This policy explains what personal data VivantFlow collects when you use our apps and website, why, who we share it with, how long we keep it, and the rights you have. It covers:
- Vivant, our vocabulary app for iPhone and the web;
- Moien, our Luxembourgish pronunciation app for iPhone;
- vivantflow.com, our website.
The two apps work very differently. Vivant needs an account and stores your study data with us. Moien has no account and keeps everything on your iPhone. Sections 4 and 5 describe each app separately; everything else applies to both.
The short version
- We don't sell your data, show adverts, or use your data for advertising.
- Vivant stores your account, your words and your chat history in a database in the EU (Frankfurt).
- Moien collects nothing about you. Your recordings stay on your iPhone.
- Photos and voice recordings you send to AI features are used once and not kept.
- You can see, export, correct or delete your data at any time. Write to privacy@vivantflow.com.
1. Who we are
VivantFlow LLC, a company registered in Delaware, USA, is the data controller for the personal data described in this policy. That means we decide how and why it is used, and we are responsible for it under the EU and UK General Data Protection Regulation (GDPR) and other privacy laws.
2. How to contact us
For anything about your data, including requests to use your rights, email privacy@vivantflow.com. For general help, email support@vivantflow.com.
By post:
VivantFlow LLC
8 The Green #17742
Dover, DE 19901
United States
We have not appointed a Data Protection Officer, because the law does not require one for a business of our size and type. Requests are handled by the founder directly.
3. Our website
vivantflow.com does not use cookies, analytics or advertising trackers. It is delivered by Cloudflare, which processes your IP address and basic request details to deliver the page and protect it from attacks. If you email us, your message is stored in our Google Workspace mailbox.
4. Vivant
What we collect
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: email address, password (stored only as a secure hash), sign-up date | To create and secure your account | Contract |
| Your study data: words and phrases you save, notes, categories, review history and scores | To run the app and schedule your reviews | Contract |
| Chat messages you send in the Chat tab, and the replies | To answer you and let you return to your conversation | Contract |
| Photos you take or choose in Scan | To read the text in the photo. Not kept (see below) | Contract |
| Voice recordings when you tap Say it | To check your pronunciation of that word. Not kept (see below) | Contract |
| Scan records: your email, time, file size, which AI model was used, and any error | To keep Scan working, find faults and control costs | Legitimate interests |
| Usage events: which features you use and when (web app) | To understand which features help learners and improve the app | Legitimate interests |
| Error reports: crash details, device and system type, app version | To find and fix bugs | Legitimate interests |
| Feedback you send us from the app | To answer it and improve the app | Legitimate interests |
An email address and password are needed to create an account; without them you can't use Vivant. Everything else depends on which features you use.
Photos and recordings are not kept
A photo you scan is sent to an AI service only to read the text in it. The app's copy is deleted as soon as the text has been read, and the photo is never stored on our servers. We keep only the words you choose to save.
When you tap Say it, the app uses your microphone only while it is recording, which you can see on screen. The recording is sent to Microsoft's speech service to score your pronunciation, then deleted. It is never stored on our servers. Your voice is not used to identify you. The app asks for microphone and camera access the first time you need them, and you can turn either off at any time in your device settings.
The app asks before it first sends a photo, message or recording to an AI service.
Analytics
Usage events go to PostHog, on servers in the EU. We record only specific actions we choose, such as finishing a review session. We don't record your screen, your keystrokes or what you type, and analytics are never used for advertising. Our legitimate interest is knowing which parts of Vivant actually help people learn. You can object at any time by emailing privacy@vivantflow.com, and we will stop.
Who receives Vivant data
These companies process data for us, under contracts that require them to protect it and use it only to provide their service to us:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt) |
| Vercel | Hosts the web app and our server functions | USA and EU |
| Anthropic | AI: reading scanned photos, chat replies, word notes | USA |
| Google (Gemini) | Reading scanned photos, as a backup to Anthropic | USA |
| Google Cloud | Turning words into speech (receives text only) | USA |
| Microsoft Azure Speech | Scoring Say it recordings | EU or USA |
| PostHog | Usage analytics | EU |
| Sentry | Error and crash reports | USA |
The AI providers use what we send them through their business APIs, which do not train their models on it.
5. Moien
Moien has no account, no login, no adverts, no analytics and no tracking. We don't collect any personal data through Moien.
What stays on your iPhone
Your recordings, the dates you practised, and any notes or ratings you add are stored only on your iPhone, inside the app. Recordings are left out of iCloud backups. To keep a copy or move to a new phone, use Settings → Export progress, which creates one file that you save wherever you choose. Deleting the app, or using Delete all recordings, removes them. We have no copy.
Moien uses the microphone only while you are recording yourself. You can turn microphone access off at any time in iPhone Settings → Privacy & Security → Microphone.
"What did it hear?" (optional)
If you tap What did it hear?, the app first asks your permission. If you agree, that one recording is sent straight from your iPhone to LuxASR, a speech-recognition service run by the University of Luxembourg, which sends back a transcript. Nothing else goes with it: no name, no account, not even the sentence you were practising. The recording never reaches us.
The University of Luxembourg says on its published notice that audio is processed in Luxembourg and is neither stored nor used for training; see luxasr.uni.lu for its terms. You can switch this feature off at any time in the app's Settings, which also withdraws your consent. If it's off, nothing is ever sent. The legal basis is your consent.
Sharing
If you tap Share, your iPhone's share sheet sends your own recording and the text you were practising to the person or app you choose. Moien never shares anything unless you tap Share.
Native recordings
The native Luxembourgish recordings come from the Lëtzebuerger Online Dictionnaire (LOD.lu), Zenter fir d'Lëtzebuerger Sprooch. They are built into the app, so playing them sends nothing over the internet.
6. Apple, the App Store and TestFlight
Apple distributes our iPhone apps and is responsible for the data it collects when you download them. If you've allowed your iPhone to share analytics with app developers, Apple passes us anonymous crash reports. If you test a beta through TestFlight and send feedback, Apple passes us that feedback and any screenshot you attach.
7. How long we keep data
- Vivant account, study data, chat messages and scan records: for as long as your account exists. When you delete your account in the app, they are deleted straight away, and removed from our database provider's backups within 30 days.
- Feedback: when you delete your account, feedback you sent is kept but your account link is removed.
- Photos and recordings sent to AI features: not kept by us at all.
- Error reports: up to 90 days.
- Analytics events: up to 12 months.
- Emails to us: as long as needed to deal with your request and any follow-up.
- Moien: we hold nothing. What's on your iPhone stays until you delete it.
8. Transfers outside the EU
VivantFlow LLC is a US company, and some of our providers are in the USA. Where personal data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is wrong;
- delete your data (in Vivant you can delete your account yourself in the app);
- take your data with you in a portable format;
- restrict how we use your data;
- object to anything we do on the basis of legitimate interests, including analytics;
- withdraw consent at any time, where we rely on it. This doesn't affect what was done before.
Email privacy@vivantflow.com to use any of these. We will reply within one month. We may ask you to confirm your identity first, usually by writing from the email address on your account.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Pronunciation scores and AI replies are learning aids only.
Complaints
If you're unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to a data protection authority in the EU country where you live or work, for example the CNPD in Luxembourg (cnpd.public.lu) or the CNIL in France (cnil.fr). A full list is on the European Data Protection Board's website (edpb.europa.eu).
10. Security
- All data is encrypted in transit (HTTPS/TLS).
- Passwords are stored only as secure hashes.
- Database rules make sure each user can reach only their own data.
- Access to production systems is limited to the people who run the service.
If a breach puts your personal data at risk, we will tell you and the relevant authority as the law requires.
11. Children
Vivant and Moien are made for adults. Vivant is not for anyone under 18, and we don't knowingly collect personal data from children. If you believe a child has given us personal data, email privacy@vivantflow.com and we will delete it.
12. Changes to this policy
If we change this policy, we'll post the new version here with a new date. If a change significantly affects how we use your data, we'll tell Vivant users by email or in the app before it takes effect.