Privacy Policy | Dutch Fluency

Hey, Rick here. Privacy policies are usually boring walls of legal text. I'll keep this as human as possible. The short version: your data is yours. We only collect what we need to make Dutch Fluency work for you, and we never sell it. Zo simpel is het.

Who we are

Dutch Fluency is a language learning platform created by Rick (that's me) based in Bangkok, Thailand. We provide podcasts, interactive tools, coaching, and reading materials for people learning Dutch. Our website is dutchfluency.com and our dashboard lives at dashboard.dutchfluency.com.

What we collect

Account info

Your name and email when you sign up for tools, transcripts, email training, or the assessment. That's it. No phone number, no address, no shoe size.

Payment info

Handled entirely by Stripe. We never see or store your card details. Stripe is PCI-DSS compliant (fancy way of saying: they take security seriously).

Usage data

We track your progress (XP, streaks, completed exercises) so you can see how far you've come. We also use basic analytics (page views, clicks) via Vercel Analytics to understand which pages are useful.

Diary entries (Dagboek)

If you use the Dagboek, your entries are stored so you can review them later. They're yours. We don't read them, share them, or use them for anything beyond providing the service to you.

Cookies

We use a language preference cookie (df-locale) and essential session cookies. No tracking cookies, no ad cookies, no creepy follow-you-around-the-internet cookies.

Voice recordings

If you use pronunciation practice (Fluency Tulip, speaking challenges), we record your audio. This is sent to OpenAI Whisper for transcription and Claude AI (Anthropic) for feedback. Voice data may be considered biometric data under GDPR Article 9 — we only process it with your explicit consent, which you can withdraw anytime.

AI-processed content

Your writing (Dagboek entries, challenge submissions) and conversations with our AI tutor are processed by Claude AI (Anthropic) to give you personalized feedback. Your "Jouw Podcast" intake data is used to generate custom episodes. We send only the minimum data needed — never your email, password, or payment info.

How we use your data

1. To provide the service (tools, podcasts, transcripts, coaching)
2. To send you things you signed up for (email training, assessment results)
3. To improve Dutch Fluency (understanding which tools people actually use)
4. To process payments (via Stripe)

We never sell your data. We never share it with advertisers. We never use it to train AI models. Full stop.

Third-party services

We use these trusted services to run Dutch Fluency:

Anthropic (Claude AI) — writing feedback, speaking analysis, AI conversations (USA)
OpenAI (Whisper) — speech-to-text transcription for voice exercises (USA)
ElevenLabs — text-to-speech audio generation for podcasts and lessons (USA)
Stripe — payment processing (USA/EU)
Supabase — database and authentication (EU — Frankfurt)
Vercel — website hosting and analytics
Heroku (Salesforce) — dashboard application hosting (EU)
Resend — transactional emails
BunnyCDN — audio and media delivery
Cloudflare — CDN, security, and bot protection

Some of these are US-based. Data transfers are protected by Standard Contractual Clauses (SCCs) as required by GDPR. Each service has their own privacy policy and we chose them because they take data protection seriously.

Legal basis (GDPR)

For the legal folks — here's why we process your data:

Contract (Art. 6(1)(b)) — providing the learning platform, processing payments
Consent (Art. 6(1)(a)) — AI-powered feedback, personalized content, email notifications
Explicit Consent (Art. 9(2)(a)) — voice recording processing (biometric data)
Legitimate Interest (Art. 6(1)(f)) — account security, fraud prevention, service improvement

Your rights

Under GDPR, you can always:

● Access your data (Art. 15) — download it from your dashboard Settings, or ask us
● Correct your data (Art. 16) — wrong email? Name change? Just tell us
● Delete your data (Art. 17) — delete your account in Settings, or email us. We'll wipe everything within 30 days
● Export your data (Art. 20) — download a JSON export from your dashboard Settings
● Withdraw consent (Art. 7(3)) — revoke voice recording or AI processing consent anytime in Settings
● Unsubscribe from emails — every email has an unsubscribe link

We respond to all data requests within 30 days. You can also lodge a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) at autoriteitpersoonsgegevens.nl.

Data security

We take security seriously:

All connections encrypted with HTTPS (TLS)
Passwords hashed with bcrypt (12 salt rounds)
Sensitive content (journals, conversations, voice transcriptions) encrypted at rest with AES-256-GCM
Role-based access control for all internal systems
Rate limiting and CAPTCHA protection against abuse
Automated security scanning on every code change
Personal data automatically redacted from application logs

Data retention

We keep your data as long as you have an account. If you cancel your subscription, your account and data remain so you can come back anytime. If you want everything deleted, email us and we'll wipe it within 30 days.

Children

Dutch Fluency is designed for adults learning Dutch. We don't knowingly collect data from anyone under 16. If you're a parent and think your child signed up, reach out and we'll remove their data.

Changes

If we update this policy, we'll post the changes here. No sneaky edits. For major changes, we'll send an email.

Questions?

Privacy stuff can feel abstract. If you have any questions about your data, just email me directly at [email protected]. I'll reply personally. Geen probleem.