Project: Apprendre Tamazight Kabyle Domain: apprendre-tamazight-kabyle.com Version: v1 Effective date: [TO BE CONFIRMED] Last updated: 2026-09-24 Data controller: Mohand Aoudia, Malmö, Sweden Contact: aoudiamohand70@gmail.com
DRAFT — This document is a starting point. Before public launch, a Swedish/EU lawyer must review and finalize it, especially for GDPR compliance.
1. Overview
This Privacy Policy explains how Apprendre Tamazight Kabyle ("we", "us", "our") collects, uses, stores, and protects your personal data when you use apprendre-tamazight-kabyle.com ("the Service").
We are based in Sweden, within the European Union. The General Data Protection Regulation (GDPR) applies to all personal data we process.
By using the Service, you accept the practices described in this policy.
2. Data we collect
2.1 Data you give us
| Data | When | Purpose |
|---|---|---|
| Email address | When you create an account | Account, notifications, contact |
| Display name (optional) | When you create an account | Public attribution |
| Password (hashed) | When you create an account | Authentication |
| UI language preference | When you use the site | Personalization |
| Words and expressions you submit | When you contribute | Dictionary growth |
| Audio recordings you upload | When you contribute audio | Pronunciation library |
| Documents, images, videos you upload | When you contribute sources | Ingestion (Phase 2) |
| Contributor Agreement acceptance | When you submit | Legal compliance |
2.2 Data we collect automatically
| Data | When | Purpose | Retention |
|---|---|---|---|
| Login events | Every sign-in | Security, audit | 12 months |
| IP address | Every request | Rate limiting, abuse prevention | 30 days |
| Browser and OS | Every request | Compatibility, debugging | 30 days |
| Page views | Every page | Basic analytics (aggregated) | 12 months |
We do NOT use tracking cookies, advertising cookies, or third-party analytics that track you across sites.
2.3 Data we do NOT collect
- Payment information (except when you buy a commercial license, via a payment processor we do not store ourselves).
- Government IDs.
- Biometric data.
- Location tracking beyond IP-based country.
3. Legal basis for processing (GDPR Article 6)
We process personal data on these legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Service | Contract (Art. 6(1)(b)) |
| Account management | Contract |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance (tax, GDPR requests) | Legal obligation (Art. 6(1)(c)) |
| Sending important account notices | Contract |
| Sending optional communications | Consent (Art. 6(1)(a)) |
You can withdraw consent at any time for consent-based processing.
4. How we use your data
We use personal data to:
- Create and manage your account.
- Authenticate you when you log in.
- Display your contributions with attribution (if you choose not to be anonymous).
- Notify you about your submissions (approved, rejected, needs audio).
- Enforce rate limits and prevent abuse.
- Comply with legal requirements (tax, GDPR).
- Improve the Service (aggregated, non-personal).
We do NOT:
- Sell your data.
- Share your data with advertisers.
- Use your data to train AI models that are sold or shared.
- Transfer your data outside the EU without safeguards.
5. Data sharing
5.1 Service providers
We use the following processors:
| Provider | Purpose | Location |
|---|---|---|
| Firebase (Google) | Authentication, database, storage | EU/US |
| Vercel | Hosting | EU/US |
| STRATO | Domain registration | EU (Germany) |
| (TBD) Payment processor | Commercial licenses | EU |
| (TBD) AI provider | Translation assistance (server-side only) | TBD |
Each processor is bound by a data processing agreement.
5.2 Legal obligations
We may disclose data if required by law, court order, or to protect the rights and safety of users or the public.
5.3 Business transfers
If the project is transferred to a foundation or company, user data may transfer with it. You will be notified.
We will NOT sell your personal data.
6. International transfers
Some processors (Firebase, Vercel) may store data outside the EU. When this happens, we rely on:
- EU Standard Contractual Clauses.
- The processor's own GDPR commitments.
- Appropriate safeguards.
7. Data retention
| Data | Retention |
|---|---|
| Account data (email, name) | Until account deletion + 30 days |
| Login events | 12 months |
| IP addresses | 30 days |
| Submitted words (verified) | Permanent (part of the dictionary) |
| Audio recordings | Permanent (part of the dictionary) |
| Contributor Agreement records | Permanent (legal record) |
| Support emails | 24 months |
Verified dictionary entries are NOT personal data — they are language records. Only your personal data (email, name) is deleted when you delete your account.
8. Your rights (GDPR)
You have the right to:
| Right | What it means |
|---|---|
| Access | Request a copy of your personal data |
| Rectification | Correct inaccurate data |
| Erasure | Delete your account and personal data |
| Restriction | Limit how we process your data |
| Portability | Export your data in a machine-readable format |
| Objection | Object to processing based on legitimate interest |
| Withdraw consent | For consent-based processing |
To exercise any right, email aoudiamohand70@gmail.com. We respond within 30 days.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
9. Security
We protect your data with:
- Encrypted connections (HTTPS everywhere).
- Hashed passwords (never stored in plain text).
- Firebase Authentication for secure sign-in.
- Firestore security rules limiting who can read/write what.
- Server-side API keys (never exposed to the browser).
- Rate limiting on sensitive endpoints.
- Regular backups (git + USB bundles + Firestore backups).
- Access controls: only the project owner has admin access.
No system is 100% secure. If a data breach occurs, we will notify affected users and IMY within 72 hours, as required by GDPR.
10. Children
The Service is not directed at children under 13 (or under 16 in some EU countries). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.
11. Cookies and local storage
We use:
- Essential cookies for authentication (session). Required for the Service to work.
- Local storage for UI preferences (language choice).
- No tracking cookies.
- No advertising cookies.
- No third-party analytics that track across sites.
Because we only use essential cookies, a cookie consent banner may not be required. This must be confirmed by a lawyer before launch.
12. Automated decision-making
We do not use automated decision-making that produces legal or similarly significant effects. AI suggestions are always reviewed by a human before affecting the dictionary.
13. Changes to this policy
We may update this policy. When we do:
- The version number increases.
- The "Last updated" date changes.
- Material changes are announced on the site.
Continued use after changes means you accept the new policy.
14. Contact
Data controller:
- Name: Mohand Aoudia
- Location: Malmö, Sweden
- Email: aoudiamohand70@gmail.com
- Street address: not public (available on request for legal matters)
For GDPR requests, use the email above with "GDPR Request" in the subject line.
End of Privacy Policy.