1Who we are
Fluëntry is operated by Arena Capital Ltd, a limited liability company incorporated under the laws of Malta (form V89C) on 24 February 2021. Registered company number: C 98138. Maltese EU VAT number: MT 27961903.
Registered office: 58 Feng Shui, Triq il-Wejba, Swieqi SWQ2393, Malta.
Arena Capital Ltd is the data controller for all personal data processed via fluentry.be. For privacy enquiries, including how to exercise your rights under the GDPR, contact privacy@fluentry.be.
We have not designated a Data Protection Officer. Our scale and the nature of our processing do not require one under Article 37 of the GDPR. The privacy contact above is responsible for all data-protection matters.
2What this notice covers
This notice applies to personal data processed when you visit or use:
- fluentry.be and any sub-domain (for example, status.fluentry.be).
- Pillar 1 (Tests), our AI literacy assessment product, which is live.
- The Academy, our AI literacy courses, including teams and the AI features inside the courses, which is live.
This notice does not cover third-party websites we link to, each of which has its own privacy notice.
3What personal data we collect
Identity and account
- Your email address, when you create an account or ask us to email you your result. You need an account with a confirmed email address to take the courses.
- An optional display name shown on your share card and in your account.
- Optional country, age band and role tag (for comparing you with other takers and to improve item targeting).
Test data
- Your responses to test items.
- Your computed scores, grade band, and percentile placement.
- Session metadata: timestamps, language and country, test type, item bank version.
Academy data
- Which courses you start, your progress through each module and your answers to the checks inside a course.
- Your completions and certificates.
- Course feedback you choose to send.
- If you create or join a team: the team, your role in it and your membership. The team's owner and admins can see your name, email address and course progress.
Technical data (for security, anti-gaming, and operational logging)
- Your IP address: truncated to the /24 (IPv4) or /48 (IPv6) for analytics; full IP retained for up to 14 months for security and fraud investigation.
- User-agent and basic device fingerprint metadata. We do not use third-party fingerprinting libraries; the data we collect is what your browser sends naturally plus a small fingerprint hash we compute for anti-gaming clustering.
- Server logs: routine HTTP request logs.
Text you send to the AI features
See section 12 below.
Communications
Messages you send us, including through the contact form at /contact (your name, email address, optional mobile number, the reason you choose and your message). The form sends us an email and stores nothing else; we use these details only to answer you. We retain support correspondence for the lifetime of your account plus 3 years.
Cookies and analytics events
See section 11 below.
4Why we process it (purpose and lawful basis)
Each processing activity has a defined purpose and a lawful basis under Article 6 of the GDPR.
| Purpose | Lawful basis | Data used |
|---|---|---|
| Run your test session and present your score | Performance of contract (Art 6(1)(b)) | Responses, scores, session metadata, email |
| Verify your email address via one-time code | Performance of contract (Art 6(1)(b)) | |
| Provide comparison with other takers, retakes and your language view | Performance of contract (Art 6(1)(b)) | Test data, country, language |
| Provide the courses, keep your progress and issue certificates | Performance of contract (Art 6(1)(b)) | Academy data, email |
| Run the AI features in the courses | Performance of contract (Art 6(1)(b)) | The text described in section 12 |
| Run teams and show team owners and admins their members' progress | Performance of contract (Art 6(1)(b)) | Name, email, course progress |
| Prevent gaming, fraud, and abuse | Legitimate interest (Art 6(1)(f)) | IP, basic fingerprint, suspect flag, behavioural pattern |
| Operate and secure the service (logging, error tracking) | Legitimate interest (Art 6(1)(f)) | Server logs, IP, error stacks |
| Improve the item bank using aggregated, de-identified responses | Legitimate interest (Art 6(1)(f)) | De-identified responses (no email, no IP) |
| Product analytics and session replay | Consent (Art 6(1)(a), and Art 5(3) e-Privacy where applicable) | Behavioural events; PII-masked replay |
| Measure whether our adverts lead to sign-ups (Google Ads tag) | Consent (Art 6(1)(a), and Art 5(3) e-Privacy) | A conversion signal sent to Google, only if you accept Marketing cookies |
| Marketing emails (newsletter, product announcements) | Consent (Art 6(1)(a), opt-in) | Email, preferences |
| Comply with legal obligations (tax, accounting, lawful order) | Legal obligation (Art 6(1)(c)) | Whatever the obligation requires |
6International transfers
Our primary infrastructure is hosted inside the European Union, in Frankfurt, Germany:
- Database, authentication, and file storage: Supabase, Frankfurt region.
- Product analytics and session replay: PostHog EU Cloud, Frankfurt.
- Hosting and edge runtime: Vercel, EU regions.
- Transactional email: Resend, EU (Ireland) region.
Some processors are incorporated outside the European Economic Area (typically in the United States). Where personal data is transferred outside the EEA in the course of operating their services, the transfer is protected by Standard Contractual Clauses (SCCs) under Article 46(2)(c) of the GDPR, supplemented by additional safeguards where required by guidance from the European Data Protection Board.
Detail per subprocessor is maintained at /subprocessors.
7How long we keep it (retention)
| Category | Retention |
|---|---|
| Active account data | While the account is active. After 3 years of inactivity, we send a reminder, then delete or anonymise. |
| Test responses (linked to your account) | Same as account lifetime, then deleted on account deletion. |
| Test responses (aggregated, de-identified) | Indefinite; used for item-health analysis. |
| Course progress, completions and certificates | Same as account lifetime, then deleted on account deletion. If you were in a team, the team keeps an anonymous count that a person completed the course. |
| Text sent to the AI features | We do not store it. We keep a log of the time, the feature, the size and the cost of each exchange for 18 months. |
| Operational server logs | 90 days. |
| Security and fraud event logs | 14 months. |
| Database backups | 30 days, then automatically purged. |
| Email suppression list (bounces, complaints) | Retained while we operate the service, per ESP best practice. |
You may request earlier deletion at any time via section 9 below.
8Your rights
Under the GDPR (and where applicable, the UK GDPR) you have the following rights in respect of your personal data:
- Right of access (Art 15): obtain a copy of the personal data we hold about you.
- Right to rectification (Art 16): correct inaccurate or incomplete data.
- Right to erasure (Art 17): have your data deleted, subject to any statutory exceptions.
- Right to restriction (Art 18): pause our processing while a dispute is resolved.
- Right to portability (Art 20): receive your data in a portable, machine-readable format.
- Right to object (Art 21): object to processing based on legitimate interest, including profiling.
- Right to withdraw consent (Art 7(3)): for any processing based on consent. Withdrawing consent does not affect the lawfulness of processing already carried out.
- Right to lodge a complaint with a supervisory authority. The lead authority for Arena Capital Ltd is the Information and Data Protection Commissioner (IDPC) in Malta. You may also complain to the supervisory authority in your country of residence.
9How to exercise your rights
You can exercise the most common rights yourself, instantly, from /account/data: download a copy of your data, delete your account, and manage your consent. For any other right, or if you prefer, write to us at privacy@fluentry.be with what you want to do, and we will action it. You may also write by post to the registered office in section 1.
In-account self-service is live
The self-service portal at /account/data covers data export (access and portability), account deletion (erasure), and consent management. Rights not yet self-serviceable (restriction, objection, rectification) are handled by the privacy contact above, on the timelines below.
The most commonly exercised rights are:
- Access: receive a copy of the personal data we hold about you, including test responses, scores, and account metadata.
- Erasure: have your account and associated data permanently deleted, subject to any statutory exceptions.
- Restriction: pause processing while a concern is being resolved.
- Objection: object to specific processing activities, including those based on legitimate interest.
- Portability: receive your data in a portable, machine-readable format (JSON export).
- Rectification: correct any data we hold that is inaccurate or incomplete.
- Withdrawing consent: for any processing based on consent (analytics, replay, marketing). You can manage consent at any time via /cookie-preferences.
We acknowledge requests within 5 working days and resolve them within the GDPR's statutory 30 calendar-day clock (extensible by 60 days for complex requests, with notice). There is no fee for the first request in a 12-month window; we reserve the right to charge a reasonable fee or refuse manifestly unfounded or excessive requests, as permitted by Article 12(5).
10Automated decision-making
We score your test responses using deterministic, transparent algorithms documented in our methodology note. This scoring is automated, but the result is informational only: it does not produce a legal effect or similarly significant effect on you within the meaning of Article 22 of the GDPR. You can retake tests freely, and the score does not gate access to any external system unless your employer has chosen to use Fluëntry for an internal literacy benchmark, in which case your employer is responsible for any further use.
The AI features in the courses give explanations and feedback. They make no decision about you and do not affect your score, your progress or your certificates.
We do not engage in profiling for advertising or third-party-facing use.
12AI-specific notes
Fluëntry exists to measure AI literacy. We are mindful that our users may be concerned about how their data is used in relation to AI systems. We commit to the following:
- We do not use your test responses or your course activity to train any AI model.
- We do not sell your data.
- The courses include three AI features: Flo (the course companion), the tutor that explains an answer you got wrong and the practice sandbox. When you use them, text is sent to OpenRouter, our AI model gateway, which passes it to the model provider (Anthropic, at the date of this notice) to produce the reply. Both are in the United States.
- What is sent: your first name, where you are in your courses, your grade band and the areas your test showed as gaps, the content of the screen you are on, the answer you chose when you miss a check and anything you type or paste into Flo or the sandbox. Your email address is not sent.
- We do not store the text of these exchanges. A sandbox conversation is gone when you leave the screen. Our gateway account is set so that the providers we use may not train on this text; the model provider may keep it for a short period for safety monitoring under its own terms.
- Do not put confidential information or other people's personal data into the AI features.
- Your test responses and scores are never sent to OpenRouter. Scoring is deterministic and documented in our methodology note; there is no AI model in the scoring loop.
- Some test items are AI-co-authored: written with the assistance of large language models and then reviewed and approved by humans before entering the bank. The proportion of AI-co-authored items per test type, and the human review process, are disclosed on the item-health page.
13Children
Fluëntry is intended for users aged 16 and over. We do not knowingly collect or process personal data from anyone under 16. Where local law sets a lower digital-services consent floor under Article 8 of the GDPR (which member states may set as low as 13), the local-law floor applies.
If we become aware that an account belongs to a user below the applicable minimum age, we will close the account and delete the associated data without delay.
14The Academy
The Academy runs on the same platform as the tests, with the same data controller (Arena Capital Ltd), the same Frankfurt data residency and the processors listed in section 5. The data it adds is described in section 3, and the AI features in section 12.
15Changes to this notice
We may amend this notice from time to time. The Effective date shown at the top of this page indicates when it was last changed.
For material changes (those that affect your rights, expand the categories of data we process, or introduce new processors that handle identifiable personal data) we will notify active account holders by email at least 30 days before the change takes effect, where reasonably practicable.
16Status of this notice
Drafting status
This is a version 1 notice drafted internally and pending external counsel review. Counsel review will be reflected in a version 2 update. Where the substantive content of this notice and the eventual counsel-reviewed version diverge, the counsel-reviewed version will govern from the date of its publication forward; this version remains the binding notice for processing carried out between the effective date above and that publication.