Privacy Policy
Last updated: 14 April 2026
Riversource Ltd, trading as LibLang ("we", "our", "us"), is committed to protecting your privacy. This policy explains what personal data we collect, why we process it, the lawful bases we rely on, who we share it with, and your rights under UK data protection law.
Riversource Ltd is registered in England & Wales (Company No. 16499431), with its registered office at 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE, United Kingdom.
1. Information We Collect
We collect personal data directly from you, from your device or app, and from payment platform confirmations and app store receipt validation.
Account information: Email address, name, password (hashed and salted using bcrypt). Optional: age band, gender, home country.
Learning profile: Target language, topics of interest, hobbies, daily goal preference.
Learning progress: Quiz scores, mastery levels, streaks, XP, badges earned, course progress, vocabulary lists, Word of the Day completions, Daily Challenge completions.
Device information: Platform (iOS/Android), OS version, app version, screen dimensions, locale. Collected for compatibility, troubleshooting, and service improvement.
Push notification tokens: Device tokens for delivering push notifications via Apple Push Notification Service and Firebase Cloud Messaging.
Support tickets: Content you submit through the Help Centre, including bug reports, suggestions, and course requests.
Payment information: If you subscribe to Premium, payment is processed by Stripe (web) or Apple/Google (in-app). We do not store your card details — they are held by the payment processor. We receive confirmation of payment status and subscription state.
2. Lawful Bases for Processing
We process your personal data under one or more of the following lawful bases under UK GDPR:
- Contract: Where processing is necessary to create and manage your account, provide language learning features, sync progress across devices, deliver support, and process paid subscriptions.
- Legitimate interests: Where necessary to secure the service, prevent abuse, troubleshoot issues, improve the app, manage support requests, and administer overnight maintenance processes.
- Consent: Where you choose to receive optional push notifications, optional promotional or reminder emails, or other optional features that rely on consent. You can withdraw consent at any time through the app's notification settings or by contacting us.
- Contract or legitimate interests (service emails): Service-related emails such as password resets, email verification, billing notices, and important account or security messages are sent under contract or legitimate interests and are not marketing.
3. How We Use Your Information
- To provide and personalise the language learning service (contract)
- To track your learning progress across sessions and devices (contract)
- To send push notifications — streaks, reminders, ticket updates — if enabled (consent)
- To send optional promotional or reminder emails if enabled (consent)
- To send service-related emails such as password resets, email verification, billing notices, and important account or security messages (contract or legitimate interests)
- To provide support you request (contract)
- To triage support requests, improve support workflows, and prevent abuse (legitimate interests)
- To improve our content and application (legitimate interests)
- To process subscription payments (contract)
- To secure the service and prevent abuse (legitimate interests)
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
4. Third-Party Services
We share data with the following services to operate LibLang. Data is shared only as necessary to provide each service:
| Service | Purpose | Data shared |
|---|---|---|
| Resend | Email delivery | Email address, notification content |
| Expo / APNs / FCM | Push notifications | Device push tokens, notification content |
| Anthropic (Claude) | AI-assisted content generation | The minimum necessary ticket description or course request text needed for topic extraction and classification |
| Google Cloud Translation | Dictionary translation | Words and phrases for translation (no personal data) |
| Stripe | Web payment processing | Email, payment details (held by Stripe, not by us) |
| Apple / Google | In-app purchase processing | Purchase receipts (validated server-side) |
We do not sell your personal data. We do not use your data for advertising.
5. International Transfers
Some of our service providers may process personal data outside the United Kingdom. Where this happens, we ensure that appropriate safeguards are in place in accordance with UK data protection law, such as adequacy regulations or approved standard contractual protections.
6. Data Security
Passwords are hashed and salted using bcrypt. All data in transit uses HTTPS/TLS. Database backups are encrypted. Access to production systems is restricted to authorised personnel with SSH key authentication.
7. Data Retention
We retain your account and learning data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data from live systems within 30 days, except where retention is required by law or limited backup retention applies. Automated backups containing deleted data are overwritten within our standard retention cycle.
8. Your Rights
Under UK data protection law, you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your account and all associated data
- Restrict processing of your data
- Object to processing based on legitimate interests
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time where processing is based on consent
To exercise these rights, contact us at privacy@liblang.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are unhappy with how we handle your personal data. The ICO can be contacted at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
9. Children's Privacy
LibLang is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.
10. Notifications
Push notifications and optional promotional or reminder emails are optional. You can control these in the app's notification settings screen. You can also disable push notifications through your device settings at any time. Service-related emails such as password resets, email verification, billing notices, ticket updates, and security messages are not marketing and may still be sent regardless of notification preferences.
11. Cookies
The LibLang website uses a strictly necessary session cookie for authentication. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. No cookie consent is required for strictly necessary cookies under UK regulations.
12. Data Protection Officer
LibLang has not appointed a statutory Data Protection Officer as we do not meet the threshold requiring one. Privacy queries should be directed to privacy@liblang.com.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via the app or email. The "Last updated" date at the top indicates when the policy was last revised.
14. Contact Us
Riversource Ltd, trading as LibLang
2nd Floor College House, 17 King Edwards Road
Ruislip, London, HA4 7AE
United Kingdom
Company No. 16499431
Email: privacy@liblang.com