App: Brazilian Portuguese Vocab Pro | Document Version: 1.1. (September 2026)
Note: This Privacy Policy explains what personal data is processed in connection with your use of the app Brazilian Portuguese Vocab Pro and on what legal basis. The app is designed with a strong emphasis on offline-first, on-device data processing.
1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
Rnext IT & Asset Management GmbH
Ringstraße 31
76356 Weingarten (Baden), Germany
Commercial Register: HRB 755386, Local Court (Amtsgericht) Mannheim
Managing Directors: Valentin Reck and Julian Reck
VAT ID: DE457226554
Phone: +49 (0) 7244 609085
Email: kontakt@rnext-it.de
2. Principles of Data Processing
We process personal data only to the extent necessary to provide our app and related services. All processing is carried out in compliance with the GDPR, the German Telecommunications Digital Services Data Protection Act (TDDDG), and any other applicable data protection legislation.
The legal bases for data processing under the GDPR include in particular:
- Art. 6(1)(a) GDPR – Consent of the data subject
- Art. 6(1)(b) GDPR – Performance of a contract or pre-contractual measures
- Art. 6(1)(c) GDPR – Compliance with a legal obligation
- Art. 6(1)(f) GDPR – Legitimate interests of the controller or a third party
Where storage of information on your device or access to information already stored on your device is required, the lawfulness of such access is governed by § 25 TDDDG.
3. Data Collected When Downloading the App
When you download the app from the Apple App Store or Google Play Store, certain data is transmitted to the respective store operator. This includes in particular the username and email address of your store account a the device identifier, and the time and date of download.
This data collection is carried out solely by the relevant app store operator (Apple or Google). We have no influence over it and bear no responsibility for it. The applicable privacy policies are those of Apple (apple.com/legal/privacy) and Google (policies.google.com/privacy).
4. Processing Activities in Detail
4.1 Local Data Storage (App Operation)
The vast majority of the app’s functionality – including your vocabulary sets, learning statistics, and settings – is stored and processed exclusively on your device. We have no access to this data.
| Purpose | Providing app features (vocabulary training, learning progress, curated content) |
|---|---|
| Data categories | Usage data (local), app settings, custom vocabulary, learning statistics |
| Storage location | Exclusively on your device (local) |
| Legal basis | Art. 6(1)(b) GDPR (performance of contract); § 25(2) No. 2 TDDDG |
| Third-party transfer | None |
4.2 Subscription Management via App Stores and RevenueCat
The app is free to download. Access to premium content requires a paid subscription available exclusively through the Apple App Store or Google Play Store. Payment processing and the associated data handling (including your payment and account details) are carried out entirely by Apple Inc. or Google LLC under their own responsibility. We do not receive your payment details at any point.
To manage subscription status, prevent abuse, and unlock premium content, we use the service RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA). RevenueCat acts as our data processor pursuant to Art. 28 GDPR and processes data exclusively according to our instructions.
What data is visible to us in RevenueCat?
As we operate RevenueCat without transmitting any user IDs or contact details, the service works with an anonymously generated App User ID that cannot be directly linked to a natural person. The following data points are visible to us per user in the RevenueCat dashboard:
- Anonymous App User ID – a randomly generated identifier with no direct personal reference
- Subscription status – e.g. active, expired, in trial period, cancelled, or in grace period
- Product identifier – which subscription product was purchased
- Timestamps – purchase date, last renewal, expiry date, date of first and last app use
- Device country – the country derived by RevenueCat from the IP address; RevenueCat does not retain the IP address itself after this determination
- App version – the app version used at the time of the most recent connection
- Estimated revenue (USD) – an amount estimated by RevenueCat based on store data; this does not constitute actual payment data
- Transaction and event history – renewals, cancellations, restores, billing issues, trial conversions
We do not transmit any further personal data (such as name, email address, or phone number) to RevenueCat.
To exercise your right to erasure of data stored by RevenueCat, please contact us at kontakt@rnext-it.de. We will forward your request without delay. RevenueCat also provides a direct GDPR erasure process at compliance@revenuecat.com. Data transfers to RevenueCat in the USA are made on the basis of Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR); a Data Processing Agreement pursuant to Art. 28 GDPR is in place.
| Purpose | Subscription management, fraud prevention, unlocking of premium content |
|---|---|
| Data categories | Anonymous App User ID, subscription status, product identifier, timestamps, device country, app version, estimated revenue, transaction history |
| Controllers / processors | Payment processing: Apple Inc. / Google LLC (acting independently); subscription status management: RevenueCat, Inc. (data processor for Rnext IT & Asset Management GmbH) |
| Legal basis | Art. 6(1)(b) GDPR (performance of contract) |
| Privacy policy | revenuecat.com/privacy |
4.3 Display of the Paywall and Checkout Processing via RevenueCat
When you access the subscription offer within the app, the paywall (purchase screen) is not loaded locally from the app but is instead retrieved at runtime from RevenueCat’s servers. This allows the paywall to be updated without requiring an app update. As part of this retrieval, technical connection data is transmitted to RevenueCat, in particular:
- IP address – used by RevenueCat to determine the device country and not retained thereafter on a permanent basis
- Device information – device type, operating system version, app version
- Fonts – if custom fonts are used in the paywall, these are loaded from RevenueCat’s servers when the paywall is displayed, creating an additional network connection to RevenueCat
- Anonymous App User ID – used to associate the subscription status
If the user decides to make a purchase, the checkout process is routed through RevenueCat to the respective app store (Apple App Store or Google Play Store). The actual payment processing is carried out exclusively by Apple or Google; RevenueCat acts as a technical interface for forwarding and confirming the transaction.
| Purpose | Runtime retrieval of the paywall configuration; routing of the purchase process to the app stores |
|---|---|
| Data categories | IP address (temporary), device information, app version, anonymous App User ID; potentially a network connection for loading fonts |
| Recipients | RevenueCat, Inc. (data processor); Apple Inc. / Google LLC (payment processing, acting independently) |
| Legal basis | Art. 6(1)(b) GDPR (performance of contract; provision of the purchase process) |
| Privacy policy | revenuecat.com/privacy |
4.4 Speech Training – Microphone and Speech-to-Text
The app offers a pronunciation practice feature. This requires access to your device’s microphone. Speech recognition is carried out via the native speech-to-text functionality provided by Apple (iOS) or Google (Android). We do not operate any backend for this feature and do not receive any voice data.
Depending on your device, operating system version, and user settings, speech processing may occur entirely on your device (on-device) or partly on servers operated by Apple or Google. We have no visibility into or control over this processing. The privacy policies of Apple and Google apply (see Section 3).
Microphone access is only requested when you actively use the speech practice feature. You can revoke microphone permission at any time in your device’s system settings. If you do so, the speech practice feature will be unavailable; all other app features remain fully functional.
| Purpose | Pronunciation checking within the speech training feature |
|---|---|
| Data categories | Voice recording (microphone data), transcription of speech |
| Processed by | Apple Inc. / Google LLC (native OS function; acting independently) |
| Legal basis | Art. 6(1)(a) GDPR (consent via granting microphone permission); § 25(1) TDDDG |
| Withdrawal | At any time by revoking microphone permission in device settings |
4.5 Vocabulary Export
You can export your vocabulary set as a file. This file is generated locally on your device and made available to you directly. No data is transmitted to our systems; we do not provide any cloud synchronisation service. The exported file is entirely within your own control.
| Purpose | Providing your vocabulary data in a portable format |
|---|---|
| Data categories | Custom vocabulary and notes (locally stored) |
| Storage location | Exclusively on your device |
| Legal basis | Art. 6(1)(b) GDPR (performance of contract) |
| Third-party transfer | None |
4.6 Contact by Email (Support)
If you contact us by email, we store and process your email address and any other information you include in your message solely for the purpose of responding to your enquiry and providing support. We do not pass your data to third parties unless this is necessary to handle your request or required by law.
| Purpose | Handling support enquiries and general correspondence |
|---|---|
| Data categories | Email address, name (if provided), content of the enquiry |
| Retention period | Until the enquiry is fully resolved; where statutory retention obligations apply, up to 10 years (§ 257 HGB / § 147 AO) |
| Legal basis | Art. 6(1)(b) GDPR (pre-contractual / contractual request) or Art. 6(1)(f) GDPR (legitimate interest in providing support) |
| Third-party transfer | None |
4.7 Newsletter
Scope and Purpose of Processing
You may subscribe to our newsletter both within the App and on our website. Through it we inform you about App updates, new content, and offers. In order to register, we process your e-mail address. Any further information is provided voluntarily and is used solely for personalised communication.
Registration Using the Double Opt-In Procedure
Registration takes place using the double opt-in procedure. After you register, you will receive an e-mail at the address you provided asking you to confirm that you wish to receive the newsletter. Your e-mail address will only be added to our mailing list once you have confirmed via the link contained in that e-mail. If you do not confirm your registration, your entry will be automatically deleted after a reasonable period.
Demonstrating Consent
In order to demonstrate your consent, we document the time of registration and the time of your confirmation. This documentation serves to fulfil our accountability obligation.
Legal Basis
The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 7(2) No. 2 of the German Act Against Unfair Competition (UWG). The legal basis for documenting the registration process is our legitimate interest in being able to demonstrate the consent granted, pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 5(2) GDPR.
Withdrawal and Unsubscribing
You may withdraw your consent at any time with effect for the future and unsubscribe from the newsletter. To do so, simply send a message to kontakt@rnext-it.de or use the unsubscribe link contained in every newsletter. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.
Storage Period
Your e-mail address is stored for the duration of your newsletter subscription and deleted once the subscription ends.
Dispatch Service Provider
We use the service Brevo to send our newsletter. The data you provide upon registration is transmitted to Brevo and stored and processed there on our behalf. Brevo acts as a processor on our behalf; we have concluded a data processing agreement with Brevo pursuant to Art. 28 GDPR. Newsletter data is processed on servers located within the European Union.
Where Brevo engages sub-processors whose processing takes place in a third country outside the European Union, such transfers are carried out on the basis of an adequacy decision of the European Commission or on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Further information is available in Brevo’s privacy policy at https://www.brevo.com/de/legal/privacypolicy/
4.8 Analysis of App Usage
Purpose of Processing
Within the App we use the analytics service Umami in order to evaluate how the App is used. This evaluation serves exclusively to improve the App and covers in particular the following use cases:
- determining which features and content of the App are used, how frequently, and which are barely used at all,
- understanding typical usage sequences within the App in order to simplify user guidance,
- identifying points at which usage is frequently discontinued, in order to draw conclusions about technical or content-related causes,
- assessing how newly provided content and features are received,
- evaluating the frequency and duration of use in order to tailor the scope and frequency of our content accordingly,
- obtaining an overview of the device types and operating system versions in use so that we can reliably provide the App on the devices actually being used.
No evaluation of the individual usage behaviour of specific persons takes place, no profiles are created, and the data is not used for advertising purposes.
Consent Prior to Processing
Usage analysis is only activated after you have expressly consented to it via the corresponding notice in the App. If you do not give your consent, no usage analysis takes place; all other functions of the App remain available to you without restriction.
Storage of an Identifier on Your Device
Once you have given your consent, a randomly generated identifier (UUID) is stored permanently on your device so that recurring usage can be attributed to one another. The identifier contains no information that directly identifies you. However, because it is stored permanently and recorded usage events are aggregated under it, it constitutes a pseudonym within the meaning of Art. 4(5) GDPR. It is not combined with any other data processed by us, nor is it used to recognise you across different providers.
Scope of Processing
Usage analysis processes in particular the identifier stored on your device, the time and duration of use, the App views accessed and the events triggered, the type and version of your device and operating system, screen resolution and language setting, and the country of origin derived from the IP address. Your IP address is used exclusively to derive the country of origin and is not stored.
Legal Basis
The storage of the identifier on your device and any access to it take place exclusively on the basis of your consent pursuant to Section 25(1) of the German Digital Services Data Protection Act (TDDDG). The legal basis for the subsequent processing of the data collected in this way is your consent pursuant to Art. 6(1)(a) GDPR.
Withdrawal of Your Consent
You may withdraw your consent at any time with effect for the future. To do so, please use the privacy settings in the App. Following withdrawal, usage analysis will cease and the identifier stored on your device will be deleted. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.
Processor
The service is provided by Umami Software, Inc., San Francisco, California, USA. Umami acts as a processor on our behalf; we have concluded a data processing agreement with Umami pursuant to Art. 28 GDPR. Analytics data is processed in a hosting region within the European Union.
As the provider is a US company, access from the United States cannot be ruled out in every case. For such cases, we have agreed standard contractual clauses pursuant to Art. 46(2)(c) GDPR in order to ensure an adequate level of data protection. We note that US authorities may demand access to data on the basis of US legislation and that legal protection fully equivalent to European standards cannot be guaranteed in every case in this respect. Further information is available at https://umami.is/privacy and at https://umami.is/dpa
Storage Period
The analytics data collected is deleted as soon as it is no longer required for the evaluation purposes set out above. The identifier stored on your device remains there until you withdraw your consent, uninstall the App, or reset the application data.
5. Recipients of Personal Data
In the course of using the app, data may be transmitted to the following external parties:
- Apple Inc. – App Store, In-App Purchase, potentially Speech-to-Text (Privacy Policy)
- Google LLC – Play Store, In-App Purchase, potentially Speech-to-Text (Privacy Policy)
- RevenueCat, Inc. – Subscription management as data processor pursuant to Art. 28 GDPR (Privacy Policy)
- Umami, Inc. – Analytics services as data processor pursuant to Art. 28 GDPR (Privacy Policy)
- Brevo – Newsletter services as data processor pursuant to Art. 28 GDPR (Privacy Policy)
Apple, Google, RevenueCat, and Umami are based in the United States. Data transfers are made on the basis of appropriate safeguards pursuant to Art. 46 GDPR (Standard Contractual Clauses adopted by the European Commission). Data is only transmitted to public authorities where we are legally required to do so (Art. 6(1)(c) GDPR). All other data remains on your device.
6. Data Retention
- Local app data: Remains on your device until you uninstall the app or delete it manually.
- RevenueCat data: Retained in accordance with RevenueCat’s privacy policy. Upon request, we will assist you in exercising your right to erasure.
- Email correspondence: Deleted after the enquiry is fully resolved, subject to any applicable statutory retention obligations (§ 257 HGB, § 147 AO: up to 10 years).
7. Your Rights as a Data Subject
Where the respective conditions are met, you have the following rights:
- Right of access (Art. 15 GDPR): You may request information about which personal data we process about you, for what purpose, and who the recipients are.
- Right to rectification (Art. 16 GDPR): You may request the correction of inaccurate or the completion of incomplete personal data.
- Right to erasure (Art. 17 GDPR): Subject to the statutory requirements, you may request deletion of your personal data, provided no retention obligations prevent this.
- Right to restriction of processing (Art. 18 GDPR): You may request that we restrict processing of your data, e.g. if you dispute its accuracy.
- Right to data portability (Art. 20 GDPR): You may request that we provide your data in a structured, machine-readable format or transmit it to another controller.
- Right to object (Art. 21 GDPR): You may object at any time to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation.
- Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent (e.g. microphone access), you may withdraw that consent at any time with future effect. The lawfulness of processing prior to withdrawal is not affected.
- Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority. The authority competent for us is:
Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de
To exercise your rights, please contact:
Rnext IT & Asset Management GmbH, Ringstraße 31, 76356 Weingarten (Baden), Germany
Email: kontakt@rnext-it.de | Phone: +49 (0) 7244 609085
8. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or manipulation. Since the app operates primarily on your device, a significant part of data security lies within your own responsibility – in particular securing your device with a PIN, screen lock, and keeping your operating system up to date.
9. Minors
The app is not directed at children under the age of 16. We do not knowingly collect personal data from persons under the age of 16. If we become aware that a person under 16 has transmitted personal data to us, we will delete that data without undue delay.
10. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy to reflect changes in applicable law, the features of the app, or our processing practices. For material changes, we will notify you through an appropriate channel (e.g. a notice within the app). The current version is always available within the app and on our website.
Last updated: September 2026