Privacy Policy

1. Data controller

Greeble Labs, LLC is the data controller responsible for your personal data. If you have questions about how we process your data, contact us at:

Greeble Labs, LLC
c/o Legalinc Corporate Services Inc.
131 Continental Dr Suite 305
Newark, DE 19713
Email: privacy@greeblelabs.io

2. Scope

This policy covers the Parlessa website at parlessa.com, the Parlessa web app at app.parlessa.com, the Parlessa applications for iOS and Android, and the account, progress and billing services behind them.

3. Information we collect

Account information

When you create an account we collect your email address and either a password, which we store only as a salted hash, or the identifier and email address that Google or Apple give us when you sign in with them. We never see your Google or Apple password.

Learning progress

Which labs you have started and finished, when, and at what pace; your self-ratings and any lines you flag; the schedule state for each structure; and your settings (pace, show-text-after-answer, no-timer mode, reminder time, and your analytics and ad-sharing switches). Progress is synced to our server when you are signed in so it follows you across devices.

Device install id

A random identifier stored in your browser's local storage or the app's secure store. It lets us save your progress before you have an account and lets analytics count you once. It is not linked to a person until you sign in.

Usage analytics

We use PostHog to record page views and product events such as "lab started", "lab completed" and "signed up". Events carry the install id, the page path, the referrer, the type of browser or device and, on your first visit, any campaign parameters in the address (utm_*, fbclid, ttclid, gclid, rdt_cid). Analytics run without cookies: identifiers are kept in local storage, requests go to our own address (e.parlessa.com), session recording is off, and Do Not Track is respected.

Nothing you say

The Service does not use the microphone. Nothing you say during a lab is recorded, transmitted or processed.

Support correspondence

Any information you include when you write to us, such as your email address and the content of your message.

Payment information

Purchases on the web are processed by Lemon Squeezy, which acts as the merchant of record. Purchases inside the apps are processed by Apple (App Store) or Google (Google Play). We do not collect or store payment card information. We store your entitlement (plan, status, renewal date) and the merchant's order reference so we can give you access and answer billing questions.

4. Legal basis for processing (EEA and UK users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following grounds:

Where we rely on legitimate interest, we have conducted a balancing test to make sure our interests do not override your rights and freedoms.

5. How we use information

• Operate the Service: sign you in, save and sync your progress, schedule structures for revision
• Process subscriptions and give you the access you paid for
• Send the transactional emails described in section 8
• Respond to support requests
• Understand how the Service is used and improve it
• Measure advertising, as described in section 7
• Diagnose technical problems and keep the Service secure
• Comply with legal obligations

6. Cookies and analytics

The Site and the apps do not set analytics cookies, which is why there is no cookie banner. Analytics identifiers are stored in local storage. You can switch analytics off in the account settings; the switch is honoured on every device you are signed in on. For users in the EEA and UK, analytics and ad-conversion sharing are only enabled with your consent.

Lemon Squeezy may set cookies on its own checkout pages under its own privacy policy.

7. Ad-platform conversion sharing

When you arrive from an advertisement, the ad platform's click identifier is stored with your install id. If you then sign up, complete a lab or buy a plan, we may send that click identifier and the name of the event to the platform that showed you the ad (Meta, TikTok, Google or Reddit) from our server, so the platform can measure whether the ad worked. No progress data and no audio is sent. Where a platform requires an email address, it is hashed before it is sent.

You can opt out at any time in the account settings ("share conversions with ad platforms"). Visitors in the EEA and UK are asked before it is switched on. This sharing is the only activity we carry out that may count as "selling" or "sharing" personal information under US state privacy laws, and the same switch honours a "do not sell or share" request.

8. Emails

We send transactional email through Resend: sign-in and password-reset links, a welcome message, a notice when your plan changes, an optional daily reminder that you switch on yourself, a notice before an inactive account is deleted, and replies to your support messages. Receipts come from Lemon Squeezy, Apple or Google. Every optional email carries a one-click unsubscribe. We do not sell or rent email addresses and we do not send a newsletter.

9. How we share information

We share information with service providers who process it on our behalf:

• Cloudflare, Inc.: hosting, storage, the API and the analytics proxy (United States and European Union data centres)
• PostHog, Inc.: product analytics (United States)
• Resend, Inc.: transactional email (United States)
• Lemon Squeezy, LLC: merchant of record for web purchases
• Apple Inc. and Google LLC: purchases made inside the apps
• RevenueCat, Inc.: validation of app-store receipts
• Meta, TikTok, Google and Reddit: conversion events only, as described in section 7, and only when the switch is on
• Legal authorities, if required by law or to protect our rights

We do not sell personal information.

10. International data transfers

Your information may be transferred to and processed in the United States and other countries outside the EEA or UK. When we transfer personal data outside the EEA or UK, we put appropriate safeguards in place, including Standard Contractual Clauses approved by the European Commission, data processing agreements with our service providers, and transfers to countries with adequate data protection laws. You may request a copy of the safeguards we use by contacting us.

11. Data security

We use industry-standard measures to protect your information, including encryption in transit (TLS), hashed passwords and access controls on our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Data retention

• Account, progress and settings are kept while your account exists
• Accounts with no activity for 24 months receive a notice and are deleted 30 days later
• Analytics events are kept for 24 months, then aggregated
• Server logs are kept for 30 days
• Transaction records may be retained for up to 7 years for tax and legal compliance
• Support correspondence is retained for up to 3 years after resolution

On request we will delete your personal data unless we have a legal obligation or legitimate business need to retain it.

13. Your rights

From the account page you can download everything we hold about you as a file, and delete your account, sessions and progress in one step; analytics events are then anonymised and a confirmation email is sent. Depending on your location, you may also have the right to:

• Access: request a copy of the personal information we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data
• Restriction: request that we limit how we use your data
• Portability: request your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise these rights, contact us at privacy@greeblelabs.io. We will respond within 30 days, or sooner if the law requires.

EEA and UK residents

You have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights. A list of EEA authorities is available at edpb.europa.eu. In the UK, contact the Information Commissioner's Office.

California residents

You have the right to request information about the categories of personal information we collect and how it is used, and to opt out of the sharing described in section 7. To make a request, contact us at the address in section 1.

14. Children's privacy

The Service is for people aged 16 and over and is not directed to children. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it promptly. If you believe we have collected data from a child, please contact us.

15. Third-party links

The Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites.

16. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with a new "last updated" date. For significant changes we will notify signed-in users by email or with a notice in the Service.

17. Contact us

Greeble Labs, LLC
c/o Legalinc Corporate Services Inc.
131 Continental Dr Suite 305
Newark, DE 19713
Privacy: privacy@greeblelabs.io
Support: support@parlessa.com