Privacy Policy

1. Definitions

• "Data subject" — the individual to whom the personal data relates.
• "Operator" — the party that collects, processes, and protects personal data.
• "Personal data" — information relating to an identified or identifiable data subject.
• "Processing" — actions to collect, store, change, use, and destroy data.
• "Cross-border transfer" — transfer of personal data to the territory of a foreign state.

2. What data we collect

• email address;
• password (stored as a hash; never stored in plain text);
• name or nickname, if you provide one;
• chosen interface language and learning settings;
• learning-progress data (vocabulary, completed lessons, statistics);
• events about payments and subscription status;
• technical data: IP address, device and browser type, cookies.

We do not collect or store bank-card numbers. Payment details are entered on the side of the Payment service Freedom Pay (Paybox) and are not passed to the Operator.

3. Purposes of processing

• providing access to the Service and keeping it operational;
• user registration and authentication;
• setting up and tracking subscriptions, and processing payments;
• user support and responding to requests;
• improving the Service and anonymized usage analytics;
• complying with the laws of the Republic of Kazakhstan.

4. Legal basis for processing

Personal data is processed on the basis of your consent (Articles 7 and 8 of Law No. 94-V) and to the extent necessary to perform the contract (the Public Offer). Consent includes information about the list of data processed, the purposes of processing, transfer to third parties, and cross-border transfer.

5. Transfer to third parties

To operate the Service, personal data may be transferred to: the Payment service Freedom Pay (Paybox) — to process payments; the cloud-infrastructure provider (Supabase) — to store and process data; analytics services — in anonymized form. Transfers are made on the basis of your consent and in order to perform the contract.

6. Cross-border transfer and place of storage

Personal data is stored and processed on the servers of the infrastructure provider (Supabase) in a data center located in Tokyo, Japan (the ap-northeast-1 region). This constitutes a cross-border transfer of personal data, to which you consent in accordance with Article 16 of Law No. 94-V.

7. Retention periods

Personal data is stored until the purposes of processing are achieved, your consent is withdrawn, or your account is deleted, unless a different period is established by the laws of the Republic of Kazakhstan (Article 12 of Law No. 94-V).

8. Your rights

Under Article 24 of Law No. 94-V, you have the right to: obtain information about the processing of your personal data; require its change, supplementation, or blocking; require the destruction of your data; and withdraw your consent to processing.

To exercise your rights, delete your account, or withdraw consent, contact support@tillab.app or use the settings in your Account area. Requests are handled within the time frames set by law.

9. Cookies and analytics

The Service uses cookies and similar technologies for authentication, saving settings, and analyzing usage. You can disable cookies in your browser settings, but some features of the Service may then become unavailable.

10. Protection measures

The Operator takes the necessary legal, organizational, and technical measures to protect personal data against unlawful access, alteration, distribution, or destruction (Article 25 of Law No. 94-V), including encryption of the transmission channel (HTTPS), access control, and storing passwords as hashes.

11. Changes to the Policy and contact

The Operator may amend this Policy by publishing a new version at tillab.app/privacy. For any questions about the processing of personal data, contact support@tillab.app.

Version dated July 23, 2026.