Privacy policy

Marta, trading as Cá Se Fala, based in sul de Portugal, sul de Portugal, Portugal, is the data controller. You can reach her at ola@casefala.pt or by WhatsApp message on +351 210 000 000.

You do not need an account to read this site, take the level test or use the free tools. If you create one, these are the things the site keeps, and why:

• Your name and e-mail address — to log you in and so Marta knows whose account is whose.
• Your password, as a bcrypt hash — a one-way scramble. Nobody, including Marta, can read your password from it.
• When you signed up and accepted this policy, and when you were last active.
• The bundles unlocked for you — which ones, when, who unlocked them and, if Marta adds one, a short note (for example how you paid). No card or bank details are ever stored here.
• Your progress — the lessons you marked as done (and when), and the last lesson you opened, so the site can take you back to it.
• Your notes on each lesson — only you and the site see them.
• Your level-test result (level and score, not your answers), if you took the test while logged in or right before signing up.

The lawful basis is the contract with you (running the account you asked for) and your consent, which you give when you sign up. Marta can see your name, e-mail, bundles, progress and level result in her admin, to unlock bundles and help you; she cannot see your password or your notes there.

To stop people guessing passwords, the site also counts recent sign-in attempts. It keeps only a scrambled (hashed) key made from the connection address and e-mail, never the address itself. Counters older than a day are removed automatically the next time anyone signs in, signs up or sends a message on the site.

Account data lives in a PostgreSQL database run by Neon (neon.tech), in a data centre in the United States (AWS us-east-2, Ohio), in a section of the database used only by this site. The site itself is served by Vercel (vercel.com), which runs it on servers in the United States and elsewhere. Both act as processors on Marta’s behalf; data sent outside the European Economic Area relies on the safeguards in their data-processing terms (the European Commission’s standard contractual clauses).

Everything travels encrypted (HTTPS) and the database is only reachable with a secret key held by the site.

The site sets two cookies, and only when you log in:

• lpi_session — keeps you logged in for up to 30 days. It holds a random code, not your name or e-mail, and cannot be read by scripts on the page. Logging out deletes it and ends the session on the server.
• lpi_in — simply says “someone is logged in on this browser”, so the menu can show “My lessons”. It contains no personal data and gives no access to anything.

Both are strictly necessary for an account to work, so there is no cookie banner — there is no analytics, advertising or tracking cookie to consent to.

Two things stay in your own browser and never reach a server unless you act: the verb trainer’s score (local storage, with a Reset button), and a level-test result you have not saved yet (kept in the open tab only, so a sign-up right after can keep it).

• Contact form — your name, e-mail, optional level and topic, and your message go to Marta two ways: by e-mail through FormSubmit (formsubmit.co, a third-party forwarding service), and as a copy in her admin on this site, so no message is lost.
• “Send my result to Marta” on the level test — your name, e-mail, result and optional message are kept in her admin so she can answer.
• “Get this bundle” — when you are logged in, pressing it notes in her admin that you asked for that bundle (with your account name and e-mail), so she knows whose payment to expect. The message itself goes by WhatsApp or your own e-mail program, and you decide whether to send it.

Marta keeps these for as long as she needs them to answer you and to keep a record of your enquiry. Ask her to delete them and she will; deleting your account deletes them too.

Pages that show Marta’s YouTube videos display a still picture served by this site. Nothing is loaded from YouTube or Google until you press play; then the player loads from youtube-nocookie.com, Google’s privacy-enhanced embed, and Google’s privacy policy applies to what happens inside it.

Lesson videos inside your account work the same way: the lesson page shows a play button, and nothing is loaded from the video service until you press it. The video then plays either from YouTube (youtube-nocookie.com, as above) or from Bunny Stream (bunny.net, BunnyWay d.o.o., Slovenia) if Marta hosts the lesson there. The player only appears on lessons you have access to.

Log in, open Account settings and press Delete my account (you confirm with your password). It happens at once and removes your account, your sessions, your bundle access, your progress, your notes, your level-test result, and every message stored in Marta’s admin that is linked to your account or your e-mail address. It cannot be undone.

You can also simply ask Marta to do it for you. The database provider keeps a short rolling history for recovering from accidents; deleted data disappears from it on its own within days. Messages that reached Marta’s own e-mail or WhatsApp are hers to delete — ask her.

• Level test — your answers exist only in the open page. The result is kept only as described above.
• Sound trainer — the microphone is requested only when you press “record yourself”, and your browser asks your permission first. The recording stays in the page’s memory so you can play it back, is never uploaded, and is discarded when you leave. The “hear it” buttons use the voice already installed on your device.
• Verb trainer — the score counter lives in your browser’s local storage only.

Like every web server, the hosting provider records technical request data such as the IP address and the browser used, for security and to keep the service running. This site does not use that data for anything else.

Under the GDPR you may ask Marta for a copy of the personal data she holds about you, ask her to correct it or delete it, object to its use, or withdraw a consent you gave. Write to ola@casefala.pt. If you are not satisfied with the answer, you may complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD).

If this policy changes, the date at the top of the page changes with it.