BlendLearn Privacy Policy

Effective date: May 2026

1. Introduction

Neon Flower Sp. z o.o. (“we”, “our”, or “us”) operates the BlendLearn mobile application and web service. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our service.

By using BlendLearn, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the service.

BlendLearn is built for language schools and supervised educational settings and is intended for a general audience. Minimum-age requirements and how children may use BlendLearn are explained in Section 11 and in our Terms of Service.

Depending on where you live, this policy is also informed by the UK GDPR and the UK Age Appropriate Design Code (Children’s Code), the US Children’s Online Privacy Protection Act (COPPA), and Brazil’s LGPD. Section 9 lists the supervisory authority for your region.

2. Data Controller

The controller of your personal data is:

• Neon Flower Sp. z o.o.
• ul. Radzikowskiego 94a/106, 31-315 Kraków, Poland
• Email: privacy@neonflower.ai

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Polish data protection law (RODO).

3. Information We Collect

3.1 Account Information

• Email address — authentication and account recovery.

• Display name — shown to other users within classes.

• Profile photo — optionally uploaded for your profile.

3.2 Social Sign-In

If you sign in with Google, Apple, or Facebook, we receive information from that provider via Supabase OAuth (we do not receive your social network password). Depending on your choices and the provider, this may include:

• Email address
• Name or display name
• Provider user identifier (used to link your account)
• Profile photo URL (if you grant that permission)

Each provider processes data under its own privacy policy: Google, Apple, Meta (Facebook).

3.3 Learning Content

• Flashcards and decks — content you create or study.

• Study progress and schedules — spaced-repetition data (review dates, difficulty ratings, retention scores).

• Class data — class memberships, posts, comments, and shared learning materials.

3.4 Automatically Collected Data

• Crash logs — Firebase Crashlytics (device type, OS version, stack traces). No personal learning content.

• Analytics events — Firebase Analytics when you consent via Settings. Events are aggregated; we do not use the Android advertising ID.

• Push notification tokens — if you enable notifications (Firebase Cloud Messaging).

3.5 AI Content Generation

When you choose to use the optional AI features to generate flashcard content, we send your input to our AI processing provider. That input may include:

• The words and field values you type.
• The relevant deck and template context (e.g. the languages and field names).
• If you choose to import them, photographs of notes or text extracted from documents (e.g. PDFs).

Please do not enter sensitive personal information into AI inputs. We keep logs of AI requests and their generated outputs to operate usage quotas, prevent abuse, and improve quality. The AI provider is listed in Section 6, and AI transparency is explained in Section 5.1.

4. Legal Basis for Processing (GDPR)

We process personal data on the following bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — providing the service: account, sync, classes, study features, optional social sign-in, and optional AI content generation.

• Consent (Art. 6(1)(a) GDPR) — Firebase Analytics when enabled via the Analytics Consent toggle in Settings. You may withdraw consent at any time.

• Legitimate interests (Art. 6(1)(f) GDPR) — security, fraud prevention, crash diagnosis, and service improvement, balanced against your rights. You may object where applicable.

• Legal obligation (Art. 6(1)(c) GDPR) — where we must retain or disclose data to comply with law.

Where we rely on consent for children, we follow Section 11 and applicable child-privacy laws.

5. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve BlendLearn’s features.
• Authenticate your identity and secure your account.
• Synchronise your learning data across devices via PowerSync.
• Generate spaced-repetition study schedules.
• Enable class-based collaboration between teachers and students.
• Diagnose technical issues and improve application stability.

• Understand aggregate usage patterns to guide product development (with consent, where required).

• Send service-related notifications you have enabled.

• Generate flashcard content with AI when you choose to use that feature.

5.1 AI Transparency

In line with the EU AI Act and good practice, we want you to understand how AI is used in BlendLearn:

• AI-generated content is labelled as such. Translations, example sentences, and other fields produced by AI are generated automatically and should be reviewed before you rely on them.

• AI output may be inaccurate. AI can produce incorrect or incomplete language content. You are responsible for checking AI-generated material.

• No automated decisions with legal or similarly significant effects. We do not use AI to make decisions that produce legal effects about you or similarly significantly affect you.

• Children and AI. We take particular care with children’s data in AI features. Do not submit photographs of, or sensitive information about, children to AI generation.

6. Data Storage and Processors

6.1 Services We Use

We use the following processors (sub-processors) to operate BlendLearn. They process data only on our instructions and for the purposes below:

Processor	Purpose	Location / transfers
Supabase, Inc.	Authentication, PostgreSQL database, file storage	Primary region: EU Central 2 (Zurich, Switzerland). Supabase may also transfer data to the United States and Singapore under appropriate safeguards (e.g. Standard Contractual Clauses). Privacy
Journey Mobile, Inc. (PowerSync)	Offline-first sync between your device and the cloud	United States; cloud infrastructure via reputable providers (e.g. AWS). Cross-border transfers subject to contractual safeguards. Privacy
Google LLC (Firebase)	Analytics (with consent), crash reporting, performance, push notifications, web hosting	May process data in countries where Google maintains facilities (including the United States and other regions). Privacy
OpenRouter, Inc.	AI content generation — processes the text, context, and any photos or document text you submit to generate flashcard content; routes requests to upstream AI model providers	United States; requests may be routed to upstream model providers. Cross-border transfers subject to contractual safeguards. Privacy

6.2 On-Device Storage

• PowerSync SQLite — local cache for offline access, synced when online.

• Supabase Storage — profile photos and uploads; access controlled by policies.

6.3 Row-Level Security

Supabase PostgreSQL uses Row-Level Security (RLS) so users can access only their own data and data shared within their classes.

7. International Data Transfers

If you are in the European Economic Area, Switzerland, or the United Kingdom, your data may be transferred to countries outside your region, including the United States and Singapore, because our processors operate globally.

We rely on appropriate safeguards where required by law, such as the European Commission’s Standard Contractual Clauses and processor data processing agreements. You may request more information about safeguards by contacting privacy@neonflower.ai.

8. Data Sharing

• Processors — listed in Section 6, under contract and only as needed to run the service.

• Class content — visible to members of classes you join (core feature).

• No sale of personal data — we do not sell, rent, or trade your personal information.

• No advertising networks — we do not share data with ad networks for behavioural advertising (see Section 10).

9. Your Rights

Under GDPR / RODO, you have the right to:

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate data.

• Erasure — delete your account and associated data (Settings or Account Deletion).

• Restriction — limit processing in certain cases.

• Portability — receive your data in a structured format where applicable.

• Object — object to processing based on legitimate interests.

• Withdraw consent — for analytics via Settings; withdrawal does not affect prior lawful processing.

To exercise these rights, email privacy@neonflower.ai. We respond within one month, as required by law.

You may lodge a complaint with a supervisory authority:

• Poland / EEA — the President of the Personal Data Protection Office (UODO): uodo.gov.pl, or your local EEA authority.

• United Kingdom — the Information Commissioner’s Office (ICO): ico.org.uk.

• Brazil — the Autoridade Nacional de Proteção de Dados (ANPD): gov.br/anpd.

• United States — concerns about children’s privacy may be raised with the Federal Trade Commission (FTC): ftc.gov.

10. Data Retention

• Account data — until you delete your account; removed from servers within 30 days after deletion.

• Crash logs — approximately 90 days.

• Analytics data — per Firebase defaults (typically up to 14 months for events).

• AI generation logs — request and response logs from the AI features, deleted when you delete your account, or otherwise retained for a limited period and then deleted or de-identified.

• Local device data — removed when you uninstall the app or sign out.

11. Children’s Privacy

BlendLearn is an educational tool intended for a general audience and is not directed to children under 13. We design for privacy and safety and follow applicable child-protection laws, including COPPA (US), the GDPR rules on children’s data (“GDPR-K”), the UK Age Appropriate Design Code (Children’s Code), and Brazil’s LGPD and ECA.

11.1 Minimum Age and How Children May Use BlendLearn

• To create and use an account on your own, you must be at least 16 in the European Economic Area (or the digital-consent age set by your country, which may be 13–16), and at least 13 elsewhere.

• Children below that age may use BlendLearn only when a school or teacher enrols them as part of a class, or with verifiable consent from a parent or guardian. In a school setting, the school or teacher confirms that it has the authority — and any required parental consent — to enrol the student. This follows the COPPA educational-context model and the GDPR “school as controller” model.

• We do not knowingly allow children under 13 to sign up independently. If we learn that a child under the applicable age created an account without the required school or parental consent, we will disable the account and delete the associated personal data.

11.2 Data Collected From Children

For children, we collect only what is needed to operate the educational service:

• Email address (authentication).
• Display name and optional profile photo from onboarding.
• Learning content and class memberships.

11.3 Data We Do NOT Collect From Children

• Android Advertising ID (we do not request AD_ID).
• Persistent device identifiers (IMEI, IMSI, MAC, etc.).
• Precise location (GPS).
• Device phone number.
• Microphone/camera except when the user intentionally adds media to flashcards or profile.

11.4 No Advertising and No Behavioural Tracking

• No third-party advertisements or ad SDKs.
• No interest-based targeting or remarketing.
• No sale or sharing of personal data for advertising.
• No profiling of children, and gamification is not used to manipulate children.

11.5 Analytics and Crash Reporting for Children

• Analytics is anonymised/aggregated where used; no advertising ID.
• Crash logs exclude user-generated learning content.
• Parents, schools, or the child may withdraw analytics consent via Settings.

11.6 Children and Social Features

Class feeds are private and limited to the members of a class. Teachers moderate their classes, and any user can report content (see our Terms of Service). We do not offer public profiles, direct messaging, friend requests, or global feeds.

11.7 Children and AI

We take particular care with children’s data in AI features (Section 5.1). Do not submit photographs of, or sensitive information about, children to AI generation.

11.8 Parental and School Consent and Rights

Where the law requires consent before a child uses the service, that consent must be given by a parent or guardian, or by a school/teacher acting in the educational context. Parents, guardians, and schools may review, export, or delete a child’s data by contacting privacy@neonflower.ai from an email that verifies the relationship. Schools may request a Data Processing Agreement for class use.

11.9 Data Sharing for Children

Children’s data is shared only with the processors in Section 6, under their data-processing terms, and never for advertising or unrelated commercial purposes.

12. Third-Party Services

• Supabase — Privacy

• PowerSync — Privacy

• Firebase (Google) — Privacy

• OpenRouter (AI generation) — Privacy

• Google Sign-In — Privacy

• Apple Sign-In — Privacy

• Facebook Login — Privacy

13. Contact

Questions about this policy or your data rights: privacy@neonflower.ai

Neon Flower Sp. z o.o.

ul. Radzikowskiego 94a/106, 31-315 Kraków, Poland

14. Changes to This Policy

We may update this Privacy Policy. Material changes will be posted here with an updated effective date. Continued use after changes constitutes acceptance of the revised policy.