1. Overview
DailyChinese Pro ("we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website and services.
We comply with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.
2. Data We Collect
2.1 Information You Provide
| Data Type | Examples | Required? |
|---|---|---|
| Account Data | Name, email, password (hashed) | Required |
| Payment Data | Handled by Stripe (we never see your card) | Required for subscriptions |
| Profile Data | Display name, avatar | Optional |
| Usage Data | Practice session bookings, lesson progress | Automatic |
| Communication | Support emails, feedback | Optional |
2.2 Automatically Collected
- Technical data: IP address, browser type, device info, operating system
- Usage data: Pages visited, time spent, features used, search queries
- Cookies: Authentication tokens, preferences, analytics
3. How We Use Your Data
- Provide the Service: Account management, content delivery, subscription processing
- Improve our Service: Analytics, performance monitoring, feature development
- Communication: Service announcements, payment confirmations, support
- Security: Fraud prevention, account protection, rate limiting
- Legal compliance: Tax records, law enforcement requests
4. Legal Basis (GDPR)
We process your personal data under the following legal bases:
- Contract: To provide the Service you subscribed to (Art. 6(1)(b))
- Consent: For marketing communications and non-essential cookies (Art. 6(1)(a))
- Legal obligation: Tax and billing records (Art. 6(1)(c))
- Legitimate interest: Security, fraud prevention, service improvement (Art. 6(1)(f))
5. Cookies & Tracking
| Cookie Type | Purpose | Duration |
|---|---|---|
| Authentication | Keeps you logged in | 30 days |
| Preferences | Dark mode, language settings | 1 year |
| Analytics | Page views, user behavior | 2 years |
| Marketing | Campaign tracking | 30 days |
You can manage cookies through our Cookie Consent banner. Essential cookies cannot be disabled as they are required for the Service to function.
6. Data Sharing
We do NOT sell your personal data. We share data only with:
- Stripe: Payment processing (PCI-DSS compliant)
- Cloud hosting: Server infrastructure (encrypted)
- Email service: Transactional emails
- Legal authorities: When required by law
We never share your data with advertisers, data brokers, or third-party marketers.
7. Data Storage & Security
- Passwords are hashed using bcrypt with 10+ rounds
- JWT tokens for session management with expiration
- HTTPS/TLS encryption for all data in transit
- Rate limiting and input validation on all API endpoints
- Security headers: HSTS, X-Frame-Options, CSP
- Regular security audits and vulnerability scanning
8. Your Rights
Under GDPR (EU/UK users):
- Access: Request a copy of your data
- Rectification: Correct inaccurate data
- Erasure: Request deletion ("right to be forgotten")
- Portability: Export your data in JSON format
- Objection: Object to certain processing
- Withdrawal: Revoke consent at any time
Under CCPA (California users):
- Know: What personal data we collect
- Delete: Request deletion of your data
- Opt-out: Of the sale of personal data (we don't sell data)
- Non-discrimination: Equal service regardless of rights exercised
9. Data Retention
- Account data: Retained while your account is active; deleted 30 days after account closure
- Payment records: Retained for 7 years for tax compliance
- Usage data: Aggregated and anonymized after 24 months
- Password reset tokens: Expire after 1 hour
- IP addresses: Deleted after 90 days unless needed for security
10. Children's Privacy
Our Service is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe we have collected data from a child, contact us immediately at privacy@dailychinese.pro.
11. International Data Transfers
Your data may be processed in countries outside your residence. We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) and only transfer data to countries with adequate data protection laws.
12. Contact Us
Data Protection Officer: dpo@dailychinese.pro
Mailing Address: DailyChinese Pro, Privacy Team
European Representative: Available upon request
If you have a complaint about our data practices, you can contact your local Data Protection Authority or the Information Commissioner's Office (ICO) at ico.org.uk.