Privacy Policy

Effective date: 2026-07-10
Last updated: 2026-10-10

Previous version, effective until 2026-07-31

This Privacy Policy applies to the Kalbomatas website, accounts, and other Kalbomatas Services provided by MB Uncascade. Kalbomatas is in testing and development, so the data involved may change as features change. Material changes will be reflected in an updated policy.

1. Roles and scope

MB Uncascade as controller. MB Uncascade, company code 307057505, operating under the Kalbomatas name, is the controller of your personal data when you register independently or use the Service, including for account administration, payments, subscriptions, security, abuse prevention, support, legal obligations, product operation, and improvement.

Kalbomatas is designed for learning Lithuanian and learning about Lithuania, especially for people outside Lithuania, the Lithuanian diaspora, Lithuanian heritage schools, and people planning to live in Lithuania.

If a heritage school, employer, or other organisation decides what data to provide and how to use it for its own administrative purposes, that organisation may be a separate controller for that processing. The relevant arrangement will define the roles. Our provider list is available on the Subprocessors page.

2. Personal data we collect

Category	What may be processed	When we receive it
Account data	name, email, account ID, date of birth, account type, language and learning choices	when you register, sign in, or change your profile
Learning data	level, lessons, answers, test results, progress, review history, XP, and other learning signals	when you use learning and motivation features
Writing and document data	text, uploaded images or PDFs, extracted text, language-check requests, and results	when you use writing, OCR, or document features
Voice and conversation data	audio, transcripts, pronunciation and conversation requests, and technical voice metadata	when you practise pronunciation or conversation
Community data	forum topics, posts, comments, replies, reports, and information you publish	when you use community features
Support and communications	emails, support chats, messages, attachments, and information needed to resolve a problem	when you contact us or use support providers
Technical and security data	IP address, access time, browser, operating system, sessions, authentication and error logs, and device identifiers	automatically when you use the Service
Mobile app analytics	login-request and successful-login timestamps, a pseudonymous installation hash, platform, app version, and account activity days; the raw installation identifier is not stored in analytics	after sign-in and while using the app; before sign-in we receive only aggregate Apple and Google reports
Payment data	subscription ID, payment status, confirmation, and billing metadata; we do not store full card details ourselves	through Stripe or another payment provider
Invite data	technical invite-link reference, inviter and invited account IDs, channel category, verification, and limited reward status; the inviter never sees payment details	when you open an invite, create a new account, or use invite credit
Testing and beta data	feedback, error reports, feature-use signals, prompts, ratings, technical logs, and data needed for a particular test	when you use experimental features or join a pilot
Special categories	we do not request or intentionally collect them; we may remove or mask them if you place them in free-text fields	only if you choose to provide them

The amount of data depends on whether you use the public website, an account, a subscription, writing, voice, community, support, or testing features.

3. Purposes and legal bases

Service and account – to provide accounts, sign-in, learning content, progress, support, and selected tools. The basis is performance of a contract (Article 6(1)(b) GDPR).

Writing, voice, AI, and translation – to process your request, analyse text or audio, return an output, and protect the feature. The basis is contract performance and, where relevant, legitimate interests (Article 6(1)(b) and (f) GDPR).

Security, abuse prevention, and stability – to control access, investigate incidents, identify errors, and protect the Service. The basis may be legitimate interests, contract performance, or a legal obligation.

Testing and product improvement – to evaluate quality, errors, security, and how the product works in practice. The basis may be legitimate interests, contract performance, or consent where required. If a test needs broader data capture, we will explain it in that feature’s context.

Mobile app operation and improvement – to evaluate sign-in and daily activity signals, security, reliability, and app-version adoption. The basis is contract performance and legitimate interests. We do not create advertising profiles, track you across apps, collect precise location, or use a persistent first-party analytics identifier before sign-in.

Payments, accounting, and marketing – to administer payments and meet legal obligations; marketing is sent only where permitted and, when required, with consent. We do not send marketing to children under 14.

4. Recipients and providers

We may share data with providers that help operate Kalbomatas: Hetzner for infrastructure; Cloudflare for CDN, WAF, and security; Google Workspace for email and documents; Crisp for support; Sentry for error and performance monitoring; Stripe for payments; DeepL for translation; OpenAI, OpenRouter, and Google Cloud, including Gemini, for AI, text, voice, and document features; and Google Analytics 4 or Umami for analytics when enabled under their applicable settings. Umami may receive only coarse account-type, access-state, and plan categories; we do not send an account ID, email address, or another persistent identifier.

The particular provider depends on the feature, technical configuration, availability, and testing stage. We do not sell personal data. We disclose data to institutions or law enforcement only where required by law or necessary to establish, exercise, or defend legal claims.

The current public provider list is available on the Subprocessors page. Where a provider processes data on our behalf, we use appropriate contractual data-protection terms.

5. International transfers

We prefer processing in the European Union and European Economic Area. If a provider’s operation involves a transfer outside the EEA, we use a lawful transfer mechanism, including the European Commission’s Standard Contractual Clauses (SCCs), and assess supplementary safeguards where appropriate.

6. Retention

Account and learning history: We may automatically delete an inactive account and its personal learning history after three years from the later of the last website sign-in or authenticated mobile-app use (or account creation if there has been no activity). We email a warning at least 31 days before automatic deletion, with the scheduled date. Signing in during that period cancels deletion. After deletion, we email a confirmation.

Automatic deletion does not apply to accounts with an active personal subscription (including an Apple purchase), active paid or trial organization access, privileged staff roles, unsettled payments, financial history, or family and parent–child links. Saved work is not deleted just because it is old. Records required for accounting, a dispute, or legal obligations may be retained separately only as needed.

Technical, security, and error logs: up to 3 years unless a longer period is needed for a dispute, security investigation, or legal obligation.

Mobile sign-in and daily activity analytics: for no longer than a rolling 3-year period and until the account is deleted. Aggregate Apple and Google store reports are not linked to accounts and are also retained for no longer than 3 years.

Writing, audio, and voice content: for as long as needed to provide the selected feature, show its result, provide support, and maintain account history. Raw audio and document files used only to generate a result are not intended for long-term storage and may be deleted according to the feature’s technical operation.

Support, payment, and accounting data: as needed to manage a request, prove a payment, and meet legal obligations. Accounting records may be kept for up to 10 years.

Testing and beta data: during active testing and for up to 5 years after a programme ends where needed for quality, security, error investigation, disputes, or compliance.

7. Cookies and analytics

Necessary cookies support sign-in, sessions, security, consent management, and core Service operation. Analytics cookies, including GA4, are loaded only after the required consent. If cookieless analytics is enabled, it is used for aggregated traffic and product signals, not advertising profiles or evaluation of learning results.

After app sign-in, we record account login and daily activity events, a pseudonymous installation hash, platform, app version, and timestamps. Apple and Google provide only their platform-defined aggregate reports for downloads, installations, deletions, and available usage measures; we do not link them to accounts. Apple usage measures may be opt-in, thresholded, or statistically protected.

8. AI, OCR, and voice features

If you use writing, OCR, pronunciation, conversation, or another AI feature, your text, image, PDF, audio, or request may be sent to the provider needed to return the result. We do not send direct identifiers unless they are needed for the feature or you include them yourself.

Please do not place unnecessary personal data or special-category data in free-text, voice, or document fields. Automated results may be inaccurate and are not professional advice. The relevant providers and transfer information are listed on the Subprocessors page.

9. Children’s privacy

Independent registration is for people aged 14 or older. Children under 14 may use the Service only through the family model, where a parent, guardian, or other lawful representative confirms their authority, agrees to the account, account linking, and progress visibility. Ordinary organisation or school access is for users aged 14 or older in the current model.

If we learn that a child under 14 is using the Service without this model or another lawful basis, we may suspend access, decline to activate the account, or delete it. A child may decline a testing invitation without creating an account.

10. Security

We use HTTPS/TLS, access and session controls, request limits, anti-bot measures, content-safety controls, backups, provider access controls, and technical incident monitoring to the extent consistent with the operating product. No measure guarantees absolute security. We handle breaches under the GDPR and other applicable requirements.

11. Your rights

You may have the right to access, correct, delete, restrict, port, or object to processing, and to withdraw consent where processing is based on consent. Send requests to labas@kalbomatas.lt. We respond within 30 days or sooner; for complex requests, the period may be extended as permitted by the GDPR.

You may complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, at vdai.lrv.lt.

12. Communications

We send necessary Service, security, and account messages. Marketing messages are sent only according to your settings and consent where required. We may notify you about important privacy or Service changes by email, on the website, in your account, or through another clear channel.

13. Changes to this policy

We may update this policy because of product development, legal requirements, security, or provider changes. The latest version will state its effective and update dates. We will try to notify you through a clear channel about material changes.

14. Contact

MB Uncascade, operating under the Kalbomatas name
Company code: 307057505
V. Nagevičiaus g. 3, Vilnius, LT-08237, Lithuania
Privacy questions: labas@kalbomatas.lt