Privacy Policy

• This Policy describes how Mynawoo, operated by Alireza Saligheh, an individual operator, handles personal data when you use mynawoo.com, supported applications, support channels, and connected AI features.
• For privacy questions or requests, contact [email protected]. Payment providers acting as Merchant of Record process transaction data under their own privacy notices and may act as independent controllers for payment, tax, fraud, and legal-compliance purposes.

• Account and profile data. Email address, password hash, authentication provider identifiers, username or display name, optional profile image, birth date or age-related information, phone number if provided, interface language, native and learning languages, and account settings.
• Learning and content data. Course enrolment, lesson activity, answers, scores, progress, grammar mistakes, vocabulary and Leitner cards, writing or speaking submissions, uploads, generated exams, selected themes, analytics, and support feedback.
• AI and connected-app data. Prompts, instructions, content sent to an AI feature, generated outputs, connection scopes, authorization records, and audit or safety logs. The data available to a connected app depends on the permissions you approve.
• Technical and security data. IP address, approximate location inferred from IP, browser, device, operating system, language, timestamps, referral or campaign information, session and login records, device or notification tokens, diagnostics, security events, and usage logs.
• Transaction data. Merchant of Record or app-store provider, order and transaction identifiers, product or plan, price, currency, country, purchase and renewal dates, subscription status, tax and limited billing metadata, refunds, disputes, and fraud indicators. We do not receive or store complete payment-card numbers.
• Communications. Support messages, emails, survey responses, account-deletion feedback, marketing preferences, and records needed to respond to you.

We collect data from you, your device and use of the Service, an authentication provider you choose, Gumroad or Paddle when either is displayed as Merchant of Record, Google Play or another app store, connected AI apps you authorize, analytics and infrastructure providers, and lawful fraud-prevention or security sources.

• Contract. Create and authenticate your account; provide courses and learning tools; maintain progress; fulfil purchases; provide support; and manage subscriptions, cancellations, and refunds.
• Legitimate interests. Secure and operate the Service; prevent fraud and abuse; diagnose faults; measure product performance; improve content and usability; protect legal claims; and communicate about related features, balanced against your rights.
• Consent. Use certain non-essential analytics or marketing technologies, send marketing where consent is required, or process optional data where we specifically ask for consent. You may withdraw consent without affecting earlier lawful processing.
• Legal obligations and rights. Keep required tax, accounting, transaction, security, and compliance records; respond to lawful requests; enforce agreements; and establish, exercise, or defend legal claims.

• We use cookies and similar browser storage for authentication, security, language, preferences, referral context, and other functions needed to operate the Service. Our notice informs visitors that these technologies are used.
• Where enabled, Google Analytics or similar tools may collect device and usage information to help us understand visits, sign-ups, and product performance. You can use browser controls, content blockers, or provider opt-out tools to restrict non-essential storage; blocking essential storage may prevent sign-in or other features from working.
• Browser or device settings do not always remove data already collected. You may contact us about analytics or marketing choices. We will honor consent and opt-out rights where applicable law requires them.

• Infrastructure and delivery. Hosting, database, backup, storage, content-delivery, email, monitoring, and security providers, including Hetzner, AWS, and Cloudflare where used.
• Payments. Gumroad or Paddle when shown at web checkout, and Google Play or another app store for an in-app purchase. These providers receive and return data needed for the transaction, tax, subscription, refund, dispute, and fraud handling.
• Paddle transactions. When Paddle is the seller and Merchant of Record, Paddle processes transaction data for payment, tax, receipt, subscription, fraud, dispute, and refund administration under its own Buyer Terms, Refund Policy, and Privacy Notice. Paddle may act as an independent controller for those purposes. Mynawoo receives only the transaction and subscription information needed to provide access, support the purchase, prevent abuse, and keep required records.
• AI services. Google AI services where a feature uses them; OpenAI or another AI provider when you intentionally use a feature or connected app powered by that provider. Submitted content may be sent to the provider to generate the requested output.
• Analytics and communications. Google Analytics, Google Tag Manager, email-delivery, and support tools where configured.
• Legal and safety. Authorities, advisers, insurers, counterparties, or affected parties where reasonably necessary to comply with law, protect rights and safety, investigate abuse, or handle a legal claim.
• Business changes. A prospective or completed buyer, investor, lender, successor, or restructuring participant, subject to appropriate confidentiality and lawful processing.
• We do not sell full payment-card data. We do not disclose private learning content publicly unless you choose a sharing feature or disclosure is required by law.

Providers and users may be located in different countries. Data can therefore be processed outside your country, including in the EEA, UK, or United States. Where required, we rely on an adequacy decision, approved contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism. Contact us for information about safeguards relevant to your data.

We use measures designed to protect data, including HTTPS in transit, password hashing, access controls, authorization checks, logging, and backups or recovery controls where configured. No online service can guarantee absolute security. You are responsible for protecting your credentials and should notify us promptly of suspected account compromise.

• We retain account, learning, and content data while the account is active and for as long as reasonably necessary to provide the Service, resolve disputes, secure the platform, enforce agreements, and meet legal obligations.
• Transaction, tax, fraud, consent, and legal records may be kept for the period required by applicable law or needed to establish or defend claims. Security and technical logs are retained according to operational need and may be kept longer when connected to an incident.
• When deletion is appropriate, data is deleted or anonymized from active systems. Copies can remain temporarily in restricted backups until their normal rotation. Information already held by a Merchant of Record, app store, connected app, or other independent controller is governed by that party’s retention rules.

• Using Profile → Settings → Delete Account deactivates access and submits an account-deletion request. We may verify the request and retain limited information where needed for transactions, fraud prevention, security, legal duties, or legal claims.
• You may also email [email protected] from the account address. Do not send passwords or unnecessary identity documents. We may ask for proportionate verification before acting on a request.
• Deletion from a Mynawoo account does not automatically delete transaction records held by Gumroad, Paddle, an app store, or data already processed by an independently controlled connected app. Contact that provider for its separate rights process.

• Depending on your location and applicable law, you may have rights to obtain information and access, correct, delete, restrict, or port personal data; object to certain processing; withdraw consent; opt out of certain marketing; and appeal or complain to a competent data-protection authority.
• Send requests to [email protected]. We may verify identity, clarify scope, refuse or charge for manifestly unfounded or excessive requests where law permits, and retain data where an exception applies. We will respond within the time required by applicable law.
• You may unsubscribe from promotional email using its unsubscribe link. Service, security, billing, and legal messages may still be sent when necessary.

The Service is not directed to children under 13. A higher minimum age or parental-consent rule applies where required by local law. If you believe a child provided data without valid authorization, contact us so we can investigate and take appropriate action.

• A compatible AI app can access Mynawoo data only after you authorize the requested scopes. Depending on those scopes, this may include courses, lessons, progress, mistakes, vocabulary, generated exercises, and learning analytics.
• The connected app and its provider may independently retain prompts, tool results, or conversation content under their own terms. Disconnecting or revoking a token stops future authorized access but does not necessarily delete copies already processed by that provider.
• Mynawoo records authorization and tool activity as reasonably necessary for security, debugging, abuse prevention, and support. Generated content may be validated, sanitized, rejected, archived, or deleted.

We may update this Policy to reflect legal, security, operational, provider, or product changes. The updated date will be posted here. Where required, we will provide additional notice or request renewed consent before a material change takes effect.