Privacy policy
In force since 2026-10-26.
This policy explains what Fluent by Now does with information about you when you use fluentbynow.com (the lessons, the dashboard, the live class screen), schools.fluentbynow.com (the site for schools) and the emails we send. It is written to be read, not to be scrolled past. If anything is unclear, write to us.
1. Who is responsible
- Controller: Fluent by Now
- Email: zeev@freshportugal.com
We have not appointed a data protection officer, as the law does not require one for a service of this size; the address above reaches the person who answers data questions. Portugal's supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
2. What we collect, why, and on what basis
| Data | What we use it for | Legal basis |
|---|---|---|
| Account: your email address and the name you give | Signing you in with an email link (no password), telling you apart from other learners, writing to you about your account and your lessons. | Performance of our contract with you (GDPR art. 6(1)(b)). Without an email address there is no account. |
| Learning record | Your level test and its transcript, your plan, the lessons and exercises you did, your mistakes and the cards to review, your preferences, your streak and goals. Kept in your browser and mirrored to your account so your phone and your computer show the same lessons. | Performance of our contract (art. 6(1)(b)). |
| Your conversation with the AI teacher | What you write or say in a lesson is sent, with your first name, your level and the recent conversation, to OpenAI, whose language models produce the teacher's answers, corrections and exercises. The history stays in your learning record so the teacher remembers what you did. | Performance of our contract (art. 6(1)(b)). The AI teacher is the service. |
| Voice recordings | When you press the microphone, your browser records until you stop, and sends the recording once to OpenAI to be written down. We do not keep the recording; only the transcript stays in your lesson. Your voice is never compared with anyone's or used to recognise you. | Your choice each time you record (consent, art. 6(1)(a)); you can always type instead. A one-time explanation appears before the first recording on each device. |
| Photos of pages | A photo you choose is made smaller on your device and sent once to OpenAI to be read, so the teacher can make a lesson from the page. The picture is not kept. | Your choice each time (consent, art. 6(1)(a)). Please photograph pages, not people. |
| Attention and study-time measurements | While a lesson is open, the app notes the minutes it really had your attention (tab in front, a touch or key in the last two minutes), how often you left in the middle, and your study days. This feeds your progress, your streak and, if you learn with a school, the school's view of who is really learning. | Performance of our contract with you and, for the school's view, our legitimate interest and the school's in teaching you well (art. 6(1)(f)). No decision with legal effect is taken from these numbers. |
| Reminder emails | A streak about to end, a week away, free days ending: at most one short email a day, chosen from what you did. A log of what was sent prevents repeats. | Our legitimate interest in helping you keep the habit you signed up for (art. 6(1)(f)). Every mail has a one-tap link that stops them, and the switch is on your dashboard under Reminders. We never write for a third party. |
| Invite links and free days | Your invite link, who joined with it, and the free days each side received; the invite code you used to join. | Performance of our contract (art. 6(1)(b)): the free days are the service you asked for. |
| Live classes and classrooms | The conversation of a class, the names participants type, and who was present. A teacher who joins by link without an account leaves only a name. | Performance of our contract (art. 6(1)(b)). |
| Security and fair use | Your IP address, for a short time, to limit how many sign-in links, photos and demo requests one address can ask for; per-account counters of premium voice and video minutes used each month; a daily cap on what the AI costs us. | Our legitimate interest in keeping the service up and affordable (art. 6(1)(f)). |
| Schools: demo requests and staff accounts | The name, email, school and notes a school sends from the demo form, and the accounts of a school's teachers and managers. | Steps before a contract and the contract with the school (art. 6(1)(b)). |
We do not use cookies or any other technique to profile you for advertising, and we take no automated decision about you that has legal or similarly significant effects. The plan the AI teacher builds adapts to your answers; your human teacher can change it.
3. Who sees your data
- Your school and your teacher. If you learn through a school (you joined with its invitation or its code), the school's manager and the teacher assigned to you see your progress: level, lessons done, mistakes, study days, attention measurements, the homework they set and your results. They see this to teach you, not to sell to you. The school decides what is taught and is responsible for its students' consent where they are minors; we process their students' data on the school's instructions, and a data processing agreement is available on request. Learners who join with a general invite code belong to our own "Fluent by Now" school, which only our team sees.
- A human teacher in a live class sees the conversation of that class and can speak in it.
- Our team. A small number of administrators can open any account to help you, fix a problem or keep the service safe. Access is limited to named addresses and is used only for that.
- Our providers, listed below, on our instructions.
- Authorities, only when the law obliges us.
4. The AI teacher: what it is and is not
Marta, Tiago, Anna and the other teachers are not people. They are an AI system: our lesson engine around large language models run by OpenAI, with synthetic voices from OpenAI and ElevenLabs and, in role plays, a video character rendered by HeyGen. You are told this where you first meet them, an "AI" mark stays next to their name, the avatar video and the generated audio are marked as such, and the terms say the same.
- It can be wrong. A correction, an explanation or a level estimate can contain mistakes. Check what matters with your human teacher: in a lesson with a teacher present, the teacher is the authority and the AI teacher defers to them.
- No emotion recognition. The app does not infer your emotions from your voice, your face or your typing, and it never uses your camera.
- No biometric identification. Voice recordings are transcribed into text and discarded; nothing about your voice is stored or compared.
- No decisions with legal effect. Your level, your plan and your progress report are indications for you and your teacher, not grades with consequences, and a person can always override them.
- Personalisation, explained. The plan adapts to your answers, your mistakes and your teacher's instructions. You can see the plan, skip steps and ask for anything else.
5. Children
You can open an account on your own from 16. Younger learners use Fluent by Now through a school, which collects the consent of a parent or guardian before inviting them, or with a parent's or guardian's consent sent to us. If you believe a child has an account without that consent, write to us and we delete it.
Cookies and storage in your browser
There is no analytics service, no advertising pixel and no third-party tracker on fluentbynow.com or schools.fluentbynow.com. Everything the site keeps in your browser is needed for what you asked it to do: sign you in, keep your lessons, remember a choice. That is why the first-visit notice only informs you and asks for no consent. Should we ever add something that is not strictly necessary, we will ask first.
| Name | Kind | Purpose | How long |
|---|---|---|---|
pla_session | cookie | Keeps you signed in after you open a sign-in link (httpOnly, never readable by scripts). | 30 days from your last visit when you asked to be remembered; otherwise until you close the browser. |
pla_view_role | cookie | For school staff and administrators only: which view of a school is open (manager, teacher, student). | Until the view is closed; the browser keeps it for at most 400 days. |
pla_oauth | cookie | Only during a sign-in with Google, when that option is offered: a one-time code that ties the answer from Google to your browser. | 10 minutes. |
pla-* | local storage | Your learning record on this device: profile, level test, plan, lessons, exercises done, mistakes to review, chat history with the AI teacher, streak, attention measurements, preferences. Mirrored to your account when you are signed in. | Until you delete your account, sign in as someone else on this device, or clear the browser's site data. |
__pla_* | local storage | Bookkeeping for the sync between this device and your account: which keys changed, when the last sync was, who last signed in here, the cached account and school. Not sent anywhere. | Until you sign out or delete your account. |
fbn-site-lang | local storage | The language you chose for the schools website. | Until you clear the browser's site data. |
fbn-onboard-v1 | local storage | On the schools site: the draft of the school you are setting up (name, logo, colours, courses), so a reload does not lose it. | Until the school is opened or the browser's site data is cleared. |
fbn-school-brand | session storage | On the schools site: the logo and colours of the school preview you are tailoring, so the preview survives a page change. | Until the tab is closed. |
fbn-notice-* | local storage | That you have seen this notice, and the one-time explanations before the microphone and the camera are used. | Until you clear the browser's site data. |
fbn-class-* | local storage | On the live class screen: the language of the screen and whether the teacher's voice plays by itself. | Until you clear the browser's site data. |
fbn-joined-v1 | local storage | The classrooms you joined by link (their links and names), so they are listed on your dashboard. Kept on this device only, never synced. | Until you delete your account or clear the browser's site data. |
fbn-teacher-name | local storage | On the live class screen: the name a teacher without an account typed, so it is filled in next time. | Until you clear the browser's site data. |
fbn-myclass-nav | session storage | For a pupil: whether they are in a school class group, so the menu shows "My class" without asking the server on every page. | Until the tab is closed. |
__pla_reloaded_for, __pla_school_view, __pla_group, __pla_group_tab | session storage | Technical flags: that the page already reloaded for a new build, and which school tab, class and class tab were open. | Until the tab is closed. |
fbn-unit-v1|* | session storage | Where you were in a unit's lesson (its stage and the step of the introduction), so a reload brings you back to the same place. | Until the tab is closed. |
__pla_play_* | local storage | A copy of your XP, level, achievements and Wordlings for the course, so the screen shows them at once while the account loads. | Until you clear the browser's site data; the account keeps the real record. |
shell, static, audio | offline cache | The service worker's offline cache: the app's files and the audio already played, so the app installs and works without network. | Until a new version of the app replaces them. |
Who processes data for us
These companies process personal data on our instructions and under a data processing agreement. Where a provider is in the United States, the transfer rests on the European Commission's Standard Contractual Clauses. We do not sell personal data and we do not share it with advertisers.
| Provider | What it does | What reaches it | Where |
|---|---|---|---|
| Cloudflare | Hosts the site, the database with accounts and learning records, the audio cache and the rate limits; delivers the email we send. | Everything in your account; your IP address in request logs and rate-limit counters. | Cloudflare, Inc. (United States) with data centres in the EU; EU Standard Contractual Clauses. |
| OpenAI | Runs the AI teacher: the conversation, the corrections, the exercises, the reading of a photographed page, the transcription of your voice, and the standard spoken voice. | The text of the lesson (what you write and what the teacher answers), your first name and level, the photo you send, the voice recording you make. Under OpenAI's API terms this data is not used to train their models. | OpenAI (United States); EU Standard Contractual Clauses. |
| ElevenLabs | The voices of the characters in role plays. | The character's lines (text only); never your voice. | ElevenLabs (United States); EU Standard Contractual Clauses. |
| HeyGen (LiveAvatar) | The video of the character in a role play, when you choose a video avatar. | The character's audio, so the lips move; a session identifier. Your camera is never used and your voice is not sent to HeyGen. | HeyGen (United States); EU Standard Contractual Clauses. |
| Resend | A second email sender, used when Cloudflare's is not available. | Your email address and the content of the mail (sign-in links, reminders). | Resend (United States); EU Standard Contractual Clauses. |
How long we keep things
| What | How long |
|---|---|
| Account (email, name) | Until you delete it, from your dashboard or by writing to us. |
| Sign-in sessions | 30 days from the last visit when you asked to be remembered, otherwise until the browser closes; stale records are removed when next seen and in any case after 400 days. |
| Sign-in links | Valid for 15 minutes and used once; deleted within a day of expiring. |
| Learning record (synced state) | While the account exists; deleted with it. |
| Attention and study-time measurements | The last 120 days, day by day; older days are dropped on your device and in the synced copy. |
| Voice recordings and photos | Not stored by us: sent for transcription or reading and discarded; the transcript or the lesson made from the page stays in your learning record. |
| Generated audio | Cached by voice and sentence, with no link to any account, so the same sentence is not generated twice. |
| Reminder mail log | Which reminder went to you and when, so none is repeated; deleted with the account. |
| Referrals | Who joined with whose link and the days each got; deleted with the account of either person. |
| Monthly allowances | Seconds of video avatar and characters of premium voice used per month; deleted with the account. |
| Rate-limit counters | Your IP address, for at most two hours. |
| Live class rooms | The conversation of a class and the names of its participants, for as long as the class link is valid. |
| Demo requests from schools | Name, email, school and notes, kept as long as we are in contact with the school. |
6. Your rights
You have the right to ask us for access to your data, to correct it, to delete it, to receive it in a portable format, to restrict or object to a processing, and to withdraw a consent at any time (which does not undo what was done before). Two of these you can do yourself, right now:
- Download my data, on your dashboard under My profile: a JSON file with your account, your whole learning record, your sessions, schools, referrals, homework and the reminders sent to you.
- Delete my account, in the same place: everything goes at once, including the sessions on every device. A school's manager hands the school to another teacher first, or writes to us.
- Reminders switch off from any reminder's footer or from your profile. Your name you change on the dashboard.
For anything else, write to zeev@freshportugal.com from the address of your account; we answer within a month. If you think we handle your data unlawfully, you can complain to the Comissão Nacional de Proteção de Dados (CNPD) (www.cnpd.pt) or to the authority of the country where you live.
7. Security
The site is served only over HTTPS. Sign-in links are valid for 15 minutes, used once, and stored only as a hash; sessions are stored as hashes too, so a copy of the database yields no usable sign-in. The session cookie cannot be read by scripts. API keys for our providers never leave our servers. Access to the admin area is limited to named addresses.
8. Changes
When this policy changes in a way that matters, the date at the top changes and we tell you on the dashboard or by email. Older versions are available on request.