Privacy policy

Isabel, trading as Learn Portuguese with Isabel, based in Albufeira, Algarve, Portugal, is the data controller. You can reach her at learnportuguesewithisabel@gmail.com.

You do not need an account to read this site, take the level test or use the free tools. If you create one, these are the things the site keeps, and why:

• Your name and e-mail address — to log you in and so Isabel knows whose account is whose.
• Your password, as a bcrypt hash — a one-way scramble. Nobody, including Isabel, can read your password from it.
• When you signed up and accepted this policy, and when you were last active.
• The bundles unlocked for you — which ones, when, whether Isabel unlocked them or an online payment did and, if there is one, a short note (for example how you paid, or Stripe’s reference for the payment). No card or bank details are ever stored here.
• Your online orders, if you start a payment at checkout with “Pay securely” — for each one: which bundle, the amount, the date, its state (not finished, awaiting payment, paid, refunded…) and Stripe’s reference for the payment. See Paying online.
• Your progress — the lessons you marked as done (and when), and the last lesson you opened, so the site can take you back to it.
• Your notes on each lesson (with the minute of the video you pinned them to, if you did) — only you see them, in the lesson and in your notebook.
• Your level-test result (level and score, not your answers), if you took the test while logged in or right before signing up.

The lawful basis is the contract with you (running the account you asked for) and your consent, which you give when you sign up. Isabel can see your name, e-mail, bundles, orders, progress and level result in her admin, to look after your account; she cannot see your password or your notes there.

To stop people guessing passwords, the site also counts recent sign-in attempts. It keeps only a scrambled (hashed) key made from the connection address and e-mail, never the address itself. Counters older than a day are removed automatically the next time the site checks one.

Account data lives in a PostgreSQL database run by Neon (neon.tech), in a data centre in the United States (AWS us-east-2, Ohio), in a section of the database used only by this site. The site itself is served by Vercel (vercel.com), which runs it on servers in the United States and elsewhere. Both act as processors on Isabel’s behalf; data sent outside the European Economic Area relies on the safeguards in their data-processing terms (the European Commission’s standard contractual clauses).

Everything travels encrypted (HTTPS) and the database is only reachable with a secret key held by the site.

The site sets two cookies, and only when you log in:

• lpi_session — keeps you logged in for up to 30 days. It holds a random code, not your name or e-mail, and cannot be read by scripts on the page. Logging out deletes it and ends the session on the server.
• lpi_in — simply says “someone is logged in on this browser”, so the menu can show “My lessons”. It contains no personal data and gives no access to anything.

Both are strictly necessary for an account to work, so there is no cookie banner — there is no analytics, advertising or tracking cookie to consent to.

Two things stay in your own browser and never reach a server unless you act: the verb trainer’s score (local storage, with a Reset button), and a level-test result you have not saved yet (kept in the open tab only, so a sign-up right after can keep it).

This site has no contact form and sends nothing to Isabel on your behalf. If you e-mail her, your message and your address are in her own mailbox, and she keeps them for as long as she needs them to answer you. Ask her to delete them and she will.

Her admin also lists new sign-ups (your name, e-mail and, if you took it, your level-test result) and any message sent through earlier versions of this site. All of it is deleted with your account.

When you press “Pay securely” at checkout, the site sends Stripe (Stripe Payments Europe, Limited, Ireland) the bundle, its price, your account e-mail, an internal account number and the date of the Terms you accepted, and takes you to Stripe’s payment page. Your card or bank details are typed there, on Stripe’s page — this site never sees or stores them. Stripe then tells the site whether the payment went through, so the bundle can open on your account.

Of each order, the site keeps only what is listed under Your online orders above: the bundle, the amount, the date and its state, with Stripe’s reference. Isabel sees these orders in her admin, and the payment itself in her own Stripe account.

Stripe processes the payment for Isabel and, for its own legal duties (such as preventing fraud and keeping payment records), as a controller under Stripe’s privacy policy. Stripe may process data outside the European Economic Area under the European Commission’s standard contractual clauses. The lawful basis is the contract you enter into when you buy.

Pages that show Isabel’s YouTube videos display a still picture served by this site. Nothing is loaded from YouTube or Google until you press play; then the player loads from youtube-nocookie.com, Google’s privacy-enhanced embed, and Google’s privacy policy applies to what happens inside it.

Lesson videos inside your account work the same way: the lesson page shows a play button, and nothing is loaded from the video service until you press it. The video then plays either from YouTube (youtube-nocookie.com, as above) or from Bunny Stream (bunny.net, BunnyWay d.o.o., Slovenia), the service that stores and streams Isabel’s lesson videos for her. When a Bunny lesson plays, your browser connects to Bunny’s servers directly, as with any video service. The player only appears on lessons you have access to.

Lessons on Bunny Stream are protected: the site creates a link to the video only when you press play, only for your account, and the link stops working after a few hours. The site does not send Bunny your name or e-mail address. While the video plays, your e-mail address is shown faintly over the picture — only on your own screen, only for you — so that a recording of a lesson can be traced to the account it came from.

Log in, open Account settings and press Delete my account (you confirm with your password). It happens at once and removes your account, your sessions, your bundle access, your online orders, your progress, your notes, your level-test result, and every message stored in Isabel’s admin that is linked to your account or your e-mail address. It cannot be undone.

You can also e-mail Isabel and ask her to do it for you. The database provider keeps a short rolling history for recovering from accidents; deleted data disappears from it on its own within days. E-mails you sent Isabel are in her own mailbox — ask her to delete them. Payments made online stay on record at Stripe (and in Isabel’s accounts) for as long as the law requires.

• Level test — your answers exist only in the open page. The result is kept only as described above.
• Sound trainer — the microphone is requested only when you press “record yourself”, and your browser asks your permission first. The recording stays in the page’s memory so you can play it back, is never uploaded, and is discarded when you leave. The “hear it” buttons use the voice already installed on your device.
• Verb trainer — the score counter lives in your browser’s local storage only.

Like every web server, the hosting provider records technical request data such as the IP address and the browser used, for security and to keep the service running. This site does not use that data for anything else.

Under the GDPR you may ask Isabel for a copy of the personal data she holds about you, ask her to correct it or delete it, object to its use, or withdraw a consent you gave. Write to learnportuguesewithisabel@gmail.com. If you are not satisfied with the answer, you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).

If this policy changes, the date at the top of the page changes with it.