Privacy

Last updated: 2026-10-13

1. Who is responsible

Stefan Dissmer, trading as KILMA Lingua, C/ Llacuna 162-164, 08018 Barcelona, Spain (NIE X4958335H), telephone +34 637 416 117 (“kilma”, “we”, “us”), is the controller for the processing described here. For anything in this policy, including access and deletion requests, write to dissmer@gmail.com. We reply within a few working days.

2. What this policy covers

This policy covers the public website, the enquiry form, the learning app, and the Kelp classroom. It does not cover sites we link to. We do not sell personal data, we do not run advertising, and we do not build profiles for advertising purposes.

3. Visiting the website

When you visit kil.ma, our web server writes one line per request to an access log: the time, the address requested, the response code, the browser you use, the page you came from and your IP address with its last part removed before it is written — an IPv4 address loses its last octet, an IPv6 address everything after the first 48 bits. The full address never reaches the disk. The line contains no cookie and no sign-in token. We keep these lines for fourteen days and then delete them. From them we count visits on our own server with an open-source tool that runs there and sends nothing anywhere; the resulting report shows numbers, not people, and only we can see it. The log exists so that faults and attacks can be traced and so that we know how many people use the site. This is our legitimate interest under Article 6(1)(f) GDPR (section 10); it needs no consent and sets no cookie.

We use no analytics service, no tracking pixels and no advertising cookies. Nothing about your visit is shared with anyone.

4. The enquiry form

The form that asks about your goals before a first conversation differs from an ordinary contact form in three ways, so it is described here in detail.

What we store:

Your email address (required) and your name (optional).
Your answers: your goal; your own description of your situation; which things you would like to be able to do (from a fixed list); whether a date is pushing you; your Darija level; whether you read the Arabic script; the languages you speak; if you choose to give it, a rough age range (for example “30s”); the topics you would like to start with; four preferences about how you like to be taught; how much humour you like in a lesson and how you describe yourself as a learner; how often you would like to meet; the days and time windows that suit you; your time zone.
Your closing comment and, if you tell us, how you found kilma.
Technical accompaniments: which language version of the site you used, how far you got in the form, when you sent it, and whether our notification email went out.

When the record is created. The record is created as soon as you enter a valid email address and leave the second step — not when you press “Send”. We do this so that an interrupted enquiry is still an enquiry: if you stop on step five, we still know how to reply and what you were looking for.

If you do not finish. An unfinished enquiry stays with us as an incomplete one, and Meriam may write to you once to ask whether she can help. If you would rather not hear from us, one line to dissmer@gmail.com is enough and we delete the record.

On your own device. While you fill the form in, your answers are also kept in your browser’s local storage so that reloading the page does not lose them. That copy is deleted from your device once the form has been sent successfully. It is a convenience on your machine, not a transmission.

Purpose: to answer your enquiry and to let your teacher prepare for the first conversation.

5. Account and sign-in

If you have an account, we store your name, email address, an avatar you chose or one derived from your account, your role, when you last signed in, and a session cookie. You can sign in with an email address and password, or with Google — in that case Google tells us your name, email address and profile picture. We never receive your Google password.

Trying kilma without an account. You can start learning straight away, without giving us anything. We then create a guest account for you. It carries no name of yours and no address of yours: the display name is simply “Guest”, and because our sign-in framework insists on an email address, the record holds a placeholder in a domain that is reserved as permanently unresolvable, so nothing can ever be sent to it. What the guest account holds is what you do while you try: the words you answer, your intervals and your settings.

Keeping what you learned. If you decide to stay, you turn the guest account into your own: you add an email address and a password, or you sign in with Google. It is the same record throughout, so your progress simply stays where it is. If you already have an account, we merge the two after checking your password, and your existing account keeps precedence wherever the two disagree.

If you never come back. A guest account is deleted thirty days after it was last used, together with everything in it. That is the same thirty days the guest session cookie lasts (section 14), so the promise and the cookie say the same thing.

6. Learning, lessons and homework

Learning progress: which words you have answered and how, your intervals and due dates, favourites, and your settings (interface language, time zone, learning mode, level). We use this to schedule repetitions and to show your teacher where you stand.
Lessons: the appointment, the shared documents and the whiteboard, and any screenshots taken in the room. Video and audio of a lesson travel directly between the two participants and are not recorded by us. If an administrator opens a room, a document or a screenshot, that access is logged.
Calendar subscription: in your profile you can get a private link to your lessons. Once you add that link to a calendar service of your choice (for example Google Calendar, Apple Calendar or Outlook), that service regularly fetches your lesson times and the first name of the other person in each lesson from us, and processes them under its own terms. Nothing is sent until you add the link. Anyone who has the link can see these lessons, so treat it like a password; resetting it in your profile makes the old link stop working at once.
Homework: the tasks, your answers, and — where a task asks you to speak — voice recordings you make yourself, so your teacher can listen and respond.
What your teacher notes about you: a short profile that helps her prepare each lesson — how you like to be taught (humour, learning type), shown next to what you said about yourself in the enquiry form, an estimated age range if you have not given your year of birth, your goal, up to three interests and sub-goals, and which topics each lesson covered. She also sees which packs you own. Only your teachers and our administrators see this, not other learners. You can ask us at any time to see or correct it.
Group classes: if you join a study group, the other members and the teacher see your first name and your avatar, never your email address. Messages in the group chat are visible to the teacher and to every member of the group, and they stay in the group as long as it exists. Video and audio of a group class travel through a server we operate ourselves at our hosting provider in Germany; they are not recorded. Your number of group seats is visible only to you, your teacher and our administrators. For each seat used we store the seat price and kilma's share, and whether you came to your teacher through her group invitation link, because this determines the teacher's fee.
Lesson ratings: after a lesson you can rate the audio and video, your experience with your teacher and the quality of the lesson, or skip the question. Your teacher sees the ratings you give for her lessons, together with the date of each lesson; our administrators see all ratings. Ratings are kept as long as your account exists.

7. Buying a pack

If you buy a vocabulary pack, a lesson or a bundle, we store the order: what you bought, the amount, the currency, the moment of purchase, the payment reference our provider gives us, and the email address the payment was made with. You receive a receipt by email. If you had no account when you bought, one is created from that email address so that what you bought has somewhere to live; you set a password afterwards and it is yours.

Payment itself happens at Stripe or PayPal, not here. Your card details never reach us: we see the amount, the payment email address and the reference, and nothing else. Section 11 names the two companies.

Because a pack is delivered the moment you have paid, we ask you to give up the fourteen-day right of withdrawal for that delivery, and we record the moment you did. That record is the proof that we asked and you agreed; without it the right would not have lapsed.

Order records are kept for six years, as Spanish commercial and tax law requires of anyone who sells (article 30 of the Código de Comercio). That is longer than we keep anything else, and it is not our choice: deleting your account does not delete the record that a purchase was made.

8. Applying to teach on kilma

If you apply to teach on kilma, we process what you type into the form, your teacher profile, and, if you take it, what the optional language test produces and the recordings you make for it. The form asks for your name, your email address and the languages you would teach in. We send a link to that address to confirm it; you then choose a password and from then on sign in with your email address and that password.

What you give us on the form: your name, your email address and the languages you would teach in.
The written part: for each rung, which level it was, whether it was a first or a second attempt, when it started and finished, your score, and whether you passed. For each question: which option you chose or that the time ran out, whether it was correct, how long you took, and when the question was shown to you. The timing is measured on our server, not in your browser.
Which questions you have already seen, so that a second attempt gives you questions you have not.
The short code and confirmation number that connect your computer to your phone, and the moment the two were connected.
The spoken part: an audio recording made in your phone's browser, its length and format, the transcript, a mark for pronunciation, fluency, grammar, vocabulary and task completion, an overall level, a short written reason, and whether the answer sounds read aloud rather than spoken freely.

The recording is sent to Google (Gemini) to be transcribed and assessed, and Google returns the transcript and the marks. Google receives the audio and nothing else — not your name, not your email address, not your results. Section 12 says what that means for where your data goes. We ask for your explicit consent before the first recording and note when you gave it; without it there is no recording button, and you can stop at any point.

Who receives the recording, and for how long. The recording goes to Google's Gemini Developer API on our paid plan, which means Google does not use it, or what it returns, to train or improve its models. It receives the audio and nothing else. A recording from a rung you pass is deleted as soon as it has been assessed; one from a rung you do not pass is kept for thirty days so that a decision against you can still be checked. Whatever is still here ninety days after we have decided about your application — the recordings and their transcripts — is deleted then, whether we take you on or not; if we do, what remains is the record that you passed, not your voice. The language test is optional. If you would rather we held no recording of you, write to teach@kil.ma: we delete your recordings and their transcripts, and your application continues without the test.

To tell a person from a bot, the form measures how long you took to fill it in and contains a field that is invisible to you; neither is kept once you have sent it. Your IP address is used to limit how many applications can be started from one connection in an hour — it is held in memory only, for at most an hour, and is never written to a database. When your account is created and each time you sign in, an entry goes into our internal access journal, which section 13 describes.

No decision about you is made by a machine alone. The test sorts applications; every judgement it produces can be overturned by a person, and nobody is taken on without a conversation with one of us first. If you think a result is wrong, write to us and say so — while a failed attempt's recording is still here, we can listen to it again.

Once you have confirmed your email address, you set up your teacher profile. It asks for a photo or scan of your ID card or passport, your full name and postal address as they will appear in your contract, the hours you are available for lessons, and, if you choose, certificates together with the file you upload. We use the ID only to confirm who you are before you teach. Only our administrators and the staff who handle teacher applications can open it; it never appears on your public profile, and every time someone opens it is logged. Certificates are checked by us; once checked, the name and level of a certificate may appear on your public profile, but the file itself never does.

If you use “Something not working? Tell us” on one of the application pages, we receive your message and your email address together with the address of the page you were on, your browser's identification string and screen size, the time on your device, the last error message the page showed, and the state of your current test attempt. The report goes by email to our administrators so that we can help you and answer you. We keep it only as long as we need it to answer you and fix the problem.

9. What we do not do

What you produce as a learner — your learning data, your homework answers and the voice recordings you make for homework — is not sent to any AI service. We do use machine translation and speech synthesis, but only for material everybody sees: the shared vocabulary corpus, the words and example sentences and their audio, the texts of the interface, and the drafts of our newsletter. Section 11 names the two services that receive them. Nothing you write or record as a learner goes there. The one exception is the teacher application described in section 8, where the recording is the thing being assessed.

10. Legal bases

Answering your enquiry: Article 6(1)(b) GDPR — steps taken at your request before entering into a contract.
The single follow-up if you do not finish the form: Article 6(1)(b) — you gave us the address so that we would reply, and an unfinished enquiry is still an enquiry. Section 4 makes this foreseeable at the moment you enter it, and one email is the whole of it.
Account, lessons, learning progress, homework and your teacher’s notes about you: Article 6(1)(b) — performance of the contract.
A guest account and what you learn in it: Article 6(1)(b) — steps taken at your request before entering into a contract, and performance of that contract from the moment you turn it into an account of your own.
Buying a pack, a lesson or a bundle, and the receipt for it: Article 6(1)(b) — performance of the contract.
Keeping the order records afterwards: Article 6(1)(c) — a legal obligation; Spanish commercial law requires anyone who sells to keep the books and the supporting records for six years (article 30 of the Código de Comercio).
Server logs and defence against attacks: Article 6(1)(f) — security of the service.
Logging of administrator access: Article 6(1)(f) — accountability.
A teacher application, the test and the emails about it: Article 6(1)(b) — steps taken at your request before entering into a contract.
Recording your voice and having it assessed: Article 6(1)(a) — your consent, which you may withdraw at any time. Withdrawing it ends your language test; your application continues without it.
Limiting how many applications one connection can start: Article 6(1)(f) — keeping the form usable.
A problem report from the application pages: Article 6(1)(b), handling your application at your request.
Your ID, the name and address for your contract, your certificates and your weekly hours: Article 6(1)(b), steps taken at your request before entering into a contract and, once you teach, performance of that contract.

11. Who else sees the data

We use service providers who process data on our instructions: Hetzner Online GmbH, Germany, for servers and backups; Plus Five Five, Inc. (“Resend”), San Francisco, United States, for sending our emails; Google Ireland Limited, only if you choose to sign in with Google; and Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland, which runs the Gemini Developer API we use — it transcribes and assesses the voice recordings of teacher applicants and receives nothing but the audio. Sending an email means our provider sees the address it goes to and what the message says.

Payments are handled for us by Stripe Payments Europe, Limited, Dublin, Ireland, and by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, depending on how you choose to pay. They receive the amount, the email address you pay with and the order reference, and they tell us the same three things back. Your card or account details are entered on their pages and never reach us. Both are established in the EEA.

We also send text to two services, and none of it is about you: the shared vocabulary corpus, the example sentences, the interface texts and the drafts of our newsletter are translated and drafted with Google's Gemini Developer API (Google Cloud EMEA Limited, Ireland, on the paid tier, so nothing we send is used to improve Google's products) and with DeepL SE, Cologne, Germany. What goes there is learning material, not personal data — no names, no addresses, nothing you wrote or recorded.

Resend is in the United States, so those emails leave the EEA. The transfer rests on the European Commission's standard contractual clauses, and Resend additionally certifies under the EU-U.S. Data Privacy Framework. Nothing else is stored outside the EEA: your account, your answers, your learning data, your recordings and the backups all stay on European servers. They are, however, seen from Morocco — section 12 says by whom, and on what basis.

Your teacher is one of these providers, not a separate business you contract with: lessons are provided by kilma, and teachers work for us as independent contractors under a written data processing agreement. Your teacher sees the data of the learners assigned to her — the enquiry you sent, your progress, your homework, your recordings, the notes she keeps about you and which packs you own — and nothing beyond that. Administrators can see more, and their access to rooms, documents and screenshots is logged. For training, an experienced teacher may be appointed as a team leader and may ask a teacher assigned to that person to show their screen; this never happens during a lesson, so no lesson of yours is ever watched, and it only starts if that teacher accepts. Outside a lesson your data may appear on that teacher’s screen, for example while your homework is being marked. The watching is read-only, nothing is recorded or stored, and every request and session is logged. A team leader may also ask you directly to show your screen, for example to help you with the app: the mirror starts only if you accept, you can end it at any moment, it never happens during a lesson, nothing is recorded, and the request and the session are logged in the same way.

12. Where the data is stored

On servers in Germany — Hetzner, Nuremberg. Backups are encrypted before they leave the server and stored on a Hetzner Storage Box in Falkenstein, Germany. Encrypted means Hetzner cannot read them.

One thing does leave our own servers on purpose: if you apply to teach, the recording of each spoken task is sent to Google to be transcribed and assessed, and the result comes back to us. The recording itself continues to be stored in Germany, and Google receives nothing else about you. Google acts as our processor here, under Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland — the contracting party for the paid tier of the Gemini Developer API in Spain — and the data processing addendum for products where Google is a data processor. Google does not use these recordings, or the assessment it returns, to train or improve its models. It keeps them for a limited period to detect abuse of the service, and during that period they may be cached outside the European Economic Area; that residual transfer rests on the European Commission's standard contractual clauses, which Google's processor terms include.

Your teacher works from Morocco and sees the data of her own students there — the enquiry you sent, your progress, your homework, your recordings, the notes she keeps about you and which packs you own. Morocco is outside the EEA and has no adequacy decision from the European Commission. This access rests on the European Commission's standard contractual clauses (module two, controller to processor), agreed with her in writing, together with a data processing agreement and an assessment of the transfer.

We also work from Morocco ourselves: kilma keeps an office in Tangier, and when we work from there, the same data is on our own screens. That is us, not a third party — nothing is passed to anyone else by it. But it is the same country, and we therefore hold our own devices and our own working habits to the requirements we place on our teachers.

13. How long we keep it

An enquiry that led nowhere: twelve months from your last message, then deleted. Long enough to recognise you if you come back, short enough not to keep a stranger on file.
An enquiry that became lessons: for as long as the account exists, because it is the beginning of the lesson history.
Account, learning progress, homework, lesson ratings and your teacher’s notes about you: while the account exists. If you delete it, they go with it.
A guest account: thirty days from the last time it was used, then deleted with everything in it. Once you turn it into an account of your own it stops being a guest account and is kept like any other.
Voice recordings you make for homework: for as long as your account exists, so that you can hear your own progress. You can delete any recording yourself at any time, and deleting your account deletes them with it.
Classroom documents and screenshots: while the account exists; you and your teacher can delete them earlier.
Records of administrator access: twelve months, kept so that access can be accounted for.
The web server's access log (section 3): fourteen days, then deleted.
Order records — what was bought, the amount, the payment reference, the payment email address and the moment you gave up the right of withdrawal (section 7): six years, because Spanish commercial law requires it (article 30 of the Código de Comercio). Deleting your account does not delete these; they are the record of a sale, not of a person.
A recording from a rung you passed: deleted as soon as it has been assessed.
A recording from a rung you did not pass: thirty days, so that a decision against you can still be checked, and then deleted.
A teacher application, its transcripts, marks and account: thirty days after the application finally ends. If you unsubscribe from our emails, all of it goes at once. If you join us as a teacher, it becomes part of the working relationship and is kept with it.
Every recording and every transcript of a teacher application, whatever the outcome: ninety days after we have decided about the application, then deleted. This is the outer limit and it applies even where the application itself is kept, for instance because we took you on.
The image of your ID card or passport: thirty days after we have checked it, and one hundred and eighty days after you uploaded it at the latest, then deleted. What remains is the date of the check and who made it. If your application is deleted before that, or you delete your account, the image goes with it.
Your full name and postal address for the contract: while the working relationship lasts. If your application is deleted or you delete your account, they go with it.
Certificates and their files: while your account exists. You can remove a certificate yourself as long as we have not checked it yet.

Backups are kept for about a month — seven daily and four weekly snapshots — and then fall away by themselves. Something you delete therefore disappears from the live system at once and from the backups within a month.

14. Cookies and local storage

A session cookie, set when you sign in so that you stay signed in. It is necessary for the service to work.
A guest session cookie, set when you start trying kilma without an account, so that what you learned is still there when you come back. It lasts thirty days and is necessary for the guest mode to work. It is the same kind of session cookie as the one above, only longer-lived — it carries no address of yours, because there is none (section 5).
Your answers in the enquiry form, kept in your browser’s local storage while you fill it in and deleted after sending (section 4).

We use no analytics and no advertising cookies, which is why we ask for no cookie consent.

15. Your rights

You may ask for access, correction, deletion, restriction and portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time with effect for the future. One email to dissmer@gmail.com is enough; we require no particular form. We are established in Spain, so Spanish data protection law applies alongside the GDPR. You may also complain to the supervisory authority: Agencia Española de Protección de Datos (AEPD), Edificio Cuzco IV, Paseo de la Castellana 141, planta 9, 28046 Madrid, Spain, telephone 900 293 183.

16. Children

Lessons are for adults. People aged 14 to 17 may attend only with the consent and under the supervision of a parent or guardian; children under 14 may not open an account. The guest mode without an account remains open to them: you can learn without giving us anything (section 5). The enquiry form is written for an adult. It asks for no date of birth; a rough age range is optional and starts at 18.

17. Changes

We may amend this policy. Material changes are announced on the site before they take effect, and the date at the top tells you which version you are reading.