Privacy Policy

Last updated: 11 July 2026

Introduction

Litani (“we”, “us”) operates litani.ai. This policy explains what data we collect, how we use it, and your rights. We’ve written it in plain language because you shouldn’t need a law degree to understand how your data is handled.

Data Controller

Litani is the data controller for the personal data we collect through the service. We’re based in the United Kingdom, which means our handling of your personal data is regulated by the UK GDPR and the Data Protection Act 2018.

The UK Information Commissioner’s Office (ICO) is the supervisory authority responsible for data protection in the UK. If you’re unhappy with how we’ve handled your data and we haven’t been able to resolve it with you directly, you have the right to lodge a complaint with the ICO at ico.org.uk.

What We Collect

Account information

When you sign up, we receive your email address, name, and profile picture through our authentication provider (Clerk). This is used to identify your account and nothing else.

Learning content

Everything you create in Litani belongs to your learning journey: phrases you capture, translations, lists you organise, practice history, and scores. This is the core of what makes the app useful to you.

Voice recordings

When you use voice capture, your audio is sent to our transcription service to convert speech to text. We process the audio for transcription and do not store recordings long-term.

Payment information

Payments are handled entirely by Stripe. We never see or store your card number, CVV, or billing details. Stripe handles all of that directly, and they are PCI-DSS compliant.

Usage data

We collect basic information about how you use the app, such as which features you use and your session activity. This helps us understand what’s working and what needs improvement.

How We Use Your Data

To provide the service — your phrases, translations, and practice history power the core learning experience.
To personalise your learning — Litani builds a learning profile from your practice patterns, the phrases you capture, and how you perform. This is what makes practice feel relevant to your life, not generic.
To process payments — if you subscribe to a paid plan, we use Stripe to handle billing and subscription management.
To send service updates — important things like changes to your account or this policy. We don’t send marketing emails.

Lawful Basis for Processing

Under the UK and EU GDPR, every kind of personal data processing has to have a lawful basis. Here’s the basis we rely on for each type of processing we do:

Contract — processing your account information, learning content, and payment data is necessary to provide the service you signed up for.
Legitimate interest — improving the app, keeping it secure, and preventing fraud and abuse.
Consent — voice recordings (which you provide each time you tap the record button) and any optional features you choose to use.
Legal obligation — keeping tax and payment records, and responding to lawful requests from authorities.

Third-Party Services

We share data only with the services we need to run Litani. Here is every third party that receives your data, and why:

Clerk (authentication) — receives your email, name, and profile picture to manage sign-in.
Stripe (payments) — processes your payment details. They are PCI compliant and we never handle your card data directly.
Supabase (database hosting) — stores your learning data securely.
OpenAI (AI features) — receives text for translation, segmentation, and lesson generation. Per OpenAI’s API data usage policy, data sent via their API is not used to train their models.
Groq (speech-to-text) — receives your voice recordings to transcribe what you say into text. Audio is processed for transcription only and is not used to train their models.
Azure Speech Services (text-to-speech) — receives phrase text to generate audio pronunciations.
Upstash (rate limiting) — processes anonymous request counts only. No personal data is shared.

We do not sell your data to anyone. We do not share it with advertisers. These are the only services that receive your information, and each one is necessary for Litani to work.

International Data Transfers

Some of the processors we rely on are based outside the UK and EU, which means your personal data may be transferred internationally when you use Litani. Specifically:

OpenAI, Groq, Stripe, Microsoft (Azure), and Clerk are US-based providers.
Supabase hosts your database in an EU region.

Where data is transferred outside the UK or EU, we rely on Standard Contractual Clauses (SCCs) approved by the UK ICO and the European Commission to make sure your data continues to be protected to the same standard. These clauses are part of the contracts we have in place with each provider.

Cookies

We use essential cookies required for authentication and payment processing, plus optional analytics cookies from PostHog (hosted in the EU) that only activate if you accept them on the cookie banner. We do not use any advertising cookies. For details, see our Cookie Policy.

Analytics & Session Recordings

With your consent, we use PostHog (hosted in the EU) to understand how Litani is used and to improve it. This includes product analytics events (for example, that a capture was completed) and session recordings that reconstruct how you moved through the app.

Your voice is never recorded by analytics. Recordings capture the page, not your microphone.
Your words are masked. Anything you type, and the phrases, transcripts, and conversations you create, appear as blank boxes in recordings.
It only runs if you accept. Choose Reject on the cookie banner and none of this activates. Litani works exactly the same either way.

Data Storage & Retention

Your data is stored for as long as your account is active. If you decide to delete your account, all of your data is permanently removed from our systems. We don’t sell your data. Ever.

Specific retention periods for different kinds of data:

Account information — retained while your account is active. Deleted within 30 days of account deletion.
Learning content (phrases, lists, practice history) — retained while your account is active. Deleted within 30 days of account deletion.
Voice recordings — audio is processed in real-time for transcription and deleted within 24 hours. The transcripts (the text version) are kept as part of your learning content.
Payment records — retained for 7 years to comply with UK tax law (HMRC requirement).
Service logs and security records — retained for 90 days for security monitoring and debugging.
Backups — backups containing your data are rotated and overwritten within 35 days.

Security

We take appropriate technical and organisational measures to protect your data from unauthorised access, loss, or misuse. In practical terms, that means:

Data is encrypted in transit (HTTPS/TLS) and at rest in our database.
Access to production systems is restricted, logged, and protected by strong authentication.
We carry out regular security reviews of our code, infrastructure, and third-party providers.
All vendors we use are reputable and SOC 2 or ISO 27001 compliant where applicable.

We’ll be honest with you: no system on the internet is 100% secure. What we can promise is that we follow industry best practices and treat the security of your data as a priority.

In the unlikely event of a data breach affecting your personal data, we’ll notify you and the ICO within 72 hours where required to do so by law.

Marketing Communications

We currently don’t send marketing emails. The only emails you’ll receive from us are essential service emails — things like password resets, billing receipts, and important changes to your account or this policy.

If we ever decide to send marketing emails (product updates, newsletters, that kind of thing), you’ll be opted out by default and we’ll ask you to opt in before sending anything. You can always unsubscribe from any non-essential email by using the unsubscribe link in the email or by emailing privacy@litani.ai.

Your Rights

Under GDPR and similar data protection laws, you have the right to:

Access your data — see what information we hold about you.
Correct inaccurate data — fix anything that’s wrong.
Delete your account — remove all your data permanently. You can do this yourself in Settings.
Export your data — request a copy of everything we have. Email privacy@litani.ai.
Object to processing — if you believe we’re processing your data in a way you disagree with.

To exercise any of these rights, use the account settings in the app or email privacy@litani.ai.

Automated Decision-Making

Litani uses AI to generate translations, suggestions, and personalised practice content based on what you capture and how you learn. This is how the app tailors itself to your life rather than handing you generic textbook material.

However, AI is not used to make decisions that have a legal or similarly significant effect on you — things like approval or rejection of your account, different pricing for different users, or denial of service. You always have human-reviewable control over your account, and any decision that materially affects you will involve a human.

How to Make a Complaint

If you’re unhappy with how we’ve handled your data, please get in touch with us first at privacy@litani.ai. We’ll do our best to understand the problem and put it right.

If you’re not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO). You can contact the ICO at ico.org.uk or via their helpline on 0303 123 1113.

Children

Litani is not designed for children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us and we will remove it.

Changes to This Policy

We may update this policy from time to time. If we make significant changes, we will notify you by email or through the app. Minor wording changes won’t trigger a notification, but the “last updated” date at the top will always reflect the latest version.

Contact

If you have questions about this policy or how we handle your data, email us at privacy@litani.ai.