Privacy Policy

Introduction

Litani (“we”, “us”) operates litani.ai. This policy explains what data we collect, how we use it, and your rights. We’ve written it in plain language because you shouldn’t need a law degree to understand how your data is handled.

Data Controller

Litani is the data controller for the personal data we collect through the service. We’re based in the United Kingdom, which means our handling of your personal data is regulated by the UK GDPR and the Data Protection Act 2018.

The UK Information Commissioner’s Office (ICO) is the supervisory authority responsible for data protection in the UK. If you’re unhappy with how we’ve handled your data and we haven’t been able to resolve it with you directly, you have the right to lodge a complaint with the ICO at ico.org.uk.

What We Collect

Account information

When you sign up, we receive your email address, name, and profile picture through our authentication provider (Clerk). This is used to identify your account and nothing else.

Learning content

Everything you create in Litani belongs to your learning journey: phrases you capture, translations, lists you organise, practice history, and scores. This is the core of what makes the app useful to you.

Voice recordings

When you use voice capture, your audio is sent to our transcription service to convert speech to text. We process the audio for transcription and do not store recordings long-term.

Payment information

Payments are handled entirely by Stripe. We never see or store your card number, CVV, or billing details. Stripe handles all of that directly, and they are PCI-DSS compliant.

Usage data

We collect basic information about how you use the app, such as which features you use and your session activity. This helps us understand what’s working and what needs improvement.

How We Use Your Data

• To provide the service — your phrases, translations, and practice history power the core learning experience.
• To personalise your learning — Litani builds a learning profile from your practice patterns, the phrases you capture, and how you perform. This is what makes practice feel relevant to your life, not generic.
• To process payments — if you subscribe to a paid plan, we use Stripe to handle billing and subscription management.
• To send service updates — important things like changes to your account or this policy. We don’t send marketing emails.

Lawful Basis for Processing

Under the UK and EU GDPR, every kind of personal data processing has to have a lawful basis. Here’s the basis we rely on for each type of processing we do:

• Contract — processing your account information, learning content, and payment data is necessary to provide the service you signed up for.
• Legitimate interest — improving the app, keeping it secure, and preventing fraud and abuse.
• Consent — voice recordings (which you provide each time you tap the record button) and any optional features you choose to use.
• Legal obligation — keeping tax and payment records, and responding to lawful requests from authorities.

Third-Party Services

We share data only with the services we need to run Litani. Here is every third party that receives your data, and why:

• Clerk (authentication) — receives your email, name, and profile picture to manage sign-in.
• Stripe (payments) — processes your payment details. They are PCI compliant and we never handle your card data directly.
• Supabase (database hosting) — stores your learning data securely.
• OpenAI (AI features) — receives text for translation, segmentation, and lesson generation. Per OpenAI’s API data usage policy, data sent via their API is not used to train their models.
• Groq (speech-to-text) — receives your voice recordings to transcribe what you say into text. Audio is processed for transcription only and is not used to train their models.
• Azure Speech Services (text-to-speech) — receives phrase text to generate audio pronunciations.
• Upstash (rate limiting) — receives your account ID so we can count requests and stop abuse. No names, no emails, and nothing you have written.
• PostHog (product analytics, EU-hosted) — receives usage events, and session recordings if you accept analytics cookies. See Analytics below.
• Sentry (error monitoring, EU-hosted) — receives error reports when something breaks, tagged with your account ID. Never your email, and never your learning content.
• Resend (email delivery) — receives your email address and the message, to deliver the service emails described below.
• Vercel (hosting) — runs the app and serves every request, so it processes the technical data every website handles, such as your IP address.

We do not sell your data to anyone. We do not share it with advertisers. These are the only services that receive your information, and each one is necessary for Litani to work.

International Data Transfers

Some of the processors we rely on are based outside the UK and EU, which means your personal data may be transferred internationally when you use Litani. Specifically:

• OpenAI, Groq, Stripe, Clerk, Resend, Upstash and Vercel are US-based providers.
• Supabase stores your database in an EU region, and Microsoft (Azure) generates the spoken audio from a Western Europe data centre. PostHog and Sentry are EU-hosted.

Where data is transferred outside the UK or EU, we rely on Standard Contractual Clauses (SCCs) approved by the UK ICO and the European Commission to make sure your data continues to be protected to the same standard. These clauses are part of the contracts we have in place with each provider.

Cookies

We use essential cookies required for authentication and payment processing, plus optional analytics cookies from PostHog (hosted in the EU) that only activate if you accept them on the cookie banner. We do not use any advertising cookies. For details, see our Cookie Policy.

Analytics & Session Recordings

With your consent, we use PostHog (hosted in the EU) to understand how Litani is used and to improve it. This includes product analytics events (for example, that a capture was completed) and session recordings that reconstruct how you moved through the app.

• Your voice is never recorded by analytics. Recordings capture the page, not your microphone.
• Every word on the screen is masked. Anything you type, and every phrase, transcript and conversation, appears as blank boxes in a recording. We see the shape of the page and where you clicked, never what it said.
• Recordings and browser analytics only run if you accept. Choose Reject on the cookie banner and neither one activates. Litani works exactly the same either way.

Separately from the banner, our servers log a short list of product events against your account ID (a capture finished, a session completed, a subscription changed), with no content and nothing from your browser. We rely on legitimate interest for these. Email privacy@litani.ai to see them or to object.

Data Storage & Retention

Your data is stored for as long as your account is active. If you decide to delete your account, all of your data is permanently removed from our systems. We don’t sell your data. Ever.

Specific retention periods for different kinds of data:

• Account information — retained while your account is active. Deleted within 30 days of account deletion.
• Learning content (phrases, lists, practice history) — retained while your account is active. Deleted within 30 days of account deletion.
• Voice recordings — audio is processed in real-time for transcription and deleted within 24 hours. The transcripts (the text version) are kept as part of your learning content.
• Payment records — retained for 7 years to comply with UK tax law (HMRC requirement).
• Service logs and error reports — kept no longer than 90 days for security monitoring and debugging.
• Backups — our database provider takes rolling backups and overwrites them on its own schedule. Nothing from a deleted account survives beyond 35 days.

Security

We take appropriate technical and organisational measures to protect your data from unauthorised access, loss, or misuse. In practical terms, that means:

• Data is encrypted in transit (HTTPS/TLS) and at rest in our database.
• Access to production systems is restricted, logged, and protected by strong authentication.
• We carry out regular security reviews of our code, infrastructure, and third-party providers.
• All vendors we use are reputable and SOC 2 or ISO 27001 compliant where applicable.

We’ll be honest with you: no system on the internet is 100% secure. What we can promise is that we follow industry best practices and treat the security of your data as a priority.

In the unlikely event of a data breach affecting your personal data, we’ll notify you and the ICO within 72 hours where required to do so by law.

Marketing Communications

We don’t run a marketing list and we don’t send campaigns. The emails you get from us are the ones the service needs: sign-in codes, billing receipts, a reply when you write to support, and important changes to your account or this policy.

There are two exceptions, and both are things you asked for. If you put your address in the blog form, or join the waitlist on our page for tutors, you get one confirmation email for that. Nothing follows it today.

If we ever start sending campaigns, you will be opted out by default and we will ask you to opt in first, and every one of those emails will carry an unsubscribe link. Until then, to come off either list above, email privacy@litani.ai and we will take you off it.

Your Rights

Under GDPR and similar data protection laws, you have the right to:

• Access your data — see what information we hold about you.
• Correct inaccurate data — fix anything that’s wrong.
• Delete your account — remove all your data permanently. You can do this yourself in Settings.
• Export your data — request a copy of everything we have. Email privacy@litani.ai and you will have it within 30 days.
• Object to processing — if you believe we’re processing your data in a way you disagree with.

To exercise any of these rights, use the account settings in the app or email privacy@litani.ai.

Automated Decision-Making

Litani uses AI to generate translations, suggestions, and personalised practice content based on what you capture and how you learn. This is how the app tailors itself to your life rather than handing you generic textbook material.

However, AI is not used to make decisions that have a legal or similarly significant effect on you — things like approval or rejection of your account, different pricing for different users, or denial of service. You always have human-reviewable control over your account, and any decision that materially affects you will involve a human.

How to Make a Complaint

If you’re unhappy with how we’ve handled your data, please get in touch with us first at privacy@litani.ai. We’ll do our best to understand the problem and put it right.

If you’re not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO). You can contact the ICO at ico.org.uk or via their helpline on 0303 123 1113.

Children

Litani is not designed for children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us and we will remove it.

Changes to This Policy

We may update this policy from time to time. If we make significant changes, we will notify you by email or through the app. Minor wording changes won’t trigger a notification, but the “last updated” date at the top will always reflect the latest version.

Contact

If you have questions about this policy or how we handle your data, email us at privacy@litani.ai.