Privacy information

Lirumi privacy notice — version 2026-09-25 Who operates Lirumi Eniks OÜ, Estonian registry code 16672049, operates Lirumi at lirumi.app. Our registered address is Kose tn 3-3, Narva linn, Ida-Viru maakond, 20103, Estonia. Contact svilen.petrov@eniks.ai for privacy, access, export or deletion requests. Our role and your teacher or school Eniks determines how information is used for its account administration, billing, security and support. We use account and purchase information to provide the service under our contract, retain necessary accounting information for legal obligations, and use proportionate security and support information for our legitimate interests in protecting and operating the service. Where consent is required for an optional activity, that activity requires separate consent. Where a teacher or school chooses the learners, assignments and instructional purposes, it is responsible for those decisions and the lawful basis for that teaching activity. We handle instructional records on its instructions. Contact your teacher or school about the information it supplies, or contact us to identify the responsible account and route your request. Schools and teachers can request a processing agreement from our contact address before supplying learner data; this notice does not replace that agreement. Eniks-operated teaching would require a separate assessment and notice. Information we handle Teacher records include account identifiers, name, email and access role. Teachers supply learner names and contact information, and may add authorized guardian contacts. Optional profile fields can include telephone number and date of birth; provide them only where needed and authorized. Learning records include enrollments, lessons, assignments, answers, writing, attempts, results, feedback and progress. Teachers and authorized learners see records required for their learning relationship. Selected guardian notifications may include lesson information and test results. Purchase records include product, amount, currency, payment references, credits or access granted, and refund or dispute decisions. Card details are entered in Stripe's checkout. Operational records include delivery status, incident categories and support references. Avoid including passwords, access codes, card information or learner answers in an initial support message. Service providers and international processing We use Clerk for teacher authentication, Convex for application data, Vercel for hosting, Stripe for payments, Resend for email and UploadThing for uploaded files. Google sign-in and external course or meeting links also involve their respective providers. Providers receive the information needed for those functions; for example, email delivery uses the recipient address and message, and uploaded files include their contents and metadata. Provider-held records have their own applicable retention and privacy terms. Processing may take place outside Estonia or the EEA; we do not promise EU-only processing. Contact us for the arrangements applicable to your organization and information about international-transfer safeguards. Our provider-contract and transfer review is ongoing. Do not submit sensitive learner material while the necessary arrangements for your use have not been established. AI and recordings Personal learner information is not permitted in AI tools while provider terms and permitted data categories remain under review. Do not submit learner names, transcripts, recordings or other personal information for AI processing. AI integrations, when enabled, use OpenRouter and its selected model providers for text/image/audio analysis and ElevenLabs for generated audio. Availability of these tools is restricted during the review; this notice does not authorize personal-data use in them. Record-and-compare practice recordings in that exercise remain in the browser and are discarded on reset or leaving the component. That behavior does not apply to files you upload elsewhere. Browser storage and shared devices Authentication/session information, interface preferences and recovery copies of unfinished work use cookies or browser storage. The sidebar preference lasts seven days; other local preferences and unfinished recovery copies can remain until the application clears them or you clear the site data. Authentication providers also manage their own session cookies. Signing out does not necessarily remove unfinished work stored on that device. On a shared device, submit or export any work you need, sign out and clear Lirumi site data in the browser when appropriate; clearing local data may irreversibly discard unsent answers and affect other users of that browser. Microphone access is requested by features that need it; practice without a microphone is available in record-and-compare. Retention and deletion Our retention schedule is administered through operator review; it is not a promise of automatic deletion at a precise timestamp. Learning records are kept while the teacher/school's teaching relationship remains active. The default review point is 12 months without enrollment renewal, assigned work, submission or teacher review. We give the responsible teacher/school 30 days' notice before proposed cleanup so it can request export or a documented extension. A valid earlier deletion instruction takes precedence unless a specific retention obligation applies. Expiry of 30-day access does not delete coursework. Teacher accounts remain while used or while they hold continuing purchased coursebook access. Accounts without purchases are reviewed after 24 months' inactivity, with 30 days' notice before closure. Verified account closure removes teaching/account information through our deletion workflow, subject to necessary accounting, security and shared-content exceptions. Shared published-course assets can remain while required by active or historical course releases. Necessary accounting transaction/source records and associated refund evidence are retained for seven years after the relevant financial year ends. This does not justify retaining all learner work. Identifiable completed or finally failed notification records have a 90-day retention target; unresolved deliveries remain until resolved. Ordinary support correspondence is retained for 12 months after closure, and routine redacted incident records for up to 90 days after closure. Specific security, legal or financial holds must have a recorded reason and review date. Copies delivered to recipients' inboxes are not removed by deleting our records. Our recovery policy targets daily backups and a rolling 30-day retention period. Off-site scheduling and recovery arrangements are still being completed. Restricted recovery copies may contain deleted records until expiry; applicable deletion instructions must be applied before a restored service resumes. Unfinished browser work remains until recovery, successful submission or explicit discard, rather than being silently deleted on an inactivity timer. Your rights and complaints Depending on the activity and applicable law, you can request access, correction, erasure, restriction, portability, or object to processing. Where consent applies, you can withdraw it without affecting earlier lawful processing. We verify authority proportionately and respond to applicable GDPR requests without undue delay and normally within one month; if an allowed extension is necessary, we explain it within that first month. Requests concerning teacher/school-controlled records are coordinated with that controller. Automatic exercise feedback supports teaching and review; contact the responsible teacher about assessment decisions and corrections. You can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, https://www.aki.ee) or your competent supervisory authority. Adults organizing learners' use must have authority to provide the information and give learners and guardians the appropriate notices. A teacher supplying an address does not by itself establish guardian consent. This notice is under human legal and operational review; changes will be published with a new version and effective date.