Privacy Policy

1. Who We Are (Data Controller)

MocroDarija is an online platform for learning Moroccan Arabic (Darija), operated by:

TEAMBLADI e.U. (TEAMBLADI®) Slamastrasse 23, 1230 Vienna, Austria Phone: +43 676 4641061 Email: contact@mocrodarija.com Company registration: FN496717t (Handelsgericht Wien) VAT ID: ATU73526856

Full legal notice: see our Impressum page.

For privacy-related questions, contact us at contact@mocrodarija.com.

2. Data We Collect

Account data: When you register, we collect your email address and a bcrypt-hashed password. We never store your plaintext password.

Usage data: We record your learning progress, vocabulary review results, streak counts, and XP points, as well as interaction events with exercises (learning_events) used to power adaptive review. Sahbi AI chat conversations are stored to allow you to continue a session; you can delete a session's transcript from your account.

Language preference: Your chosen interface language is stored in your browser (localStorage) and, if you are logged in, in our database.

Payment data: Payments are processed by Stripe and PayPal. We do not store credit card numbers or full payment details. We receive only a subscription status and a customer identifier from these processors.

Cookies: We use a single httpOnly, secure authentication cookie (JWT token) to keep you logged in — this is strictly functional and does not require consent. If you accept analytics cookies via our consent banner, Google Analytics (GA4) sets its own cookies; nothing is set before you consent, and you can withdraw consent at any time via "Cookie settings" in the footer.

3. How We Use Your Data

We use your data to: - Operate your account and track your learning progress - Power adaptive review (surfacing the vocabulary/grammar you're weakest on) - Send transactional emails (password reset, payment receipts) - Improve the platform based on aggregate, anonymised usage patterns - With your consent only: understand site usage via Google Analytics

We do not sell your personal data to third parties. We do not use your data for advertising profiling.

4. Data Storage & Security

Your data is stored on servers hosted by Hostinger. We use parameterised SQL queries to prevent SQL injection. Passwords are hashed with bcrypt (cost factor 10). Authentication tokens are short-lived JWTs stored in httpOnly cookies, inaccessible to JavaScript.

We take reasonable technical and organisational measures to protect your data, but no system is completely immune to security risks. In the event of a breach affecting your personal data, we will notify you within 72 hours as required by GDPR.

5. Third-Party Services & International Transfers

We use the following third-party services (processors), each with their own privacy policies:

• •Anthropic (Claude API — powers the "Sahbi" AI conversation partner; your chat messages are sent to Anthropic to generate replies) — anthropic.com/legal/privacy
• •DeepL (translation pipeline used during content preparation) — deepl.com/privacy
• •Google (Analytics/GA4, only after you consent; Google Sign-In, if you use it) — policies.google.com/privacy
• •Stripe (payment processing) — stripe.com/privacy
• •PayPal (payment processing) — paypal.com/privacy
• •ElevenLabs (audio generation for pronunciation) — elevenlabs.io/privacy
• •Hostinger (hosting) — hostinger.com/privacy-policy

International transfers: Anthropic, Google, Stripe, PayPal, and ElevenLabs are US-based processors. Where personal data is transferred outside the EEA, we rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) as the transfer mechanism, per each processor's current Data Processing Agreement.

6. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• •Access: Request a copy of the personal data we hold about you, or use "Download my data" in your account settings for a machine-readable export
• •Rectification: Ask us to correct inaccurate data
• •Erasure: Request deletion of your account and associated data, or use "Delete my account" in your account settings
• •Portability: Receive your data in a machine-readable format
• •Objection: Object to certain types of processing

To exercise any of these rights, email us at contact@mocrodarija.com or use the self-service tools in your account. We will respond within 30 days.

7. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law (e.g. payment records for tax purposes, retained for up to 7 years).

8. Children

MocroDarija is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at contact@mocrodarija.com and we will delete it promptly.

9. Changes to This Policy

We may update this policy from time to time. We will notify registered users by email of material changes at least 14 days before they take effect. The current version is always available at https://mocrodarija.com/privacy.

10. Contact

For privacy-related questions or requests:

TEAMBLADI e.U., Slamastrasse 23, 1230 Vienna, Austria Email: contact@mocrodarija.com Phone: +43 676 4641061

We aim to respond within 5 business days.