This policy explains what personal data MariaNihongo collects, why, who else handles it, how long we keep it and the rights you have. The short version: we collect as little as we can, we never sell data, we show no ads, we use no tracking or analytics, and lessons are never recorded.
Who is responsible for your data
The controller of your personal data is Maria, who runs MariaNihongo, Spain. For anything about your data, write to marianihongobusiness@gmail.com or send Maria a message from your dashboard.
What we collect
- Your account: name, email address, password (stored only as a secure one-way hash, which nobody can read), timezone, language, whether you've confirmed your email, when you accepted the terms, and whether you'd like our learning-tips emails.
- Your learning profile, which you choose what to fill in: country, native and other languages, Japanese level, JLPT goal and exam date, what you want to achieve, why you're learning, what you find hard, how you like to learn, a planned trip to Japan, and notes for Maria.
- Your lessons: bookings and their times, cancellations and moves (and the reason, if you give one), the notes, vocabulary and homework Maria shares with you, your homework answers, and Maria's own teaching notes about your progress, which you can ask to see.
- Messages between you and Maria.
- Your progress: experience points, levels, badges, study streaks, game results and the words you're practising. On the games leaderboard your name only ever appears shortened to its first and last letters (for example D····l), and you can leave the leaderboard in your profile.
- Purchases: what you bought and when, the price, your credits and their expiry, and Stripe's reference numbers for the payment. Your card details are handled by Stripe; we never see or store them.
- Duo lessons: if you buy one, the email address of the person learning with you. We use it to give them access and to tell them about it, so please only give it with their agreement.
- The contact form: your name, email address and message.
- Reviews: if you give Maria a review, the name, country, level and words you agree to publish.
- Technical data: your IP address and browser details in the server's records, used to keep the site secure (for example to slow down repeated wrong passwords) and to fix errors.
Children: for students under 18, the account belongs to a parent or legal guardian, who gives us the child's details. We only ask for what we need to teach, and the parent can see, change or delete them at any time.
Why we use it, and the legal basis
- To run your account and teach you (bookings, lessons, messages, homework, progress, reminders and the other emails about your lessons and purchases): this is needed to perform our contract with you (GDPR article 6(1)(b)).
- To take payments and keep order records and invoices: our contract, and our legal obligations under Spanish accounting and tax law (article 6(1)(c)).
- To keep the site secure, prevent abuse and fix errors: our legitimate interest in a safe, working service (article 6(1)(f)).
- Evening study-streak reminders: our legitimate interest in helping you keep your streak. You can turn them off in your profile at any time.
- Learning-tips emails: your consent, only if you ticked the box. You can withdraw it at any time in your profile, and withdrawing doesn't affect anything else.
- Publishing a review with your name: your consent.
- Giving a duo partner access: the buyer's contract, and our legitimate interest in letting the person it was bought for use it.
We don't make automated decisions about you, or profile you, in any way with legal or similar effects. Levels, streaks and badges are simply game features.
Lessons are never recorded
We don't record lessons, neither audio nor video. Lessons take place on a video call service, usually Google Meet (or Zoom, when that's the link Maria gives you), which processes the call under its own privacy policy.
Who else handles your data
Only the companies we need to run the service, each with only what it needs, under data processing terms:
- Render (Render Services, Inc.) hosts the website and its database, on servers in Frankfurt, Germany.
- Stripe (Stripe Payments Europe, Ltd., Ireland) processes payments. For its own legal and anti-fraud duties Stripe is a separate controller, under its own privacy policy.
- Google (Google Ireland Ltd. and Google LLC): our emails are sent through Google; lessons usually happen on Google Meet; the site's fonts come from Google Fonts, whose servers receive your IP address to send them; and the Videos page plays Maria's YouTube videos in YouTube's privacy-enhanced mode.
- The website administrator who builds and maintains the site, who can see data only as far as needed to keep it working, and is bound to keep it confidential.
- Public authorities, only when the law requires it.
We never sell your data, and we don't share it for advertising.
Data outside the European Union
Our data is stored in the EU. Stripe, Google and Render are, or belong to, US companies, so some data may be accessed from the United States. Those transfers are covered by the EU-US Data Privacy Framework and by the European Commission's Standard Contractual Clauses.
How long we keep it
- Your account, profile, lessons, notes, messages and progress: while your account is open. When you ask us to close it, we delete them within one month, except for what follows.
- Purchase and payment records: for as long as Spanish accounting and tax law requires us to keep them (up to six years), attached to an account with your name and details removed.
- Contact form messages: up to 12 months.
- Security records (such as the IP addresses of login attempts): 30 days. Server logs and error reports: a few weeks.
- Backups: overwritten within 30 days.
- Your consent to learning-tips emails: until you withdraw it.
Your rights
You can ask us, at any time and free of charge, to:
- show you the personal data we have about you and give you a copy (access);
- correct anything that's wrong (you can change most of it yourself in your profile);
- delete your data (erasure), close your account, or limit how we use it (restriction);
- give you your data in a common, machine-readable format, or send it to someone else (portability);
- stop using it where we rely on our legitimate interests (objection);
- withdraw any consent you've given.
Ask by message from your dashboard or by email to marianihongobusiness@gmail.com. We answer within one month, and may ask you to confirm it's really you. Parents and guardians exercise these rights for their children.
If you think we haven't handled your data properly, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (www.aepd.es), or to the authority where you live. We'd appreciate the chance to put it right first.
How we keep it safe
Everything travels encrypted (HTTPS); passwords are stored only as one-way hashes; only Maria and the website administrator can see student data, and important actions in the staff area are logged; repeated login attempts and form submissions are limited; and the database has regular backups.
Cookies
We only use the cookies the site needs to work, plus one that remembers your language. The Cookie Policy lists them.
Changes to this policy
We'll update this policy whenever the way we handle data changes. The date at the top shows the current version, and we'll email account holders about any important change before it applies.