Privacy Policy

Last updated: August 23, 2026

Effective date: March 21, 2026

Privacy at a Glance

Where your data is stored: on servers in the United States. Section 7 sets out the safeguards we apply to these transfers.

1. Introduction

This Privacy Policy explains how Tathros GmbH ("we," "us," "our," "Tathros") collects, uses, stores, shares, and protects your personal data when you use the Vokabulo mobile application ("App," "Service").

It also covers the Vokabulo website at www.vokabulo.com (the "Website"). Unless a section refers to the Website explicitly, the practices described in this policy relate to the App. Section 10.2 sets out everything we process when you visit the Website.

We are committed to protecting your privacy. We only process what is strictly required to operate the App. We do not sell your data. We do not serve advertisements.

This Privacy Policy applies to all users of the App worldwide and addresses the specific requirements of the following data protection laws:

• EU: General Data Protection Regulation (GDPR)
• Germany: TDDDG, BDSG
• Italy: Codice della Privacy (D.Lgs. 196/2003)
• France: Loi Informatique et Libertés, CNIL Recommendations
• Spain: LOPDGDD (Ley Orgánica 3/2018)
• Brazil: LGPD (Lei nº 13.709/2018)
• United Kingdom: UK GDPR, Data Protection Act 2018, PECR
• United States: CCPA/CPRA, state privacy laws, COPPA

Please read this Privacy Policy carefully. By using the App, you acknowledge that you have read and understood this policy.

2. Data Controller

The data controller responsible for your personal data is:

Tathros GmbH, Zum Quellenpark 38, 65812 Bad Soden am Taunus, Germany

Email: privacy@vokabulo.com, Website: www.vokabulo.com

Managing Director: Wolfgang Männel

Commercial Register: Königstein HRB 7391, VAT ID: DE264657778

Data Protection Officer: Wolfgang Männel

3. What Data We Collect

We collect and process the following categories of personal data:

3.1. Account Data (provided by you at registration)

3.2. Learning Data (generated through your use of the App)

3.3. Sets Data (generated when you use Sets features)

3.4. Technical Data (collected automatically)

3.5. Data Processed by Third-Party Services on Our Behalf

4. What We Do NOT Collect

We want to be explicit about what we do not collect:

• No advertising identifiers (IDFA/GAID)
• No precise location data (GPS, Wi-Fi triangulation, or Bluetooth beacons)
• No browsing history or activity outside the App
• No contacts, calendar, or photo library data
• No health or biometric data
• No financial or payment card information (all payments are processed by Apple)
• No advertising networks or ad SDKs
• No cross-app or cross-site tracking
• No cookie-based analytics (our website analytics sets no cookies and stores nothing on your device)
• No audio recordings (voice input is processed on-device via Apple's speech recognition and is not stored or transmitted by us)

5. How We Use Your Data

We use your personal data for the following purposes:

We do not use your data for advertising, profiling for marketing purposes, or automated decision-making that produces legal effects concerning you.

6. Legal Bases for Processing

6.1. EU/EEA, UK, and Switzerland (GDPR / UK GDPR)

We process your data based on the following legal bases under Article 6 GDPR:

• Performance of contract (Art. 6(1)(b)): Processing necessary to provide the Service you signed up for, including account management, vocabulary storage, quiz functionality, sync, Sets features, AI-powered features, and subscription management.
• Consent (Art. 6(1)(a)): Processing for optional features that require your explicit opt-in, including push notifications, leaderboard participation, voice input (microphone access), and subscribing to our newsletter. You may withdraw consent at any time (see Section 11).
• Legitimate interest (Art. 6(1)(f)): Processing necessary for our legitimate interests, including ensuring app stability and security, fraud prevention, measuring aggregate traffic to the Website, and protecting the Website's newsletter signup form from automated abuse. We have balanced these interests against your rights and freedoms and determined that processing is proportionate and does not override your interests.

6.2. Brazil (LGPD)

Under the LGPD, we process your data based on: consent (Art. 7(I)), performance of contract (Art. 7(V)), and legitimate interest (Art. 7(IX)), as described in Section 5 above.

6.3. United States

In the United States, we process your data as described in this Privacy Policy to provide the Service under our Terms and Conditions. For California residents, see Section 15.

7. Data Storage and Security

7.1. Where Your Data Is Stored

Your data is stored in the following locations:

7.2. International Data Transfers

Your account data and learning data are stored and processed in the United States. Our backend provider (currently Convex) hosts our database on Amazon Web Services infrastructure located in the United States, our authentication provider (currently Clerk) also processes data in the United States, and our bot protection provider (currently Cloudflare) processes signup-form signals in the United States. Our other service providers may process data in the United States or in other countries where they maintain infrastructure. These countries may have data protection laws that differ from those in your jurisdiction.

For transfers from the EEA, we rely on:

• EU-U.S. Data Privacy Framework, for providers certified under it (Clerk and Cloudflare are certified);
• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914), incorporated into our data processing agreements with providers that are not certified under the Data Privacy Framework, including our backend provider;
• Adequacy decisions where available.

For transfers from the UK, we rely on:

• UK International Data Transfer Agreements (IDTAs) or the UK Addendum to EU SCCs, or the UK Extension to the EU-U.S. Data Privacy Framework where the provider is certified under it.

For transfers from Brazil, we rely on:

• the standard contractual clauses adopted by the ANPD under Resolução CD/ANPD nº 19/2024, or other appropriate safeguards under Article 33 of the LGPD.

Website analytics is not transferred. Our website analytics provider (currently Plausible) stores all data within the European Union, on infrastructure operated by European companies, and transfers none of it to the United States or any other third country. The transfers described in this section therefore do not apply to it.

Requesting a copy of the safeguards. You may request a copy of the safeguards in place for these transfers, including the relevant contractual clauses, by emailing privacy@vokabulo.com.

Transfer risk assessment. Before transferring personal data to the United States, we assessed whether local law or government access powers could undermine the protection these safeguards are intended to provide. That assessment takes into account the nature of the data (account details and vocabulary study records, with no special-category data), the sector in which our providers operate, and the transparency information our providers publish. Alongside the contractual safeguards, we apply technical measures including encryption in transit (TLS), encryption at rest (AES-256), isolated per-customer databases with unique credentials, and role-based access controls. We review this assessment periodically, and we will suspend transfers to a provider if we conclude that these measures no longer provide a level of protection essentially equivalent to the one guaranteed within the EEA.

7.3. Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted data transmission (TLS/HTTPS) for all network communications;
• Encryption of data at rest on our backend infrastructure (AES-256);
• Encrypted local storage via Apple's data protection framework;
• Authentication tokens stored in iCloud Keychain with hardware-backed security;
• Backend infrastructure with SOC 2 Type II compliance (Convex);
• Role-based access controls for internal systems;
• Regular security reviews of third-party dependencies.

No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Data Retention

When you delete your account, we perform a soft deletion immediately and permanently purge all personal data within 30 days, unless longer retention is required by applicable law (e.g., tax or financial regulations).

9. Data Sharing and Disclosure

9.1. We Do NOT Sell Your Data

We do not sell, rent, or trade your personal data to any third party. This applies globally, including under the definitions of "sell" and "share" in the California Consumer Privacy Act (CCPA/CPRA).

9.2. Service Providers (Data Processors)

We share data with the following categories of service providers who process data on our behalf, under contractual obligations to protect your data:

We may change service providers at any time. We will update this Privacy Policy to reflect material changes.

9.3. Other Users

When you participate in the leaderboard, the following data is visible to other users:

• Your username and profile photo (if set);
• Your streak data and points.

You can hide yourself from the leaderboard at any time in Settings > Privacy.

9.4. Legal Disclosure

We may disclose your data if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation; (b) protect our rights or property; (c) prevent fraud or address security issues; or (d) protect the safety of our users or the public.

9.5. Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you via email and/or prominent notice within the App of any change in ownership or use of your personal data and your choices regarding your data.

10. Cookies and Tracking Technologies

10.1. The App

The App does not use cookies, web beacons, pixel tags, or similar browser-based tracking technologies.

The App stores data locally on your device using:

• SwiftData (Apple's local database framework) — for vocabulary, quiz sessions, and other app data;
• UserDefaults — for app preferences and settings;
• iCloud Keychain — for authentication tokens (cross-device sync).

These are standard, on-device storage mechanisms and do not constitute tracking technologies. They are strictly necessary for the operation of the Service.

10.2. The Website

The Website at www.vokabulo.com sets no cookies and uses no web beacons, pixel tags or advertising trackers. Reading the Website stores nothing on your device and reads nothing from it.

Two things on the Website process data, and both are set out in full below: how we count visits, and what happens if you subscribe to our newsletter.

Traffic measurement. We measure aggregate traffic to the Website using a privacy-focused analytics provider (currently Plausible). This tool:

• sets no cookies and uses no browser cache or local storage;
• assigns you no persistent identifier, and does not track you across websites, apps, or devices;
• does not store your IP address. Your IP address and browser user agent are used momentarily to generate a daily hash so that a repeat visit within the same day is counted once. The salt behind that hash is rotated and permanently deleted every 24 hours, so a visitor cannot be recognised from one day to the next;
• stores all data within the European Union, on infrastructure operated by European companies.

We use this information solely to understand which pages are read and where our visitors come from. The legal basis is our legitimate interest in operating and improving the Website (Art. 6(1)(f) GDPR). You may object to this processing at any time (see Section 11).

We do not use the Website to build profiles, and we do not combine Website statistics with your App account.

The newsletter signup form. The Website offers a newsletter. Subscribing is entirely optional, it unlocks nothing in the App, and nothing on the Website is gated behind it.

If you subscribe, we process:

• your email address, which is required;
• your first name, only if you choose to give one, and only so that we can greet you by name;
• the language you selected, so that you receive the newsletter in that language.

We use double opt-in. When you submit the form we send a single confirmation email, and you are added to the list only when you click the link in it. This protects you from being signed up by somebody else. If you never confirm, your address is deleted automatically after 90 days. A first name you give is stored as plain text with any markup characters removed, and it is never used for anything but the greeting.

The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time, with effect for the future, using the unsubscribe link at the bottom of every newsletter or by emailing privacy@vokabulo.com. Withdrawing does not affect the lawfulness of what we sent before.

The subscriber list lives in our own backend (currently Convex, in the United States), and we write the messages ourselves. Delivery is handled by our email provider (currently Resend, United States), which receives your address and the message in order to send it. We use no newsletter or email marketing platform, and we never sell, rent or share the list. We do not track whether you open an individual newsletter or which links you click in it.

To stop the form being used to send unwanted mail to other people, we limit how often a single internet connection can submit it. For that we store a salted one-way hash of the IP address a submission came from, never the address itself, and the hashes are purged automatically every day.

Bot protection on the signup form. The signup form is protected by Cloudflare Turnstile, a bot check that replaces a traditional CAPTCHA. It is worth being precise about what it does:

• it loads only when you interact with the signup form. If you read the page without touching the form, nothing is requested from Cloudflare and no check runs;
• when it does run, your browser sends Cloudflare signals including your IP address, browser user agent and TLS fingerprint, which Cloudflare uses to distinguish a person from an automated script;
• the check runs inside a frame served by challenges.cloudflare.com and may store and read information on your device within that frame in order to work. It sets no cookie on www.vokabulo.com, and we do not use Cloudflare's pre-clearance feature;
• Cloudflare does not use these signals to show you advertising, and states that it cannot identify individuals from them. Cloudflare acts as our processor for the check itself, and as controller when it uses aggregated insight to improve its own bot detection, on the basis of its legitimate interest;
• our own server sends Cloudflare the IP address your request arrived from, so that the check can be scored against it. In return we receive only a pass or fail result, never the underlying signals.

The legal basis is our legitimate interest in keeping our signup form from being turned into a tool for mailing strangers (Art. 6(1)(f) GDPR). Cloudflare, Inc. is in the United States; Section 7.2 sets out the transfer safeguards, and Cloudflare is certified under the EU-U.S. Data Privacy Framework.

10.3. Why There Is No Cookie Banner

Under § 25 TDDDG (Germany) and PECR (UK), consent is required to store information on, or gain access to information already stored on, your device, unless doing so is strictly necessary to provide a service you have explicitly requested.

The App's local storage described in Section 10.1 is strictly necessary and is therefore exempt from that consent requirement.

Reading the Website stores nothing on your device and reads nothing from it, so for ordinary browsing these provisions do not apply at all. Our analytics sets no cookies and touches no device storage, which is why it needs no banner either.

The one exception is the bot check on the newsletter signup form (Section 10.2), which may store and read information on your device while it runs. It runs only when you use that form, it exists solely to establish that a person and not a script is submitting it, and it is therefore strictly necessary to provide a service you have explicitly requested. It falls under the exemption in § 25(2) No. 2 TDDDG and the equivalent exemption in PECR, and does not require consent.

For these reasons, neither the App nor the Website asks you to accept cookies.

11. Your Data Protection Rights

You have the following rights regarding your personal data. The specific rights available to you depend on your location.

11.1. Rights Available to All Users

Regardless of your location, you can:

• Access your data: View your account information, vocabulary, and learning data within the App at any time.
• Correct your data: Edit your profile, vocabulary, and other content directly in the App.
• Delete your account: Use Settings > User Account > Delete Account to permanently delete your account and all associated data.
• Export your data: Use the export feature in language pair settings to download your vocabulary data.
• Control notifications: Enable or disable push notifications in your device settings.
• Control leaderboard visibility: Toggle leaderboard participation in Settings > Privacy.
• Revoke permissions: Disable microphone and speech recognition access in your device settings.

11.2. Additional Rights Under EU/EEA Law (GDPR)

If you are in the EEA, you also have the right to:

• Restriction of processing (Art. 18) — request that we limit how we process your data;
• Data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format;
• Object to processing (Art. 21) — object to processing based on legitimate interests;
• Withdraw consent (Art. 7(3)) — withdraw consent for optional features at any time, without affecting the lawfulness of processing based on consent before withdrawal;
• Lodge a complaint with your local supervisory authority (see Section 14).

We will respond to GDPR rights requests within one month, extendable by two further months for complex requests.

11.3. Additional Rights Under German Law

• All rights under Section 11.2 apply.
• Under § 34 BDSG, you have the right to obtain information about data stored about you.
• Under § 35 BDSG, you have the right to correction, deletion, and restriction of processing.

11.4. Additional Rights Under Italian Law

• All rights under Section 11.2 apply.
• You may lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).
• Under the Codice della Privacy (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018), you may seek judicial remedy before the ordinary courts.

11.5. Additional Rights Under French Law

• All rights under Section 11.2 apply.
• You may lodge a complaint with the CNIL (www.cnil.fr).
• Under the Loi Informatique et Libertés (Loi n° 78-17), you have the right to define directives regarding the storage, deletion, and communication of your personal data after your death (Article 85).

11.6. Additional Rights Under Spanish Law

• All rights under Section 11.2 apply.
• You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.
• Under Title X of the LOPDGDD, you benefit from digital rights including the right to digital security and the right to digital education.

11.7. Additional Rights Under Brazilian Law (LGPD)

If you are in Brazil, you have the following rights under Article 18 of the LGPD:

• Confirm the existence of data processing;
• Access your personal data;
• Correct incomplete, inaccurate, or outdated data;
• Anonymize, block, or delete unnecessary or excessive data;
• Data portability to another service provider;
• Delete personal data processed with your consent;
• Obtain information about third parties with whom data is shared;
• Obtain information about the possibility and consequences of denying consent;
• Withdraw consent at any time.

Data Protection Officer (Encarregado): Wolfgang Männel, see above

Response Time: We will respond within 15 days, extendable by an additional 15 days.

You may file complaints with the ANPD at www.gov.br/anpd.

11.8. Additional Rights Under UK Law

• You have the same rights as listed in Section 11.2, as adapted under the UK GDPR and Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025).
• You may lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.
• Age of digital consent in the UK is 13 years old.

11.9. Additional Rights Under US Law

(a) California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information is collected, used, and disclosed;
• Delete your personal information;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information;
• Limit the use of sensitive personal information;
• Non-discrimination for exercising your rights.

We do not sell or share your personal information as defined by the CCPA/CPRA. We do not use sensitive personal information for purposes other than providing the Service.

Categories of Personal Information Collected (preceding 12 months):

Categories of Personal Information Sold or Shared: None. We have not sold or shared any personal information in the preceding 12 months.

Categories of Personal Information Disclosed for Business Purposes:

We do not knowingly collect personal information from consumers under 13.

(b) Other US State Privacy Laws

If you reside in Virginia, Colorado, Connecticut, Texas, or another state with a comprehensive privacy law, you may have rights including access, correction, deletion, data portability, and the right to opt out of targeted advertising, profiling, and the sale of personal data. We honor applicable rights. Contact us at privacy@vokabulo.com.

(c) COPPA

The App is not directed at children under 13 in the United States. We do not knowingly collect personal data from children under 13. If we learn we have collected such data, we will promptly delete it. If you believe a child under 13 has provided us with personal data, contact us at privacy@vokabulo.com.

12. Children's Privacy

12.1. The App is designed to be safe and suitable for users of all ages. We are committed to protecting the privacy of children.

12.2. We do not use advertising networks of any kind. The website analytics described in Section 10.2 sets no cookies, assigns no persistent identifier, and does not track users across websites, apps, or devices. The bot check on our newsletter signup form is used only to tell a person from an automated script, never for advertising or for profiling you across sites. This keeps the Service a safe environment for all users, including children.

12.3. Account Creation: To use certain features, an account is required. We do not knowingly collect personal data from children under 13 (or the applicable age of digital consent in your jurisdiction) without verifiable parental consent. If you are under 13, please do not create an account without a parent or guardian.

12.4. If we learn we have collected personal data from a child without appropriate consent, we will promptly delete it. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at privacy@vokabulo.com.

13. AI-Powered Features and Data Processing

13.1. The App uses third-party AI language models to power the AI Translate Service (automatic translation and context generation) and Scenes (situation-based vocabulary generation).

13.2. What we send to AI providers: Only the text content necessary to generate the requested output — e.g., a word to translate or a situation description. We do not send your username, email, user ID, or any other personal identifiers to AI providers.

13.3. Multiple providers: We use multiple AI providers and may change, add, or replace providers at any time. The choice of AI provider is an implementation detail that does not affect your privacy rights.

13.4. No training on your data: We do not permit AI providers to use your prompts or outputs to train their models. We use API-level access with data processing agreements that prohibit training use.

13.5. EU AI Act (Article 50): Content generated by AI is disclosed as AI-generated within the App interface. We comply with the transparency obligations of the EU AI Act regarding the labeling and marking of AI-generated content.

13.6. Automated Decision-Making (GDPR Art. 22): The App uses automated processing for spaced repetition scheduling (determining when to show a word for review) and AI-generated content suggestions. These automated processes do not produce legal effects or similarly significant effects on you. All AI-generated content is presented as suggestions that you review and choose to accept or discard.

14. Supervisory Authorities

If you believe we have violated your data protection rights, you have the right to lodge a complaint with the competent supervisory authority:

15. California-Specific Disclosures (CCPA/CPRA)

This section provides additional disclosures required under California law:

15.1. Right to Know: See Section 11.9(a) for categories of personal information collected.

15.2. Right to Delete: You may delete your account and personal data through Settings > User Account > Delete Account, or by emailing privacy@vokabulo.com.

15.3. Right to Correct: You may correct your personal information through the App, or by emailing privacy@vokabulo.com.

15.4. Right to Opt Out of Sale/Sharing: We do not sell or share your personal information. No opt-out mechanism is required.

15.5. Sensitive Personal Information: We collect email addresses as account identifiers. We do not use sensitive personal information for purposes other than providing the Service.

15.6. Financial Incentives: We do not offer financial incentives related to the collection of personal information.

15.7. Shine the Light (Cal. Civ. Code § 1798.83): We do not share personal information with third parties for their direct marketing purposes.

15.8. Accessibility: This Privacy Policy is provided in a format accessible on mobile devices and is designed for readability.

15.9. How to Submit Requests: Email privacy@vokabulo.com or use the in-app account management features. We will verify your identity before fulfilling requests. We will respond within 45 days, extendable by an additional 45 days for complex requests.

15.10. Authorized Agents: You may designate an authorized agent to make requests on your behalf. Agents must provide a signed written authorization or power of attorney.

16. Germany-Specific Provisions

16.1. TDDDG Compliance (§§ 19-26)

The App constitutes a "digital service" under the TDDDG. We comply with the following:

• § 25 TDDDG: We do not store information on or access information from your device beyond what is strictly necessary for the provision of the Service. The local storage mechanisms described in Section 10.1 are exempt from the consent requirement, as they are strictly necessary for providing the Service you explicitly requested. Our website analytics neither stores information on your device nor accesses information already stored there, and therefore falls outside § 25 entirely (see Section 10.2). The bot check on our newsletter signup form may store and read information on your device while it runs, but only when you use that form and only to establish that it is being submitted by a person. That is strictly necessary for a service you have explicitly requested and is exempt under § 25(2) No. 2 TDDDG.
• § 19 TDDDG: We implement appropriate technical and organizational measures to protect your personal data.
• § 20 TDDDG: We apply additional safeguards for the processing of minors' data.

16.2. BDSG Compliance

We comply with the Federal Data Protection Act (BDSG), including:

• § 26 BDSG: Employee data processing (applicable to our internal operations only);
• § 34 BDSG: Right to information;
• § 35 BDSG: Right to correction, deletion, and restriction;
• § 38 BDSG: We have appointed a Data Protection Officer. Contact details are set out in Section 2.

17. France-Specific Provisions (CNIL Compliance)

In accordance with the CNIL's recommendations on mobile applications (April 2025):

17.1. Privacy by Design: Data protection has been integrated into the App from the earliest design stages. We minimize data collection to what is strictly necessary for each feature.

17.2. Data Processing Map: We maintain a comprehensive record of all processing activities, including identification of data types, purposes, legal bases, recipients, and retention periods, as set out in this Privacy Policy.

17.3. SDK Transparency: All third-party SDKs integrated into the App and their data processing activities are disclosed in Section 3.5 and Section 9.2. No SDK processes data for purposes that are not strictly necessary for the Service without your explicit consent.

17.4. Role Clarification: Tathros GmbH is the data controller for all personal data processing. Our service providers (Clerk, Convex, AI providers, ElevenLabs, RevenueCat, Plausible, Cloudflare, Resend) act as data processors under appropriate data processing agreements. Cloudflare additionally acts as a controller in its own right when it uses insight from bot checks to improve its detection systems, as described in Section 10.2.

17.5. Post-Mortem Directives (Art. 85 Loi Informatique et Libertés): French users have the right to define directives regarding the storage, deletion, and communication of their personal data after death. You may submit such directives to privacy@vokabulo.com.

18. Italy-Specific Provisions

18.1. Processing of your personal data complies with the Codice della Privacy (D.Lgs. 196/2003, as amended by D.Lgs. 101/2018) and the GDPR.

18.2. In accordance with the Garante's guidelines on cookies and tracking tools (Provvedimento n. 229/2021), we confirm that the App does not use cookies or tracking technologies beyond the strictly necessary on-device storage described in Section 10.1, and that the Website uses no cookies, profiling tools or analytics identifiers, as described in Section 10.2. The only technology on the Website that may store or read information on your device is the bot check on the newsletter signup form. It is a technical tool, used solely for security, and under those guidelines it does not require consent.

18.3. You have the right to lodge a complaint with the Garante per la protezione dei dati personali and to seek judicial remedy before the ordinary courts.

19. Spain-Specific Provisions

19.1. Processing of your personal data complies with the LOPDGDD (Ley Orgánica 3/2018) and the GDPR.

19.2. In accordance with the LSSI-CE (Ley 34/2002), we do not send unsolicited commercial communications. Push notifications are sent only with your explicit consent and can be disabled at any time.

19.3. You benefit from digital rights under Title X of the LOPDGDD, including the right to digital security and the right to digital education.

19.4. You may file complaints with the AEPD at www.aepd.es.

20. Brazil-Specific Provisions (LGPD)

20.1. We process personal data in accordance with the LGPD (Lei nº 13.709/2018). All processing is based on the legal bases identified in Section 6.2.

20.2. Data Protection Officer (Encarregado): Wolfgang Männel, see above. The Encarregado can be contacted for any questions regarding the processing of your personal data.

20.3. International Transfer: Your data is transferred to and stored in the United States. We rely on the standard contractual clauses adopted by the ANPD under Resolução CD/ANPD nº 19/2024, or other appropriate safeguards permitted by Article 33 of the LGPD.

20.4. Data Breach Notification: In the event of a security incident that may create risk or relevant damage to data subjects, we will notify the ANPD and affected individuals within a reasonable timeframe, as required by Article 48 LGPD.

20.5. Consumer Protection: This Privacy Policy complies with the transparency requirements of the Código de Defesa do Consumidor (Lei nº 8.078/1990).

21. United Kingdom-Specific Provisions

21.1. Your data is processed in accordance with the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

21.2. PECR Compliance: In accordance with the Privacy and Electronic Communications Regulations 2003, we confirm:

• The App does not use cookies or equivalent tracking technologies beyond strictly necessary on-device storage;
• The Website sets no cookies, and reading it stores nothing on and reads nothing from your device. The only exception is the bot check on the newsletter signup form, which runs only when you use that form and is strictly necessary for a service you have requested, and is therefore exempt from the consent requirement;
• Push notifications are sent only with your explicit consent;
• We do not send direct marketing communications without consent.

21.3. International Transfers: Where your data is transferred outside the UK, we rely on UK adequacy regulations or UK International Data Transfer Agreements (IDTAs).

21.4. You may lodge a complaint with the ICO at www.ico.org.uk.

22. Apple App Store and Privacy Labels

22.1. In accordance with Apple's App Privacy requirements, we provide accurate privacy nutrition labels for the App on the App Store. These labels disclose the types of data linked to your identity and the purposes for which data is used.

22.2. Apple processes certain data in connection with App Store transactions, including your Apple ID, purchase history, and device information. Apple's data practices are governed by Apple's Privacy Policy at www.apple.com/legal/privacy.

22.3. All payments for subscriptions are processed by Apple. We do not receive or store your payment card details.

23. Changes to This Privacy Policy

23.1. We may update this Privacy Policy from time to time. Material changes will be communicated through the App and/or by email at least 30 days before they take effect.

23.2. The "Last updated" date at the top of this policy indicates when it was most recently revised.

23.3. Your continued use of the App after changes take effect constitutes your acceptance of the updated Privacy Policy. Where applicable law requires explicit consent for material changes, we will obtain such consent.

23.4. We encourage you to review this Privacy Policy periodically.

24. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Tathros GmbH, Zum Quellenpark 38, 65812 Bad Soden am Taunus, Germany

Email: privacy@vokabulo.com, Website: www.vokabulo.com

For data protection inquiries specifically: Wolfgang Männel, see above.

For Brazilian users (Encarregado): Wolfgang Männel, see above.

Appendix: Summary Table of Data Processing Activities