Privacy Policy

finnly (“finnly”, “we”, “us” or “our”) is a Finnish-language learning application operated by Havilah Works Oy. This Privacy Policy applies to the finnly mobile application (the “App”) and the website at getfinnly.com (the “Site”), together the “Services”.

We are the data controller for the personal data described below. If you do not agree with this Policy, please do not use the Services.

Summary

• The App does not require you to create an account or provide your name, email address or phone number to learn with it.
• We use a small number of trusted third-party providers to run subscriptions, understand how the App is used, deliver content and provide AI feedback on your writing and speaking.
• We do not sell your personal data, and we do not use it for third-party advertising.

Data we collect

Information you provide

• Learning content you submit. When you use the writing and speaking practice features, the text you write and the voice recordings you make are sent to our backend so an AI model can grade them and return feedback. Voice recordings are processed to generate that feedback and are not used to identify you.
• Onboarding choices. Your selected interface language, learning goal, self-assessed level and target exam date, which are stored to personalise your study plan.
• Support communications. If you contact us by email, we receive the information you choose to include in your message.

Information collected automatically

• A pseudonymous app user identifier generated by our subscription provider to associate your purchases and entitlements with your installation of the App. It is not linked to your real-world identity.
• Subscription and purchase status (for example, whether you have an active trial or subscription), so we can unlock paid features.
• Usage and product-analytics events describing how you interact with the App (for example, which exercises you open or complete), together with general device and app information such as device type, operating system version and app language.
• Push notification token, if you allow notifications, so we can send study reminders. You can disable notifications at any time in your device settings.
• Website analytics. On the Site we use privacy-respecting analytics to measure aggregate traffic. We do not use this data to build advertising profiles.

The App does not collect your precise location, contacts, photos or other device data beyond what is described above. Microphone access is used solely to record the speaking exercises you choose to start.

How we use your data

• To provide the Services, including saving your progress and personalising your plan.
• To grade your writing and speaking submissions and return AI-generated feedback.
• To process and manage subscriptions, trials and restores.
• To understand how the Services are used so we can fix problems and improve them.
• To send study reminders, where you have enabled notifications.
• To respond to your support requests and comply with our legal obligations.

Legal bases (EEA/UK users)

Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases: performance of a contract (to deliver the features you request, including AI feedback and subscriptions); our legitimate interests (to secure, maintain and improve the Services through analytics, balanced against your rights);your consent (for push notifications and microphone access, which you can withdraw at any time); and compliance with legal obligations.

Third-party providers

We share limited personal data with the following processors, who act on our behalf and only for the purposes described. Each maintains its own privacy practices.

• RevenueCat — manages subscriptions and entitlements. Receives the pseudonymous app user identifier and purchase information.
• Amplitude — product analytics. Receives pseudonymous usage events and basic device information.
• Apple App Store and Google Play — process subscription payments. Your payment details are handled by the relevant app store under its own privacy policy; we do not receive your full payment card information.
• Expo (Expo Application Services) — delivers over-the-air app updates and push notifications on our behalf.
• Cloudflare— hosts and delivers the App’s audio content.
• Our AI feedback backend — processes the writing text and voice recordings you submit in order to generate grades and feedback.
• Vercel — hosts the Site and provides aggregate website analytics.

We do not sell your personal data and do not share it with third parties for their own marketing.

International transfers

Some of our providers are located outside the European Economic Area. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an equivalent recognised mechanism.

Data retention

We keep personal data only for as long as necessary for the purposes described above. Subscription records are retained for as long as needed to manage your entitlements and meet legal and accounting obligations. Analytics events are retained in aggregated or pseudonymous form. Writing and speaking submissions are processed to return your feedback and are not retained longer than necessary to provide and improve that feature.

Your rights

Depending on your location, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with your local data protection authority; in Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto).

Children

The Services are not directed to children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can delete it.

Security

We use reasonable technical and organisational measures, including encryption in transit, to protect personal data. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above, and material changes will be communicated through the Services where appropriate.

Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us at hello@havilahworks.com.