Privacy Policy

Last updated: January 2026

Hello Nabu ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our AI-based language learning service accessible at hellonabu.com and via our mobile applications (iOS and Android).

1. Data Controller Information

Hello Nabu SAS

25 rue de Ponthieu, 75008 Paris, France

Registered with RCS Paris: 930 062 849

Contact: contact@hellonabu.com

Data Protection Contact: dpo@hellonabu.com

2. Personal Data We Collect

We collect the following categories of personal data:

User Account Data:

  • Name and username

  • Email address

  • Date of birth (for age verification)

  • Authentication credentials managed via Firebase (passwords are never stored directly by Hello Nabu)

Payment Data:

  • Payments processed exclusively via Stripe (web) or Apple App Store / Google Play Store (mobile). We do not store or directly access your credit card or banking information.

Technical and Usage Data (Web):

  • IP address, browser type, device type (collected by Google Analytics, only after your consent)

  • User interactions, completed exercises, vocabulary learned, learning history

  • Limited user-generated text inputs and personal notes

Mobile Application Data:

  • Device identifiers and push notification tokens (for delivering notifications via Expo Push Notifications)

  • Crash reports and diagnostic data (collected via Firebase Crashlytics, including device model, OS version, and stack traces)

  • App usage analytics and learning events (collected via Firebase Analytics)

  • Audio recordings from pronunciation exercises (processed in real-time and not stored permanently on our servers)

  • Locally cached content and offline data stored on your device

3. Purpose of Data Collection and Processing

  • Deliver and personalize the language-learning services

  • Improve our service, identify areas for improvement, and optimize AI models

  • Send transactional communications (account notifications, password resets)

  • Send marketing communications such as newsletters and promotional offers, where you have given your explicit consent

  • Monitor application stability and diagnose crashes (via Firebase Crashlytics)

  • Ensure compliance with legal obligations and maintain security

4. Legal Basis for Processing (GDPR)

  • Performance of contract: to provide access to Hello Nabu and its features

  • Legitimate interests: service improvement, security, and fraud prevention

  • Your explicit consent: marketing communications, newsletter, cookie preferences, and push notifications

  • Legal obligation: tax records, regulatory compliance, and response to lawful requests

5. Third-Party Service Providers and Data Sharing

We use trusted third-party providers who process your data on our behalf, including:

  • Stripe: Payment processing (web)

  • Apple App Store / Google Play Store: Payment processing (mobile)

  • Firebase Authentication: User authentication

  • Firebase Crashlytics: Crash reporting and diagnostics

  • Firebase Analytics: App usage analytics

  • Azure: Cloud hosting and storage (France Central region)

  • Azure OpenAI: AI-powered language learning features

  • Google Analytics: Website analytics (web only)

  • Expo: Push notification delivery (mobile)

Data is shared only as necessary under strict confidentiality and security obligations. Each provider acts as a data processor under a Data Processing Agreement (DPA) in compliance with GDPR.

6. International Data Transfers

We primarily host data within the EU region (Azure France Central). However, some data may be processed outside the EU by providers such as Firebase (Google), Expo, or Apple/Google for payment processing.

We ensure compliance using appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission and the EU-US Data Privacy Framework where applicable.

7. Cookies and Similar Technologies

We use a small number of cookies and similar storage. Essential ones run the site; analytics and marketing ones only run after you agree in the cookie banner.

Cookies used on our website include:

  • Essential cookies (sign-in, language, theme and your cookie choice)

  • Analytics cookies (Google Analytics, Firebase Analytics) to see what gets used

  • Marketing cookies (Meta Pixel, Google Tag Manager) to see which ads bring people here

What is stored

You can withdraw your cookie consent at any time via your browser settings or the cookie banner.

You can manage your cookie preferences at any time by clicking the button below:

Cookie Settings

Our mobile apps do not use browser cookies. They ask once, on first launch, before collecting anonymous usage statistics through Firebase Analytics, and you can switch this off any time in Settings. They also use device storage (AsyncStorage) for preferences and cached content, and push notification tokens for delivering notifications, which you control through your device settings and the notification preferences in the app.

The mobile apps also send anonymous crash reports (Firebase Crashlytics) so we can fix bugs. These contain no account identifiers and cannot be used for advertising.

8. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

  • Right of access: obtain a copy of your personal data

  • Right to rectification: correct inaccurate or incomplete data

  • Right to erasure: request deletion of your data

  • Right to restrict processing: limit how we use your data

  • Right to data portability: receive your data in a structured, machine-readable format

  • Right to object: object to processing based on legitimate interests, including profiling

  • Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal

  • Right to lodge a complaint: file a complaint with your local supervisory authority (see Section 16)

To exercise any of these rights, contact us at dpo@hellonabu.com or contact@hellonabu.com. You can also export or delete your data directly from your account settings. We will respond within one month of receiving your request.

In the mobile app, you can export your data or request account deletion from Settings > Your Data.

9. Automated Decision-Making and Profiling

Hello Nabu uses AI and automated processing to personalize your learning experience. This includes:

  • Assessing your language proficiency level (CEFR) based on your exercise performance

  • Recommending lessons, vocabulary, and exercises tailored to your level and goals

  • Adapting content difficulty based on your learning progress

  • Generating AI-powered tutor responses and corrections

These automated processes are used solely to improve your educational experience and do not produce legal effects or similarly significant effects on you. You have the right to request human review of any automated assessment by contacting us at contact@hellonabu.com.

10. Data Retention

We retain your data for as long as necessary to fulfill the purposes described in this policy:

  • Active account data: retained for the duration of your account

  • After account deletion: personal data is deleted within 30 days, except where retention is required by law

  • Transaction and billing records: retained for up to 10 years as required by French tax law (Article L123-22 of the Code de commerce)

  • Crash reports and diagnostic data: retained for 90 days

  • Marketing consent records: retained for 3 years from last interaction, as recommended by the CNIL

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (CNIL) within 72 hours of becoming aware of the breach, as required by GDPR Article 33.

If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by GDPR Article 34, using the contact information associated with your account.

12. Children's Privacy

Hello Nabu is intended for users aged 16 and over. Users under 16 must obtain explicit parental or guardian consent before creating an account.

We require users to confirm their age at account creation.

If we discover that we have collected personal data from a child under 16 without appropriate parental consent, we will delete such data promptly.

If you believe a child has provided us with personal data without consent, please notify us at contact@hellonabu.com.

13. Security Measures

  • SSL/TLS encryption for all data in transit

  • Secure authentication via Firebase

  • Restricted internal data access on a need-to-know basis

  • Regular security monitoring and vulnerability assessments

  • Screenshot protection on sensitive screens in the mobile app

No online service can guarantee absolute security. If you suspect any security issue, please inform us immediately at contact@hellonabu.com.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements.

For material changes that affect how we process your personal data, we will notify you by email or through a prominent notice in the application and, where required by law, seek your renewed consent before applying the changes.

We encourage you to review this policy regularly. The date at the top indicates when it was last updated.

15. Contact Us

For privacy-related queries or to exercise your data protection rights:

Hello Nabu

25 rue de Ponthieu, 75008 Paris, France

contact@hellonabu.com

Data Protection Contact: dpo@hellonabu.com

16. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority. For users in France, this is:

Commission Nationale de l'Informatique et des Libertés (CNIL)

3 Place de Fontenoy, 75007 Paris, France

https://www.cnil.fr