronized card.
5. Connected and AI features
When you request translation, explanation, or voice, we send the minimum excerpt, languages, and parameters needed to the server. The active AI provider may receive that excerpt to generate the result. Derived responses or generated audio may remain in a technical cache for up to 30 days; its key uses a digest of the text rather than creating an account history containing the original text.
6. Billing
Stripe processes payment information, taxes, billing country, and subscription data. Orbilingua receives identifiers, plan, status, renewal or cancellation dates, and data needed to administer access, but not your full card number. Stripe processes data under its own policy and financial obligations.
7. Purposes and legal bases
We use data to perform the contract, synchronize your learning, respond to your actions, authenticate you, administer payments and support, prevent fraud and abuse, meet legal obligations, and safely improve operation. Where law requires a legal basis, we rely on contract performance, legitimate interests in security and operation, consent for optional features, and legal obligation. You may withdraw consent without affecting earlier processing, although an optional feature may stop working.
8. Necessary providers
We share only what is needed to provide, protect, or bill for the service. We do not sell personal data or use it for personalized advertising.
9. International transfers
Orbilingua operates from the United States, and providers may process data in the United States or other countries. Where required, we will use valid transfer mechanisms and contractual and technical safeguards. International transfer does not remove your mandatory rights.
10. Retention
Local data remains until you delete it, clear storage, or uninstall the extension. Account, legal acceptance, and synchronization data remain while the account is active. Account deletion first cancels an active subscription and then deletes the account, sessions, progress, and cards from the server. Sessions expire within 30 days; AI caches and technical billing events are normally pruned after 30 days. Encrypted backups expire within 90 days. We may retain financial or security records for periods required by law or needed to establish, exercise, or defend legal claims.
11. Security
We use encryption in transit, Argon2id passwords, one-time tokens stored as hashes, rotating sessions, separation of browser credentials, restricted access, encrypted backups, and abuse controls. No system is infallible; if an incident requires notice, we will provide it under applicable law.
Data received through Chrome APIs
Use and transfer of information received through Chrome APIs comply with the Chrome Web Store User Data Policy, including its Limited Use requirements.
- It is used only for learning features you choose and to operate, maintain, and protect the service.
- It is not used or transferred for personalized advertising, retargeting, advertising profiles, or data sales.
- No person reviews saved content except with specific support consent, for security, to meet a legal obligation, or after anonymization and aggregation.
12. Your rights
Depending on where you live, you may request access, correction, deletion, portability, restriction, or objection; withdraw consent; and complain to a data-protection authority. You can delete cards and your account from Orbilingua. For another request, email legal@orbilingua.app. We will reasonably verify identity and respond within legal time limits. We do not discriminate for exercising privacy rights.
13. Children
Orbilingua is not directed to children under 13. Where local law requires a higher age to consent to processing or contract, a minor needs verifiable authorization from a guardian. If you believe we received a child’s data without authorization, contact us so we can investigate and delete it where appropriate.
14. Changes and contact
We will publish changes here with a new date and version. We will request new acceptance when a contractual or material change requires it. Controller: Brujala LLC, Manchester, New Hampshire, United States. Privacy and legal-request contact: legal@orbilingua.app.