Lessiqua
Start for free
How it worksGamesPricingLog in

Privacy policy

Last updated: 15 October 2026

This policy explains what personal data Lessiqua, the language-learning service available at https://lessiqua.com and https://app.lessiqua.com, processes, why it does so, who it shares the data with, how long it keeps it, and what rights you have.

Who the controller is

The controller is QuadiLab Sh.p.k., NUIS M61817005I, with its registered office at Rruga Norbert Jokl, Tirana, Albania.

For any privacy question, to exercise your rights or to make a complaint, you can write to us at [email protected].

Which laws apply

QuadiLab is based in Albania, outside the European Union, but it also offers Lessiqua to people in the European Union. For this reason, in addition to the Albanian law on the protection of personal data (Law No. 124/2024), we apply the EU General Data Protection Regulation (GDPR), as provided by its Article 3(2).

What data we process

We only process the data needed to run the service.

Account data

  • Email address.
  • Password, which we never store in plain text: we only store a hash computed with the bcrypt algorithm.
  • If you choose to sign in with Google: the email address and the Google account identifier that Google sends us.
  • The date you signed up, the date you verified your email, and the date you accepted the Terms of Service and this policy.
  • The plan you chose.

Study content

  • The language you are learning and your own language.
  • Your courses, vocabulary and progress, including spaced-repetition data.
  • The texts you import. You can paste them or upload them as files (txt, md, html, docx, odt, pdf) or as photos, up to 20 MB. Photos and scanned PDFs are transcribed into text. The original file is not kept: we only store the extracted text.
  • The sentences in the games, your answers and your results.

Usage data

Each time you use a feature based on artificial intelligence or audio, we record which service was used, the amount consumed (tokens or characters), the estimated cost and the date. We need this to count the tokens in your plan and to enforce usage limits.

Security data and technical logs

  • To limit repeated attempts to sign in, sign up or reset a password, we record the IP address and email address used in the attempt. This data is deleted after 24 hours.
  • The server keeps technical logs (IP address, date and time, page requested) to keep the service secure and to detect malfunctions and abuse.

Voice for pronunciation assessment

In the game where you repeat a sentence out loud, the recording of your voice is sent from your browser directly to Microsoft Azure, which assesses it and returns the pronunciation scores. We do not receive or keep the recording: we only store the scores. Recording starts only when you start it and after you have allowed your browser to use the microphone.

Why we process data and on what legal basis

  • Performance of the contract: creating and managing your account, providing the service (importing texts, vocabulary, games, course, reviews, token counting) and sending you service emails, such as email verification and password reset.
  • Legitimate interest: protecting the service and its users, preventing abuse and fraud, limiting sign-in attempts and enforcing usage limits. We have assessed that this processing is limited to what is necessary and does not override your rights; you can still object as explained below.
  • Legal obligations: once payments are active, we will keep the billing data required by tax and accounting law.

What we do not do with your data

  • We do not use it for marketing and we do not send you promotional newsletters.
  • We do not carry out advertising profiling.
  • We do not sell or hand over your data to third parties.
  • We do not use your data to train artificial intelligence models.

Who we entrust data to

To provide the service we rely on a number of providers, who process data on our behalf as processors, only for the purposes stated and according to our instructions:

  • Hetzner Online GmbH (Germany): servers, database and backups.
  • Anthropic PBC (United States): the Claude artificial intelligence model. It receives the texts of the sentences, your answers in the games to be assessed, and the texts or photos to be transcribed. We use Claude through the API: according to Anthropic's terms, data sent through the API is not used to train its models.
  • Microsoft Ireland Operations Ltd (Microsoft Azure, with data centres in Germany): text-to-speech for the sentences and pronunciation assessment.
  • Mailgun (Sinch group), EU region: sending service emails.
  • Google Ireland Ltd: authentication, only if you choose to sign in with Google.
  • Cloudflare, Inc.: content delivery and traffic protection network (DNS and proxy) in front of the website.

We may also disclose data to public authorities where required by law.

Transfers outside the European Economic Area

Some data is processed outside the European Economic Area, in particular in the United States (by some providers) and in Albania (where the controller is based). These transfers rely on the standard contractual clauses approved by the European Commission or on other appropriate safeguards provided for by the GDPR. You can ask us for more information about the safeguards in place by writing to [email protected].

How long we keep data

  • Account data and study content: for as long as the account exists.
  • Account deletion: when you delete your account from your personal area, we immediately delete from the database your user record, courses, vocabulary, texts, progress and usage statistics. Backups that still contain this data are overwritten on a rotating basis within a limited period.
  • Verification and password reset links: they are single-use and expire after 24 hours (email verification) and after 1 hour (password reset).
  • Sign-in, sign-up and reset attempts: 24 hours.
  • Technical server logs: for a limited period, as long as needed for security purposes.
  • Billing data, once payments are active: for as long as required by tax law.

How we protect data

We take appropriate technical and organisational measures to protect data against unauthorised access, loss or alteration: for example, passwords are stored only as hashes and traffic to the website is encrypted. However, no system is one hundred per cent secure: please choose a strong password and do not share it.

Your rights

You can exercise the following rights at any time:

  • Access: to know what data we process about you and to receive a copy of it.
  • Rectification: to correct inaccurate or incomplete data.
  • Erasure: to have your data deleted. You can do this yourself by deleting your account from your personal area, or by asking us.
  • Restriction: to ask for processing to be restricted in certain cases provided for by law.
  • Objection: to object to processing based on our legitimate interest, on grounds relating to your particular situation.
  • Portability: to receive the data you have provided to us in a structured, machine-readable format. You can ask for a copy of your data by writing to [email protected].

To exercise your rights, write to [email protected] from the email address linked to your account. We will reply within the time limits set by law; we may ask you for information to verify your identity.

If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the data protection supervisory authority of the EU country where you live or work or where the alleged infringement took place, or with the Albanian Information and Data Protection Commissioner (Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale).

Minimum age

Lessiqua is intended for people aged 16 and over. We do not knowingly collect data from younger people: if we learn that an account belongs to someone under 16, we will delete it.

Cookies

We only use technical cookies and the browser's local storage, which are needed for the service to work. The details are in the Cookie Policy.

Changes to this policy

We may update this policy, for example when we add features or providers. The date at the top of the page shows the latest version. If the changes are significant, we will let you know in advance by email or with a notice in the app.

Contact

QuadiLab Sh.p.k., Rruga Norbert Jokl, Tirana, Albania. Email: [email protected].