Privacy Policy

Last updated: June 10, 2026

This Privacy Policy explains how HELGA collects, uses, stores, shares, and protects personal data when you use the HELGA app, website, learning services, subscriptions, AI-assisted features, certificates, and related services.

1. Data Controller

The data controller is:

Legal name: Maksym Mykuliak, trading as HELGA Menntun
Company registration / kennitala: 1103073650
Registered address: Vallaras 1
Email: info@learnhelga.is
Website: https://learnhelga.is

If you have privacy questions or want to exercise your rights, contact info@learnhelga.is.

2. Personal Data We May Collect

The exact data collected depends on the features you use. This policy reflects HELGA's current app configuration, including account authentication, subscription management, certificate processing, and support flows.

Account data

• name or display name;
• email address;
• login method;
• account ID;
• language preferences;
• subscription entitlement status.

Learning and progress data

• completed lessons;
• correct and incorrect answers;
• error review data;
• saved words;
• selected words;
• favourite lessons or levels;
• progress statistics;
• certificate eligibility;
• app usage events needed to provide learning features.

Certificate data

If you purchase or request a certificate, we may collect:

• name to appear on the certificate;
• email address;
• delivery address for paper certificates in Iceland;
• certificate level, course, completion record, issue date;
• certificate ID;
• QR verification data;
• payment or order status.

Do not provide another person’s name or address unless you have permission.

Payment and subscription data

If you purchase through the Apple App Store, Apple processes your payment information. We do not receive your full card number.

We may receive limited purchase information from Apple or subscription tools such as RevenueCat, such as:

• product purchased;
• subscription status;
• transaction ID or receipt data;
• renewal, cancellation, refund, or entitlement status.

AI-assisted feature data

If you use AI-assisted features, we may process:

• questions you submit;
• text you ask AI to explain or correct;
• language settings;
• AI output;
• technical metadata needed to provide and secure the feature.

Do not submit sensitive personal data or confidential information into AI features.

Technical and device data

Depending on app configuration and SDKs, we may collect:

• device type;
• operating system;
• app version;
• IP address;
• approximate region;
• crash logs;
• diagnostic data;
• performance data;
• security logs;
• error logs;
• push notification token if notifications are enabled.

Support data

If you contact us, we may process:

• email address;
• message content;
• screenshots or attachments you send;
• support history;
• information needed to resolve your request.

3. How We Use Personal Data

We use personal data to:

• create and manage your account;
• provide lessons, grammar, flashcards, audio, progress tracking, saved words, and other learning features;
• manage subscriptions and premium access;
• provide AI-assisted grammar and language answers;
• issue and verify certificates;
• deliver paper certificates in Iceland;
• send PDF certificates by email outside Iceland;
• provide customer support;
• fix bugs and improve app performance;
• prevent fraud, abuse, scraping, fake accounts, and certificate misuse;
• comply with legal, tax, accounting, consumer protection, and platform obligations;
• protect our rights and users’ rights.

4. Legal Bases for Processing

Where GDPR or similar laws apply, we rely on these legal bases:

Contract

To provide the Service, manage your account, provide premium features, process certificate orders, deliver certificates, and respond to support requests.

Consent

For optional features, certain analytics, marketing communications, push notifications, and sharing personal data with AI providers where consent is required.

Legitimate interests

For security, fraud prevention, abuse detection, service improvement, debugging, analytics, and protecting legal rights, provided your rights do not override those interests.

Legal obligation

For tax, accounting, consumer protection, legal claims, fraud prevention, platform compliance, or lawful requests.

5. AI Providers

AI-assisted features may use third-party AI service providers such as HELGA's configured third-party AI service provider(s).

When you use AI-assisted features, the text you submit may be sent to the AI provider to generate a response. Do not submit sensitive personal data, confidential information, passwords, ID numbers, passport numbers, health information, financial details, or private third-party information.

AI providers may process data according to their service terms and data processing agreements with us. We use reasonable efforts to select providers with appropriate data protection.

6. Certificate Data and QR Verification

Certificate data is used to create, issue, deliver, and verify certificates.

If a certificate contains a QR code or verification link, a minimal verification record must be retained for the QR verification to work. This may include certificate ID, name shown on the certificate, course or level, issue date, and verification status.

Delivery address data for paper certificates is used for delivery and related support. We aim to delete or anonymise delivery address data after fulfilment and support period, unless we need to retain it for legal, tax, accounting, fraud prevention, dispute, delivery issue, or compliance reasons.

If you request deletion of certificate verification data, the QR code or verification link may stop working.

7. Sharing Personal Data

We may share personal data with:

• Apple, for App Store purchases, Apple sign-in, subscriptions, entitlements, refunds, and platform compliance;
• Google, if you choose Google sign-in;
• hosting, database, and authentication infrastructure providers such as Supabase;
• subscription management providers such as RevenueCat;
• analytics providers, if used;
• crash reporting providers, if used;
• AI service providers configured by HELGA, if AI features are used;
• email and support providers, including Microsoft 365 email infrastructure where needed;
• delivery/postal providers for paper certificates in Iceland;
• professional advisers, such as accountants or lawyers;
• authorities, courts, or regulators where legally required;
• business successors if the Service is sold, merged, or transferred.

We do not sell your personal data.

We do not use your personal data for third-party advertising or tracking unless clearly disclosed and any required consent is obtained.

8. International Transfers

Some providers may process data outside Iceland, the EU, or the EEA. Where required, we use appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, contractual protections, or other legally recognised transfer mechanisms.

9. Retention

We keep personal data only as long as reasonably necessary for the purposes described in this Privacy Policy.

Typical retention periods:

• account data: while your account is active and for a limited period after deletion where needed;
• learning progress: while your account is active or until deleted;
• saved words and error review data: while your account is active or until deleted;
• certificate delivery address: deleted or anonymised after fulfilment and support period, unless needed for legal, tax, accounting, fraud, dispute, delivery, or compliance reasons;
• certificate verification data: retained as long as needed for certificate verification, unless deletion is requested and no legal reason requires retention;
• support messages: retained as long as needed to resolve issues and keep reasonable support records;
• transaction and entitlement records: retained as required for subscription management, legal, tax, accounting, fraud prevention, platform compliance, and dispute handling;
• security logs: retained for a limited period needed to protect the Service.

10. Security

We use reasonable technical and organisational measures to protect personal data, including access controls, encryption where appropriate, secure infrastructure, limited access, and monitoring for abuse.

No system is perfectly secure. You are responsible for protecting your account credentials and device.

11. Your Rights

Depending on your location, you may have rights to:

• access your personal data;
• correct inaccurate data;
• delete your data;
• restrict processing;
• object to processing;
• receive a copy of your data;
• withdraw consent;
• lodge a complaint with a data protection authority.

To exercise these rights, contact info@learnhelga.is.

We may need to verify your identity before acting on a request. Some data may be retained where required by law or legitimate legal reasons.

12. Account Deletion

You may request account deletion inside the app where available or by emailing info@learnhelga.is.

Account deletion may delete your learning progress, saved words, statistics, error history, preferences, and other account data. It may also affect certificate QR verification.

Deleting your HELGA account does not cancel Apple App Store subscriptions. You must cancel subscriptions through your Apple account settings.

13. Marketing Communications

We may send service-related emails such as account, subscription, certificate, support, or security messages.

We send marketing emails only where permitted by law. You can unsubscribe from marketing messages at any time.

14. Push Notifications

If the app uses push notifications, we will ask for device permission. You can disable notifications in your device settings.

15. Children

The Service is not intended for children under 13. If you are under 13, do not use the Service unless your parent or guardian has provided required consent.

If we learn that we have collected personal data from a child under 13 without appropriate consent, we will take reasonable steps to delete it.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The latest version will be available in the app or on our website.

If changes are material, we may notify you through the app, website, or email where appropriate.

17. Contact

Privacy contact: info@learnhelga.is