Privacy notice
Last updated: 19 October 2026
This is a translation. In case of any discrepancy, the Hungarian version prevails.
Controller
SimplySlaps, Budapest, Hungary. Email: [email protected].
What we process
| Purpose | Data | Legal basis | Kept |
|---|---|---|---|
| Account and sign-in | Email address, sign-in code hash, session, IP address, browser. With Google sign-in: name, picture, Google account ID and sign-in tokens. | Contract, GDPR Art. 6(1)(b). | Until you delete your account. Sessions: 30 days. Codes: 5 minutes. |
| Lessons | Answers and their grades, typed answers, progress, times. | Contract. | Until you delete your account. |
| Purchases | Order ID, pack, price, status, payment references, packs owned. | Contract. After account deletion, legitimate interest in handling legal claims, GDPR Art. 6(1)(f). | With the account. After deletion, without it, for 5 years from the order. |
| Withdrawal waiver | When the box was ticked, and the language. | Legal obligation, GDPR Art. 6(1)(c). | With the order. |
| Emails and complaints | Email address and message. | Legitimate interest. For complaints, legal obligation. | Until answered. Complaints: 3 years. |
| Logs and backups | Email address when an email fails to send. A database backup. | Legitimate interest in running the service. | Logs: until overwritten. Backups: 30 days. |
| Usage statistics in the app | Pages viewed and when, account ID, browser, device, screen size, approximate location from the IP address. | Legitimate interest in improving the service, GDPR Art. 6(1)(f). | 1 year. |
You must give an email address to have an account or buy a pack.
Recipients
An email delivery provider, a hosting and network provider and an analytics provider, PostHog (EU cloud), process data on our behalf. Link (Sold through Link, LLC), Stripe's reseller, handles payments as an independent controller under its own policy. With Google sign-in, Google also receives data.
Some of our providers are in the United States. Transfers rely on the EU-US Data Privacy Framework.
Cookies and browser storage
- Session cookie: keeps you signed in, for 30 days.
- Google sign-in state: for a few minutes.
NEXT_LOCALEcookie: your chosen language, for 1 year.simplyslaps:progress:…(browser storage): lesson progress, until you sign out.ss-lang-offer(browser storage): your answer to the language offer, until cleared.- Analytics storage (browser storage): a visitor ID for usage statistics in the app, until cleared. Signing out gives a new ID.
- YouTube's cookies: set by Google when a video loads.
We use no advertising cookies.
YouTube
Lessons play videos through the YouTube API Services. When a video or its preview image loads, Google collects data under the Google Privacy Policy. By watching the videos, you agree to the YouTube Terms of Service.
Your rights
You can ask for access, correction, erasure, restriction and portability. You can object to processing based on legitimate interest. Send requests to [email protected]. We answer within one month. You can delete your account yourself on the account page. You can also go to court.
You can complain to the Hungarian data protection authority, NAIH: 1363 Budapest, Pf. 9., Hungary, +36 1 391 1400, naih.hu. NAIH doesn't accept complaints by email. Send yours by post or through its online form.
Age
You must be 16 or older to create an account.