Privacy Policy
Effective from [effective date] · UK GDPR & Data Protection Act 2018
1. Who's responsible for your data
Digital Blue Solutions Limited, trading as Tungo, is the "data controller" for the personal data described in this policy. Our registered office is [registered office address], company number [company number]. You can reach us about privacy matters at [privacy email, e.g. privacy@tungo.xyz].
2. What we collect
Account data
- Your email address and password (we only ever store a securely hashed version of your password, never the password itself).
- Your base language and the language you're learning, and your learning settings.
Usage data
- Your activity within lessons and games – for example, answers given, progress, and which tasks you've completed – so the app can track and adapt to your progress.
Technical data
- A first-party login cookie that keeps you signed in, and a short-lived, single-use signed token used only at the moment of logging in to securely carry your session from tungo.xyz to my.tungo.xyz.
- Standard technical data such as IP address and browser type, used for security and troubleshooting.
Payment data
- Records of your plan and payments (amount and date). Your card details are entered directly with our payment processor, Stripe, and never pass through or get stored on our own servers.
Communications
- Emails we send you, such as password reset links, and any messages you send us for support.
3. What we use it for
- To create and run your account and deliver the lessons and games themselves;
- to process your top-ups and keep accurate records of them;
- to send essential account emails, like password resets;
- to keep the Service secure and stop misuse; and
- to understand how Tungo is used so we can improve it.
4. Our legal basis
We rely on:
- Contract – most of the above is necessary to provide the Service you've signed up for;
- Legitimate interests – for keeping Tungo secure and improving it, in a way that doesn't override your own rights; and
- Legal obligation – for keeping financial records we're required to keep.
5. Cookies
Tungo uses one strictly necessary cookie to keep you signed in across the app. We don't currently use advertising or third-party tracking cookies. [Update this section if analytics or marketing cookies are added later – those require a cookie banner and consent under PECR.]
6. Who we share it with
We share the minimum necessary data with the suppliers who help us run Tungo:
- Stripe, to process plan payments;
- [email delivery provider / SMTP host], to send account emails; and
- [hosting provider], who host our servers.
We don't sell your personal data, and we don't share it with anyone else for their own marketing purposes.
7. Where it's stored
[Confirm where servers/backups are physically located. If any supplier above is outside the UK/EEA, name the country and the safeguard used – e.g. the UK's International Data Transfer Agreement or the EU Standard Contractual Clauses.]
8. How long we keep it
We keep your account data for as long as your account is active. If you close your account, we'll delete or anonymise your personal data within [X months], except where we need to keep payment records for longer to meet our accounting and tax obligations (typically [6 years, per HMRC requirements – confirm]).
9. Keeping it secure
We use industry-standard measures to protect your data, including encrypted connections (HTTPS) across the Service, securely hashed passwords, and access controls that limit who inside Tungo can see your data.
10. Your rights
Under UK GDPR, you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct anythin