1Who we are
Fluëntry is operated by Arena Capital Ltd, a limited liability company incorporated under the laws of Malta (form V89C) on 24 February 2021. Registered company number: C 98138. Maltese EU VAT number: MT 27961903.
Registered office: 58 Feng Shui, Triq il-Wejba, Swieqi SWQ2393, Malta.
Arena Capital Ltd is the data controller for all personal data processed via fluentry.be. For privacy enquiries, including how to exercise your rights under the GDPR, contact privacy@fluentry.be.
We have not designated a Data Protection Officer. Our scale and the nature of our processing do not require one under Article 37 of the GDPR. The privacy contact above is responsible for all data-protection matters.
2What this notice covers
This notice applies to personal data processed when you visit or use:
- fluentry.be and any sub-domain (for example, status.fluentry.be).
- Pillar 1 (Tests), our AI literacy assessment product, which is live.
- Pillar 2 (Academy), our future literacy-training product, which has been announced but not yet built. When Academy launches, a separate update to this notice will land at the same time.
This notice does not cover third-party websites we link to (for example, Lemon Squeezy's checkout pages), each of which has its own privacy notice.
3What personal data we collect
Identity and account
- Your email address (required to take a test and receive your score).
- An optional display name shown on your share card and in your account.
- Optional country, age band and role tag (for comparing you with other takers and to improve item targeting).
Test data
- Your responses to test items.
- Your computed scores, grade band, and percentile placement.
- Session metadata: timestamps, language and country, test type, item bank version.
Technical data (for security, anti-gaming, and operational logging)
- Your IP address: truncated to the /24 (IPv4) or /48 (IPv6) for analytics; full IP retained for up to 14 months for security and fraud investigation.
- User-agent and basic device fingerprint metadata. We do not use third-party fingerprinting libraries; the data we collect is what your browser sends naturally plus a small fingerprint hash we compute for anti-gaming clustering.
- Server logs: routine HTTP request logs.
Payment data
- We do not handle card details. Payments are processed by Lemon Squeezy as our merchant of record (see section 5).
- We receive from Lemon Squeezy: a customer reference, the entitlement state (whether you have an active subscription or one-off unlock), payment status, and a country code for VAT determination.
Communications
Messages you send us, including through the contact form at /contact (your name, email address, optional mobile number, the reason you choose and your message). The form sends us an email and stores nothing else; we use these details only to answer you. We retain support correspondence for the lifetime of your account plus 3 years.
Cookies and analytics events
See section 11 below.
4Why we process it (purpose and lawful basis)
Each processing activity has a defined purpose and a lawful basis under Article 6 of the GDPR.
| Purpose | Lawful basis | Data used |
|---|---|---|
| Run your test session and present your score | Performance of contract (Art 6(1)(b)) | Responses, scores, session metadata, email |
| Verify your email address via one-time code | Performance of contract (Art 6(1)(b)) | |
| Provide comparison with other takers, retakes and your language view | Performance of contract (Art 6(1)(b)) | Test data, country, language |
| Process payment and grant entitlements | Performance of contract (Art 6(1)(b)) | Lemon Squeezy customer reference, entitlement state |
| Prevent gaming, fraud, and abuse | Legitimate interest (Art 6(1)(f)) | IP, basic fingerprint, suspect flag, behavioural pattern |
| Operate and secure the service (logging, error tracking) | Legitimate interest (Art 6(1)(f)) | Server logs, IP, error stacks |
| Improve the item bank using aggregated, de-identified responses | Legitimate interest (Art 6(1)(f)) | De-identified responses (no email, no IP) |
| Product analytics and session replay | Consent (Art 6(1)(a), and Art 5(3) e-Privacy where applicable) | Behavioural events; PII-masked replay |
| Marketing emails (newsletter, product announcements) | Consent (Art 6(1)(a), opt-in) | Email, preferences |
| Comply with legal obligations (tax, accounting, lawful order) | Legal obligation (Art 6(1)(c)) | Whatever the obligation requires |
6International transfers
Our primary infrastructure is hosted inside the European Union, in Frankfurt, Germany:
- Database, authentication, and file storage: Supabase, Frankfurt region.
- Product analytics and session replay: PostHog EU Cloud, Frankfurt.
- Hosting and edge runtime: Vercel, EU regions.
- Transactional email: Resend, EU (Ireland) region.
Some processors are incorporated outside the European Economic Area (typically in the United States). Where personal data is transferred outside the EEA in the course of operating their services, the transfer is protected by Standard Contractual Clauses (SCCs) under Article 46(2)(c) of the GDPR, supplemented by additional safeguards where required by guidance from the European Data Protection Board.
Detail per subprocessor is maintained at /subprocessors.
7How long we keep it (retention)
| Category | Retention |
|---|---|
| Active account data | While the account is active. After 3 years of inactivity, we send a reminder, then delete or anonymise. |
| Test responses (linked to your account) | Same as account lifetime, then deleted on account deletion. |
| Test responses (aggregated, de-identified) | Indefinite; used for item-health analysis. |
| Payment records | 7 years from transaction date (Maltese accounting law). |
| Operational server logs | 90 days. |
| Security and fraud event logs | 14 months. |
| Database backups | 30 days, then automatically purged. |
| Email suppression list (bounces, complaints) | Retained while we operate the service, per ESP best practice. |
You may request earlier deletion at any time via section 9 below.
8Your rights
Under the GDPR (and where applicable, the UK GDPR) you have the following rights in respect of your personal data:
- Right of access (Art 15): obtain a copy of the personal data we hold about you.
- Right to rectification (Art 16): correct inaccurate or incomplete data.
- Right to erasure (Art 17): have your data deleted, subject to statutory exceptions (for example, tax records).
- Right to restriction (Art 18): pause our processing while a dispute is resolved.
- Right to portability (Art 20): receive your data in a portable, machine-readable format.
- Right to object (Art 21): object to processing based on legitimate interest, including profiling.
- Right to withdraw consent (Art 7(3)): for any processing based on consent. Withdrawing consent does not affect the lawfulness of processing already carried out.
- Right to lodge a complaint with a supervisory authority. The lead authority for Arena Capital Ltd is the Information and Data Protection Commissioner (IDPC) in Malta. You may also complain to the supervisory authority in your country of residence.
9How to exercise your rights
You can exercise the most common rights yourself, instantly, from /account/data: download a copy of your data, delete your account, and manage your consent. For any other right, or if you prefer, write to us at privacy@fluentry.be with what you want to do, and we will action it. You may also write by post to the registered office in section 1.
In-account self-service is live
The self-service portal at /account/data covers data export (access and portability), account deletion (erasure), and consent management. Rights not yet self-serviceable (restriction, objection, rectification) are handled by the privacy contact above, on the timelines below.
The most commonly exercised rights are:
- Access: receive a copy of the personal data we hold about you, including test responses, scores, and account metadata.
- Erasure: have your account and associated data permanently deleted, subject to the statutory exceptions in section 7 (notably tax records).
- Restriction: pause processing while a concern is being resolved.
- Objection: object to specific processing activities, including those based on legitimate interest.
- Portability: receive your data in a portable, machine-readable format (JSON export).
- Rectification: correct any data we hold that is inaccurate or incomplete.
- Withdrawing consent: for any processing based on consent (analytics, replay, marketing). You can manage consent at any time via /cookie-preferences.
We acknowledge requests within 5 working days and resolve them within the GDPR's statutory 30 calendar-day clock (extensible by 60 days for complex requests, with notice). There is no fee for the first request in a 12-month window; we reserve the right to charge a reasonable fee or refuse manifestly unfounded or excessive requests, as permitted by Article 12(5).
10Automated decision-making
We score your test responses using deterministic, transparent algorithms documented in our methodology note. This scoring is automated, but the result is informational only: it does not produce a legal effect or similarly significant effect on you within the meaning of Article 22 of the GDPR. You can retake tests freely, and the score does not gate access to any external system unless your employer has chosen to use Fluëntry for an internal literacy benchmark, in which case your employer is responsible for any further use.
We do not engage in profiling for advertising or third-party-facing use.
12AI-specific notes
Fluëntry exists to measure AI literacy. We are mindful that our users may be concerned about how their data is used in relation to AI systems. We commit to the following:
- We do not use your test responses to train any commercial large language model.
- We do not sell or share your responses with model developers.
- Some test items are AI-co-authored: written with the assistance of large language models and then reviewed and approved by humans before entering the bank. The proportion of AI-co-authored items per test type, and the human review process, are disclosed on the item-health page.
- OpenRouter, our AI model gateway, is used only at content-authoring time, for example to draft candidate items for human review. It does not see runtime user responses, scores, or account data.
- Our scoring algorithms are deterministic and documented in our methodology note. There is no opaque AI model in the scoring loop.
13Children
Fluëntry is intended for users aged 16 and over. We do not knowingly collect or process personal data from anyone under 16. Where local law sets a lower digital-services consent floor under Article 8 of the GDPR (which member states may set as low as 13), the local-law floor applies.
If we become aware that an account belongs to a user below the applicable minimum age, we will close the account and delete the associated data without delay.
14Pillar 2 (Academy) disclosure
We have publicly announced the future launch of an AI-literacy training product called Academy. Academy will run on the same platform, with the same data controller (Arena Capital Ltd), the same processors, and the same Frankfurt data residency.
Academy is not yet built. When it launches, this notice will be updated to disclose any new processing introduced by it (for example, course progress, lesson interactions, or accredited assessments). Existing Pillar 1 customers will be informed in advance.
15Changes to this notice
We may amend this notice from time to time. The Effective date shown at the top of this page indicates when it was last changed.
For material changes (those that affect your rights, expand the categories of data we process, or introduce new processors that handle identifiable personal data) we will notify active account holders by email at least 30 days before the change takes effect, where reasonably practicable.
16Status of this notice
Drafting status
This is a version 1 notice drafted internally and pending external counsel review. Counsel review will be reflected in a version 2 update. Where the substantive content of this notice and the eventual counsel-reviewed version diverge, the counsel-reviewed version will govern from the date of its publication forward; this version remains the binding notice for processing carried out between the effective date above and that publication.