Legal
Last updated August 16, 2026
This Privacy Notice for FLUENSEA (Pty) Ltd (doing business as Fluensea) (“we”, “us”, or “our”), describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you:
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. Contact us at team@fluensea.co.
What personal information do we process? Your account details, your billing and subscription status, the learning content you create or import, your progress and proficiency data, and — where a feature involves speaking — recordings of your voice. Learn more about the information we collect.
Do we process any sensitive personal information? We do not ask for, and do not want, special-category information such as health, religion, political opinions, or race. We do process recordings of your voice, because speaking is how the Services work — but we never use them to identify you, and we do not create voiceprints. Learn more about voice and audio.
Do we collect any information from third parties? Yes, in two narrow cases: if you sign in with Google or X we receive basic profile information from them, and our payment provider Polar tells us your subscription status, billing country, and the last four digits of your card. We do not buy personal information, and we do not receive it from data brokers or advertising networks. Learn more about information from third parties.
How do we process your information? To provide the Services you signed up for, to run the AI features, to take payment, to keep the platform secure, to improve it, and to comply with law. Learn more about how we process your information.
In what situations and with which parties do we share personal information? With the service providers who run our infrastructure, payments, and AI features — each named individually — and in a small number of other situations. Learn more about when and with whom we share your personal information.
Do you use my content to train AI models? No. We do not train models on your recordings, chats, transcripts, or imported texts. Learn more about AI and machine learning.
Do you sell my information? No. We do not sell personal information and we do not share it for cross-context behavioural advertising. Learn more about US state privacy rights.
How do we keep your information safe? We have organisational and technical measures in place, and we will tell you and the regulator if a breach puts you at risk. However, no electronic transmission over the internet can be guaranteed 100% secure. Learn more about how we keep your information safe.
What are your rights? Depending on where you are located geographically, you may have certain rights regarding your personal information, including access, correction, deletion, portability, and objection. Learn more about your privacy rights.
How do you exercise your rights? Email us at team@fluensea.co, or change and delete your own data in the app under Settings → Account. Learn more about reviewing, updating, or deleting your data.
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Account information. Your name or display name, email address, password (stored only as a salted hash — we never see or store it in readable form), your profile picture if you set one, the languages you are learning, and the interests you pick during onboarding so we can choose content for you.
Learning content and activity. Because this is a learning product, most of what we hold is the record of your learning: the words and sentences you save, your flashcards and review history, your progress, streaks, goals, and proficiency estimates, the results of your placement test, the texts and articles you import into the reader, and the messages you type to our AI chat tutor and conversation partner.
Voice and audio. Several features ask you to speak — shadowing, pronunciation comparison, spoken conversation practice, and community submissions. When you do, your microphone audio is recorded in your browser. For most exercises it stays in your browser and is discarded when you leave the page. Where an exercise needs a transcript, the recording is sent to our speech-to-text provider, transcribed, and not retained by us. If you choose to post a submission to the community, that recording is uploaded and stored, and is publicly accessible — see section 9. We do not use your voice to identify you, we do not create voiceprints, and we do not use your recordings to build or train voice models.
Special-category information. We do not ask for information about your health, race, ethnicity, religion, political opinions, trade-union membership, sex life, sexual orientation, or genetic or biometric identifiers, and you should not put such information into free-text or spoken features. If you do, you are asking us to process it and we will handle it under this notice, but we do not seek it out and we do not use it to make decisions about you.
Payment information. Polar is the merchant of record for every purchase. You enter your card details with Polar, not with us. We never receive or store your full card number. What we receive back from Polar is your subscription plan and status, the currency and amount, your billing country (needed for tax), and the card brand and last four digits so you can recognise your own payment method.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.
In Short: Some information — such as your IP address and browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services, including your IP address, browser and device characteristics, operating system, language preferences, referring URLs, and device name.
Approximate location. We derive an approximate location — country, and sometimes region or city — from your IP address, to set sensible language and content defaults and to detect suspicious sign-ins. We do not collect precise or GPS location and we never ask your device for it.
Log and usage data. Our servers automatically collect log data when you access or use our Services, including IP address, device information, browser type, error diagnostics, and information about your activity in the Services (features opened, exercises completed, searches, and date/time stamps). Product analytics are covered separately in section 6: before you answer the cookie banner they run anonymously and store nothing on your device, and they are only linked to your account if you agree.
We receive a limited amount of information about you from other companies:
We do not buy personal information, we do not obtain it from data brokers, and we do not receive it from advertising networks or social media tracking pixels.
Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We process your personal information for the following purposes:
We do not use your personal information for advertising, we do not profile you for advertising purposes, and we do not use your content to train AI models.
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.
If you are located in the EU or UK, the GDPR and UK GDPR require us to explain the valid legal bases we rely on. These are:
If you are located in South Africa, POPIA permits processing where it is necessary to perform our contract with you, to comply with a legal obligation, to pursue our legitimate interests or yours, or where you have consented. Where you are under 18, we rely on the permission of your parent or guardian as the consent of a competent person — see section 12.
If you are located in Canada, we may process your information if you have given us express or implied consent. You may withdraw consent at any time. In some exceptional cases we may be legally permitted to process your information without consent, as permitted by applicable law.
In Short: We share your information with the service providers who help us run Fluensea, and in a small number of other situations. We do not sell it.
We are a small company and we build on other companies’ infrastructure. The providers below process personal information on our behalf, under contract, only on our instructions, and only for the purpose shown. They are not permitted to use your information for their own purposes.
| What it does | Provider | Processes data in |
|---|---|---|
| Application hosting and content delivery | Vercel | USA and global edge locations |
| Database, sign-in, and file storage | Supabase | European Union (Ireland) |
| Payments, invoicing, subscriptions (merchant of record) | Polar | USA and European Union |
| Bot and abuse prevention on our sign-in forms | Cloudflare (Turnstile) | Global |
| Rate limiting and short-term caching | Upstash | European Union and USA |
| AI voices, and the spoken conversation partner | Inworld AI | USA |
| Language models behind the chat tutor, translation, dictionary lookups, character recognition, and generated cover art | Deepinfra | USA |
| Machine translation | LibreTranslate | European Union |
| Spoken conversation practice — including transcribing the audio you speak during a session — where it is used instead of Inworld AI | Google (Gemini API) | USA and European Union |
| Automated first-pass moderation of community submissions | OpenAI (moderation only) | USA |
| Sign in with Google | USA | |
| Sign in with X | X (formerly Twitter) | USA |
| Ambient video playback (embedded in privacy-enhanced mode) | YouTube / Google | USA |
| Ambient radio playback | Third-party internet radio providers | Various |
| Product analytics — anonymous until you consent, then linked to your account | PostHog | European Union |
This list changes as our stack changes. When we add or replace a provider that processes personal information, we update this table and the “Last updated” date.
We do not sell your personal information, we do not rent or trade it, and we do not share it for advertising, ad targeting, or cross-context behavioural advertising. There are no advertising or social media tracking pixels on Fluensea.
In Short: Yes. We are based in South Africa and our providers are mostly in the European Union and the United States. We use recognised legal transfer mechanisms.
FLUENSEA (Pty) Ltd is registered in South Africa, so the people who operate the Services access your information from South Africa. Our database and file storage sit in the European Union (Ireland). Several of the providers in section 4 process data in the United States. This means your personal information crosses borders.
If you are in the EEA, the UK, or Switzerland, countries outside those regions may not offer the same level of legal protection as your own. Where we transfer your personal information out of those regions — including to us in South Africa, and to providers in the United States — we rely on one of the following, and we will tell you which one applies to a given provider if you ask:
We also keep the practical measures that make those clauses meaningful: data encrypted in transit and at rest, access limited to the people who need it, and contracts that require providers to tell us about government access requests where they are legally able to.
If you are in South Africa, we transfer personal information outside the Republic in reliance on section 72 of POPIA, on the basis that the recipient is bound by an agreement with us that upholds principles for lawful processing that are substantially similar to those in POPIA, or because the transfer is necessary to perform our contract with you.
In Short: Yes — a small number. No analytics cookie or analytics storage is ever written to your device unless you agree to it.
We use cookies and browser storage in two categories.
These make the site work and cannot be turned off, so we do not ask for consent for them. They set no advertising identifiers and follow you nowhere else.
PostHog tells us which pages get opened, which features get used, and where people get stuck, so we know what is worth improving. It records page views, clicks on buttons and links, and events like finishing a study session. It does not record your keystrokes, your recordings, or the content of your lessons and flashcards, we do not use it for advertising, and we never sell it. Data is processed in the European Union.
How much it collects depends on your answer to the cookie banner, and there are three states rather than two.
You can change your mind at any time, and changing it takes effect immediately rather than at your next visit:
We also honour browser-level opt-out signals — see section 14.
When you play ambient video, the player is embedded from YouTube in its privacy-enhanced mode (youtube-nocookie.com), which avoids YouTube’s tracking cookies unless you actually start playback. Once you press play, Google may set its own storage and receives your IP address as the video is delivered, governed by the Google Privacy Policy. Ambient radio streams are fetched from third-party stations, which likewise see your IP address as part of delivering the stream.
In Short: Yes, and they are central to the product. Whenever you are dealing with an AI rather than a person, we say so. We do not train models on your content.
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) and equivalent rules elsewhere require us to be clear about where you are interacting with an AI system or with content it generated. In Fluensea, that is:
We do not use AI to impersonate a specific real person, and we do not present AI-generated content as human-written. If you find an AI touchpoint that is not clear about being AI, tell us and we will fix the labelling.
The AI features are powered by the third-party providers named in section 4. To return a result to you we send them what the feature needs: the message you typed, the audio you recorded, the sentence or passage being worked on, the text you imported, and the settings of the exercise. We do not send them your name, email address, or payment details, and your account is identified to them only by a random identifier where one is needed at all.
We do not use your content to train AI models. Not your recordings, not your transcripts, not your chats with the tutor, not the texts you import. We do not build models of our own from your data, and we select and configure our AI providers so that content we send for processing is not used to train their models. If that ever changes, we will update this notice and tell you before it takes effect — we will not do it quietly.
You must not use the AI features in a way that breaches the terms of the underlying provider, and you should not type or speak sensitive personal information — yours or anyone else’s — into them.
The AI features make automated judgements about your learning: what level you are at, how hard a text is for you, what to review next, and whether a piece of community content needs a human to look at it. These affect what the app shows you, not your legal rights or your access to the Services. We do not use automated decision-making to set your price, refuse you service, or terminate your account — a person makes those decisions. If you believe an automated judgement about you is wrong, email us and a person will look at it.
For the features described above, Fluensea acts as a deployer within the meaning of the EU AI Act: we put third-party AI systems to use in our own product under our own name, but we do not develop or train the underlying models, which are supplied by the providers listed in section 4. None of these features is a high-risk AI system under Annex III of the Act — Fluensea is not used to decide access to education, employment, credit, or public services, and any certificate or score it produces is for your own information. We do not use emotion recognition or biometric categorisation. Questions, complaints, or transparency requests about our use of AI should go to team@fluensea.co.
Generated translations, explanations, corrections, and stories can be inaccurate, and confident-sounding mistakes are the normal failure mode of this technology. Treat the Services as a practice tool, not as an authority — and never as a source of professional, medical, legal, or financial advice.
In Short: If you choose to sign in with Google or X, we receive basic profile information from them and nothing more.
Our Services offer you the ability to register and log in using your existing Google or X account. Where you choose to do this, that company sends us your name, email address, and profile picture — and, in X’s case, your @username as well — and confirms that the sign-in succeeded. We do not receive your password for either, and we do not get access to your Gmail, Drive, contacts, or calendar.
A note on what X’s permission screen says. X grants sign-in access in fixed bundles, and the bundle that carries your email address also carries permission to read posts from your timeline. That is why X names it on the screen where you approve the sign-in. We never read your timeline. We ask X for exactly five things — your account id, name, @username, profile picture, and confirmed email address — and we cannot post, follow, message, or read on your behalf. If your X account has no confirmed email address on it, the sign-in will stop and tell you so, because we need an address to reach you about your subscription and to let you reset a password.
We will use the information we receive only for the purposes described in this Privacy Notice. We are not responsible for other uses of your personal information by Google or X themselves, and we recommend reviewing the Google Privacy Policy and the X Privacy Policy to understand how they use your data. You can disconnect Fluensea at any time — in your Google security settings, or under Settings → Security and account access → Apps and sessions on X. If you do, use the password-reset flow to set a password so you can still reach your account.
In Short: What you post to the community is public, including recordings of your voice. Only post what you are comfortable making public.
The Services include a community area where you can submit your own work — written answers and audio recordings of you speaking — for others to see, hear, and respond to. This is entirely optional. Nothing you do in your own lessons is ever published.
When you post a submission:
Please do not record other people without their agreement, record children, or include your address, phone number, financial details, or other information you would not shout across a room.
You can delete your own submissions at any time from the community area, and deleting your account removes them too. We will remove the stored file and it will stop being served — but we cannot retrieve copies that other people have already made, and cached copies may persist briefly. If a submission of yours has been published and you need it taken down urgently, email team@fluensea.co and we will treat it as a priority.
In Short: Most things until you delete them or close your account. Billing records for longer, because tax law requires it.
We keep personal information only for as long as we need it for the purposes in this notice, and then delete or anonymise it. In practice:
| Information | How long we keep it |
|---|---|
| Account details, learning content, progress, and settings | Until you delete the item, or until you delete your account |
| Practice recordings made in exercises | Not stored — processed in your browser, and where a transcript is needed, sent for transcription and not retained |
| Community submissions, including published audio | Until you delete the submission or your account, or we remove it for breaching our terms |
| Server and security logs | Up to 12 months, then deleted |
| Product analytics (only if you consented) | Up to 24 months from collection |
| Billing and tax records (invoices, amounts, dates) | At least 5 years after the transaction, as South African tax and company law requires — this survives account deletion |
| Support correspondence | Up to 24 months after your query is resolved |
| Encrypted backups | Rolling 30 days, after which deleted data is gone from backups too |
Two things outlive account deletion. The first is the billing record above. The second is a minimal record — an email hash and the date — where we need it to enforce a limit or prevent abuse, such as remembering that a free trial has already been used, or that an account was closed for breaching our terms. We keep as little as possible for as short a time as possible.
Where deletion is not immediately possible because information sits in an encrypted backup, we isolate it from any further processing until the backup rotates out.
In Short: We take reasonable technical and organisational measures, and we will tell you if something goes wrong in a way that puts you at risk.
Our measures include encryption in transit (HTTPS) and at rest, row-level access rules in the database so one account cannot read another’s data, password hashing, access to production systems limited to those who need it, rate limiting and bot protection on authentication endpoints, and dependence on established infrastructure providers rather than machines we manage ourselves.
However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Transmission of personal information to and from our Services is at your own risk. You should use a strong, unique password and access the Services from a device you trust.
If personal information in our care is lost, accessed, or disclosed unlawfully, we will investigate immediately and contain it. Where the law requires it, we will notify the relevant regulator — the Information Regulator of South Africa under section 22 of POPIA, and the competent EU or UK supervisory authority under Articles 33 and 34 of the GDPR, in that case within 72 hours of becoming aware of it — and we will notify you directly, in plain language, where the breach is likely to put your rights or your data at risk. We will tell you what happened, what information was involved, and what you can do about it.
In Short: You must be at least 13 (16 in some countries). Under 18s need a parent’s permission. We do not aim the Services at children and we do not market to them.
Minimum age. You must be at least 13 years old to create an account. If you are in a country whose law sets a higher minimum age for using an online service without a parent’s authorisation — 16 in several EU member states — that higher age applies to you. We do not knowingly allow anyone below the applicable minimum age to register, and we do not knowingly collect their personal information.
If you are between 13 and 17. You may use the Services with the permission of your parent or legal guardian, and by registering you confirm you have it. Under section 35 of POPIA we rely on that permission as the consent of a competent person for processing your information; under Article 8 of the GDPR it is the parental authorisation that consent-based processing requires. Please talk to your parent or guardian before you sign up, and before you post anything — including a recording of your voice — to the community.
The Services are not designed for or directed at children. We do not build features for children, we do not advertise to children, we do not use child-appeal marketing, and nothing in the Services profiles a user for advertising. Content is generated for adult learners and, although we filter for offensive material, it is not curated as children’s content.
Parents and guardians. If you believe a child under 13 has registered, or that your child aged 13 to 17 signed up without your permission, email us at team@fluensea.co. We will verify the request, close the account, and delete the personal information. You can also ask us for a copy of what we hold about your child, or ask us to correct it. If we learn ourselves that an account belongs to someone below the minimum age, we will deactivate it and delete the data without waiting to be asked.
In Short: You can see, correct, export, and delete your information, object to some of what we do with it, and complain about us. Email us and we will do it.
Wherever you live, we will honour the following. In the EEA, the UK, Switzerland, South Africa, Canada, and many US states these are legal rights; where they are not, we give them to you anyway.
Email team@fluensea.co and say what you want. That single route covers every right above, including access and export — we do not yet have a self-service download button, so we assemble a machine-readable copy by hand and send it to you.
You can also do some of it yourself, immediately, in the app:
One thing to know about in-app deletion: the delete button asks you to cancel an active paid subscription first, so that billing stops before the account and its records disappear. That is a sequencing safeguard, not a refusal — if you would rather we did both at once, email us and we will cancel the subscription and delete the account together. We will never use a live subscription as a reason to refuse an erasure request.
We respond within 30 days, and faster where we can. If a request is unusually complex we may extend that once and will tell you why. We may need to confirm your identity before we act, which protects you as much as us — we will ask for as little as possible to do so, and we do not charge for any of this unless a request is manifestly excessive or repetitive.
Please raise it with us first at team@fluensea.co — most problems are a misunderstanding we can fix the same week. You do not have to, and going to a regulator directly costs you nothing.
If you are located in the EEA or UK and believe we are unlawfully processing your personal information, you have the right to complain to your Member State data protection authority or the UK Information Commissioner’s Office. In Switzerland, the Federal Data Protection and Information Commissioner. In South Africa, the Information Regulator — details in section 16.
Most browsers, and some browser extensions, can send a signal saying you do not want to be tracked — either the older Do-Not-Track (“DNT”) header or the newer Global Privacy Control (“GPC”), which California and several other US states treat as a binding opt-out.
We honour both. If your browser sends DNT or GPC, we treat it as a decision to decline optional analytics: nothing is loaded, no analytics cookie is written, and we do not even show you the cookie banner, because you have already answered it. This applies to the only optional tracking we have. It does not switch off the strictly necessary cookies that keep you signed in, since without those the Services cannot work at all.
Because we do not sell personal information or share it for cross-context behavioural advertising, there is nothing else for an opt-out signal to switch off.
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have additional privacy rights.
Using the categories set out in the California Consumer Privacy Act, we have collected the following in the past twelve (12) months:
| Category | What that means for us | Collected |
|---|---|---|
| A. Identifiers | Name or display name, email address, account username, account identifier, IP address | YES |
| B. Personal information (CA Customer Records) | Name, email address, and billing country and card brand and last four digits received from our payment provider. We never receive your full card number | YES |
| C. Protected classification characteristics | We do not ask for your gender, date of birth, race, ethnicity, national origin, religion, marital status, or disability | NO |
| D. Commercial information | Your plan, subscription status, trial history, transaction amounts and dates | YES |
| E. Biometric information | Recordings of your voice from speaking exercises and community submissions. We do not create voiceprints, do not extract identifier templates, and never use audio to identify you | YES |
| F. Internet or other network activity | Which features and pages you use, exercises completed, searches within the app, error diagnostics. Product analytics only if you consent. No browsing history from other sites, no advertising interactions | YES |
| G. Geolocation data | Approximate location — country, sometimes region — derived from your IP address. No precise or GPS location | YES |
| H. Audio, electronic, sensory, or similar information | Microphone audio from speaking exercises, and published community audio | YES |
| I. Professional or employment-related information | We do not collect your job title, employer, or work history | NO |
| J. Education Information | We hold your progress in our own course, but no student records or directory information from an educational institution | NO |
| K. Inferences drawn from collected information | Estimated proficiency level, how demanding material is for you, review scheduling, and the interests you told us about — used to pick content, never for advertising | YES |
| L. Sensitive personal information | As the CCPA defines it: no government identifiers, no financial account credentials, no precise geolocation, no racial, religious, health, or sexual-orientation data, and no biometrics used for identification | NO |
How long we keep each category is set out in section 10. In summary: categories A, B, D, F (excluding logs), G, K and your learning content are kept until you delete them or close your account; audio in categories E and H is not retained at all unless you publish it to the community; server logs for up to 12 months; analytics for up to 24 months; and billing records in categories B and D for at least 5 years, because South African tax and company law requires it.
We do not sell personal information, and we have not sold any in the past twelve months. We do not share personal information for cross-context behavioural advertising, and we have not in the past twelve months. We do not use or disclose sensitive personal information for any purpose beyond those permitted without a right to limit. We do not knowingly sell or share the personal information of anyone under 16.
Depending on your state, you have the right to know what we collect and why, to access and receive a copy of it, to correct it, to delete it, to opt out of sale, sharing, and profiling in furtherance of decisions with legal or similarly significant effects, to limit our use of sensitive personal information, and not to be discriminated against for exercising any of these.
To exercise any of them, email team@fluensea.co, or use the in-app controls described in section 13. We do not sell or share your information, so there is no opt-out for you to submit — but you may still send one, and we will confirm the position in writing. We will respond within 45 days and may extend once by a further 45 days where a request is complex, telling you why. An authorised agent may act for you if you give them written permission and we can verify it.
If we decline to act on your request, you may appeal by emailing team@fluensea.co with “Appeal” in the subject line. We will respond to the appeal within 45 days with a written explanation. If your appeal is denied, you may submit a complaint to your state attorney general.
California “Shine The Light” Law. California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes. We disclose none, but you are welcome to ask us to confirm that using the contact details in section 19.
In Short: You may have additional rights based on the country you reside in.
We collect and process your personal information under the obligations and conditions set by Australia’s Privacy Act 1988 and New Zealand’s Privacy Act 2020. This Privacy Notice satisfies the notice requirements defined in both Privacy Acts. If you do not wish to provide the personal information necessary to fulfil their applicable purpose, it may affect our ability to offer you products or services, respond to your requests, manage your account, or confirm your identity.
At any time, you have the right to request access to or correction of your personal information. If you believe we are unlawfully processing your personal information, you have the right to submit a complaint about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner and a breach of New Zealand’s Privacy Principles to the Office of New Zealand Privacy Commissioner.
This is our home jurisdiction. FLUENSEA (Pty) Ltd is the responsible party for the personal information described in this notice, within the meaning of the Protection of Personal Information Act 4 of 2013 (POPIA), and the service providers in section 4 are our operators.
Our Information Officer is responsible for our compliance with POPIA and for handling your requests and complaints. You can reach them at team@fluensea.co, marking your message for the attention of the Information Officer, or by post at the address in section 19.
Under POPIA you have the right to be told that we hold your information and to ask what it is (sections 23 and 24), to have it corrected, destroyed, or deleted where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully, to object to processing on reasonable grounds (section 11(3)), not to receive unsolicited electronic direct marketing (section 69), not to be subject to a decision based solely on automated processing (section 71), and to complain to the Information Regulator. Exercising these rights costs you nothing, other than the prescribed fee for a formal access request, which we will tell you about before charging.
Access to information (PAIA). Requests under the Promotion of Access to Information Act 2 of 2000 should be sent to the Information Officer at the address above, and our PAIA manual is available free of charge on request from the same address.
If you are unsatisfied with the way we have handled a complaint about our processing of personal information, you can contact the Information Regulator (South Africa) at enquiries@inforegulator.org.za, or for complaints: PAIAComplaints@inforegulator.org.za & POPIAComplaints@inforegulator.org.za. You do not need to come to us first, though we would rather you did.
In Short: Right now we only send you emails you need. If that ever changes, you will be asked first and can leave in one click.
Service and account emails. These are part of the Services and are not marketing: confirming your address, resetting your password, confirming a subscription or trial change, receipts and billing notices, replies to your support requests, security alerts, and notices about changes to this notice or our terms. You cannot unsubscribe from these while you have an account, because they are how we tell you things you need to know. If you do not want them, delete your account.
Marketing emails. We do not currently send marketing or promotional email. If we start, then:
You can also ask us to stop at any time by emailing team@fluensea.co, with no need to give a reason. We do not currently place tracking pixels in our emails; if we introduce open or click tracking, we will update this section before we switch it on.
In Short: Yes. For anything material we will tell you directly rather than quietly changing the date.
We may update this Privacy Notice from time to time, and the updated version will be marked by a new “Last updated” date at the top. If we make a material change — a new purpose, a new category of information, a new recipient, a change to how long we keep things, or anything that reduces your rights — we will notify you by email or with a prominent in-app notice before it takes effect, and where the change relies on your consent we will ask for it rather than assume it.
We keep previous versions of this notice and will send you the version that applied on any given date if you ask at team@fluensea.co.
The data controller and responsible party for the information described in this notice is FLUENSEA (Pty) Ltd, a private company registered in South Africa. Privacy questions, requests, and complaints all go to the same place — our Information Officer, at team@fluensea.co. We are not required to appoint a Data Protection Officer under Article 37 of the GDPR, so the Information Officer is your contact point for every privacy matter.
Depending on where you live, you may have the right to ask for access to the personal information we hold about you, for details of how we have processed it, for a machine-readable copy of it, for inaccuracies to be corrected, or for it to be deleted.
Two routes, both of which work:
Full detail on what you can ask for, how long we take, and how to complain if we get it wrong is in section 13.