v0 status (effective 2026-06-27): This document is published in v0 pending review by Estonian legal counsel. Final terms may differ.

Effective date: 2026-06-27 (v0 draft) Last updated: 2026-10-09 Operator: A2est OÜ, registered in Estonia Contact: privacy@a2est.ee

1. What this document is

This is the full privacy policy for A2est. It expands on §4 of /terms with the GDPR-aligned details: what we collect, why, how long we keep it, who we share it with, and your rights.

2. Data we collect

2.1 Account data

• Email address - used for sign-in, package receipts, expiry warnings, and (if you opt in) marketing email. Required.
• Password hash - industry-standard hashing (argon2id). We never see your plaintext password.
• TOTP secret - if you enable two-factor authentication. Encrypted at rest. We cannot recover this for you; if you lose it, account recovery requires identity verification.
• Sign-in records - for each sign-in: the time, the browser type, and the IP address. Used to keep your account secure and to end a session when you sign out.

2.2 Learning data

• Lesson progress - which scenes and lessons you've started, completed, or restarted.
• Scene completion state - saved locally to your browser and synced to our Postgres when authenticated.
• AI tutor conversation history - your spoken and typed exchanges with the A2est AI tutor. Used to personalize future sessions and for product improvement (anonymized + aggregated).
• Cultural persona chat history - your typed exchanges with canon personas (for example Jaan). Stored under your account so you can reopen past chats and replay banked audio. Deleted when you delete your account.
• Referral attribution - which user referred you (if any), and which users you referred (if any).

2.3 Payment data

• Payment metadata - what you paid, when, on which tier.
• Payment method details - entered on the payment provider's own page (SfeyPay, EveryPay, or Stripe). We do not store full card numbers, CVVs, or bank credentials. We store the provider's payment reference, the product, the amount, and the payment status.

2.4 Telemetry

• Standard web telemetry - page views, referrers, error reports. No third-party advertising trackers. No Facebook pixel. No Google Ads tag. (Donor-trust stance.)
• AI Tutor usage - minutes consumed, sessions started, errors.

2.5 Free public content (no account)

The free /kids and /discover pages need no account, and using them stores no personal data about you on our servers. Progress on these pages (completed units, Discover stamps) is kept only in your browser's local storage. Audio for their words and phrases is fetched from our servers without any account identifier; your IP address is used only as a short-lived rate-limit counter. If an adult account holder signs in, this device's progress is copied to that account so it is not lost.

3. How we use your data

• To operate the service - sign you in, render your dashboard, run your AI tutor sessions, send you expiry warnings.
• To improve the service - anonymized and aggregated usage analytics. We never sell individual user data.
• To communicate with you - transactional email (receipts, expiry warnings, security alerts). Marketing email only with explicit opt-in.

4. Third-party processors

We do not sell user data to advertisers. We do not run third-party advertising trackers on A2est.

5. Cookies and local storage

A2est uses only cookies that are strictly necessary to provide the service you asked for. We use no advertising, analytics, or tracking cookies and no third-party cookies, so we do not ask for consent to them.

Your browser's local storage also keeps a few settings and drafts on your device: theme, audio speed, sidebar layout, dismissed notices, progress made before you sign in (lessons, /kids, /discover), and a message you typed before signing in. Only A2est pages on your device read them; progress made before you sign in is copied to your account when you sign in.

The mobile apps do not use cookies. They keep your sign-in token in the device's secure storage (Keychain on iOS, Keystore on Android).

6. Retention

• Account data: retained while your account is active. Deleted within 30 days of account-deletion request.
• Learning data: retained while your account is active. Anonymized aggregates may be retained indefinitely for product improvement.
• AI tutor conversation history: retained while your account is active. You can delete individual sessions from your dashboard.
• Payment data: retained 7 years per Estonian accounting law (Raamatupidamise seadus).
• Telemetry: retained 26 months, then aggregated and anonymized.

7. Your rights (GDPR)

You have the right to:

• Access - request a copy of all data we hold on you.
• Rectification - correct inaccurate data.
• Erasure ("right to be forgotten") - delete your account and associated data. 7-day deletion grace: you can cancel a deletion within 7 days of requesting it.
• Restriction of processing - pause our use of your data while a dispute is resolved.
• Data portability - export your data in machine-readable format. Lesson export (JSON, Anki, CSV) is available from your account settings.
• Object to processing - for any processing based on legitimate interest. (We don't do this; all processing is consent- or contract-based.)
• Withdraw consent - at any time, for any processing based on consent (e.g. marketing email).
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) if you believe we have mishandled your data.

To exercise any of these rights, contact privacy@a2est.ee or use the in-app controls at /account/data.

8. Security

• TLS for all traffic (HSTS preload).
• Password storage: argon2id.
• TOTP secrets: encrypted at rest with a key managed outside the database.
• Database access: restricted to authenticated app services; no direct human access in production.
• Backups: encrypted at rest, retained 30 days.
• Incident response: any breach affecting user data is reported to AKI within 72 hours per GDPR Art. 33, and to affected users without undue delay.

9. International transfers

A2est is operated in Estonia. Data is stored in EU regions of our cloud providers. No data is transferred outside the EU/EEA without your explicit consent or a GDPR-compliant mechanism (e.g. Standard Contractual Clauses).

10. Children

Accounts and paid courses are for adults (18+). We do not knowingly collect data from children under 16 (the GDPR default). If we discover we have, we delete it within 7 days. The free /kids pages need no account (see §2.5).

11. Changes to this policy

We will notify you by email at least 30 days before any material change takes effect. Continued use of the service after the effective date constitutes acceptance. If you do not accept the change, you may export your data and close your account before the effective date.

12. Contact

A2est OÜ Email: privacy@a2est.ee Registered in Estonia.

For data-protection complaints: Andmekaitse Inspektsioon (aki.ee).