Privacy Policy

This is a reference translation. The legally binding version is the German original.

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. For detailed information on the subject of data protection, please refer to our privacy policy listed below this text.

Data Collection on This Website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find the operator's contact details in the section “Information about the responsible party” in this privacy policy.

How do we collect your data?
Your data is collected in part by you providing it to us. This may include data you enter into a contact form, for example.
Other data is collected automatically or with your consent when you visit the website through our IT systems. This primarily involves technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?
Some of the data is collected to ensure the error-free provision of the website. Other data may be used to analyze your user behavior.

2. Hosting and Infrastructure

We host the contents of our website with the following providers:

Vercel

Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit our website, Vercel automatically collects technical data such as your IP address, browser type, and timestamps. We also use Vercel Analytics and Speed Insights to analyze website performance, collecting anonymized performance metrics. This is based on Art. 6(1)(f) GDPR (legitimate interest) and, where applicable, your consent (Art. 6(1)(a) GDPR) for analytics cookies.

Supabase

We use Supabase as a Backend-as-a-Service platform. The provider is Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. Supabase provides databases, authentication solutions, and storage. When you create an account or use our services, your data is stored on Supabase servers. The use of Supabase is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable provision of our website and services.

AWS S3 and CloudFront

For storage and delivery of audio and image files, we use Amazon Web Services (AWS) S3 and CloudFront. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. When using these services, files are stored on S3 servers and delivered via the CloudFront CDN, during which your IP address is technically processed. This is based on Art. 6(1)(f) GDPR (legitimate interest in efficient delivery of media files).

3. General Information and Mandatory Disclosures

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Note on Translations

Lingoban does not provide legally binding translations.

Information About the Responsible Party

The responsible party for data processing on this website is:

Sesang, Owner Wonyoung Seo
Limburger Str. 15
65520 Bad Camberg
Germany

Phone: +49 159 0162 5972
Email: hello@sesang.de

The responsible party is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).

Storage Duration

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, deletion will occur after these reasons cease to apply.

4. Data Collection on This Website

Cookies

Our websites use so-called “cookies.” Cookies are small text files and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted after your visit. Persistent cookies remain stored on your device until you delete them yourself or automatic deletion occurs through your web browser.

In some cases, cookies from third-party companies may also be stored on your device when you enter our site (third-party cookies). These enable us or you to use certain services of the third-party company (e.g., cookies for processing payment services).

Inquiries by Email, Phone, or Fax

If you contact us by email, phone, or fax, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of handling your request. We do not share this data without your consent.

Registration on This Website

You can register on this website to use additional features. We only use the data entered for the purpose of using the respective offer or service for which you have registered. The mandatory information requested during registration must be provided in full. Otherwise, we will reject the registration.

Google OAuth

We offer you the option of signing in with your Google account (Single Sign-On). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you sign in with Google, we receive access to certain information from your Google account (e.g., your email address and name) to verify your identity and create a user account for you. The data processing is based on your consent (Art. 6(1)(a) GDPR) or for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).

5. Third-Party Services

OpenAI

For AI-powered text analysis, story generation, and image generation, we use the API of OpenAI, L.L.C., 3180 18th St, San Francisco, CA 94110, USA. When you use these features, text and words you enter are transmitted to OpenAI. Processing is based on Art. 6(1)(b) GDPR (contract performance).

Google Gemini

As an alternative AI service, we use Google Gemini (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for text and image analysis. Text and words you enter are transmitted to Google. Processing is based on Art. 6(1)(b) GDPR (contract performance).

Replicate

For alternative image generation, we use Replicate, Inc., San Francisco, CA, USA. Text prompts are transmitted to Replicate to generate images. Processing is based on Art. 6(1)(b) GDPR (contract performance).

Google Cloud Text-to-Speech

For speech synthesis (pronunciation of flashcard texts), we use Google Cloud Text-to-Speech (Google Ireland Limited). Flashcard texts are transmitted to Google to generate audio files. Processing is based on Art. 6(1)(b) GDPR (contract performance).

Google Translation API

For translation features, we use the Google Cloud Translation API (Google Ireland Limited). Flashcard texts are transmitted to Google to generate translations. Processing is based on Art. 6(1)(b) GDPR (contract performance).

Resend

For sending daily review reminder emails, we use Resend Inc., San Francisco, CA, USA. Your email address and email content (review cards) are transmitted to Resend. Processing is based on your consent (Art. 6(1)(a) GDPR). You can disable email notifications at any time in your account settings.

6. Data Transfer to Third Countries

Some of the above-mentioned services (OpenAI, Replicate, Vercel, AWS, Resend) are based in the USA. Data transfer to the USA is carried out on the basis of EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR or on the basis of an adequacy decision by the EU Commission (EU-US Data Privacy Framework), if the respective provider is certified.

7. Account Deletion

You can delete your account at any time through the settings in your user profile. After your deletion request, a 30-day grace period begins during which you can revoke the deletion. After the 30 days have elapsed, your data will be permanently deleted, including:

  • Profile data and account settings
  • All flashcards and decks
  • Stored audio files (TTS)
  • Generated images
  • Learning progress and review history

8. Your Rights (GDPR)

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15): You can request information about your stored personal data.
  • Right to rectification (Art. 16): You can request the correction of inaccurate data.
  • Right to erasure (Art. 17): You can request the deletion of your data.
  • Right to restriction (Art. 18): You can request the restriction of processing.
  • Right to data portability (Art. 20): You can request to receive your data in a structured, commonly used, and machine-readable format.
  • Right to object (Art. 21): You can object to the processing of your data.
  • Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority.

To exercise your rights, please contact: hello@sesang.de

Last updated: February 21, 2026