Privacy Policy

Effective October 25, 2026.

Working draft, to be reviewed by a lawyer before publication.

This policy explains what personal information Scalinata Software inc., a company of Quebec, Canada ("we", "us"), collects when you use Get Phrasal, why, who it is shared with, how long it is kept and how to exercise your rights. It supplements our terms of use. We write it to comply with the Quebec law on the protection of personal information in the private sector (Law 25) and, for people who live in the European Union, the GDPR.

1. What we do not do

We do not sell your information and we do not rent it out.
There is no advertising, no advertising tracker and no third-party audience analytics tool in Get Phrasal. The only exception: on the payment page, the script of our reseller Paddle.com (see the section on cookies).
We send no promotional e-mail and no newsletter: see section 3.
We make no decision about you based solely on automated processing. The choice of what is shown to you and the marking of your answers are teaching tools: they decide nothing about you outside the service and have no legal effect.

2. The information we collect

What you give us

Your e-mail address. If you sign in with Google, the name that service sends us is not kept.
Your password: it is never kept in clear text, only as a strong fingerprint (hash): we cannot read your password back, only check the one you type.
Your answers to the questions (the choice you make among the options), their results (right or wrong), your history and your learning statistics, as well as the list of the senses you set aside because you already know them.
The free access code you enter, if any.

What the service produces

The dates of your free trial and of your plan, and the state of your access.
The use of a free access code: which code, when, and the new end date of your access.
The version of the terms and of this policy that you accepted, the date of acceptance and, depending on how you signed up, a fingerprint of your IP address.
Your progress: the senses seen, the number of correct answers and your active days. There is no spaced repetition: the service computes no "mastery level" and no review due date.

What your browser sends

Information your browser sends automatically: its type (for example Chrome on Windows) and your IP address, which we keep only as a fingerprint (a value computed from the address with a secret key), never in clear text. This fingerprint remains personal information.
Technical usage events and the errors encountered.
The technical logs of our host and of our official reseller, Paddle.com, may contain the IP address.

What comes from a third party

If you sign in with Google: an identifier specific to that service and your e-mail address, as that service sends them to us. We do not keep the name it sends.
If you pay for a plan: the amount, the taxes, the date, the status and the order number that our official reseller, Paddle.com (Merchant of Record), sends us; we link to it the e-mail address of your account, which stays on that payment even if you later delete your account (see section 6). We never receive or keep your card number or your payment credentials (card, PayPal or other method offered by Paddle).

If your account is provided by an organization

A school, company or body may buy access to Get Phrasal for its members (the "organization members"). It is then responsible for the collection of the information of the people it enrolls and for the permission needed to do so; we act on its behalf to provide the service.

For an account with an e-mail address: the organization's e-mail address (never a personal address), a password (as a strong hash) and the name of the organization the account belongs to.
For an account without an e-mail address (for example a young student): a nickname or a number chosen by the organization, a sign-in username and a password (as a strong hash). Nothing else: no family name, no date of birth, no e-mail address or contact details of a parent.
For the organization itself: its name, its e-mail domains, the number of seats, the access end date, and the declaration it accepted (date and account of the organization administrator).

The organization administrator sees, where applicable, your progress (the number of senses seen, the number of correct answers and recent activity), never the detail of your answers.

3. Why we use it

To provide the service to you: create and secure your account, run the service (quizzes, marking, history, statistics and payment), manage your trial and your plan, write to you about your account (e-mail verification, password reset).
To reply to your messages.
To protect the service: limit abusive attempts, detect fraud, diagnose technical errors, enforce the single trial per person and the use of each free access code only once per account.
To comply with the law: our legal obligations (accounting and tax obligations, keeping payments and the address of the person who paid in order to answer a request or a dispute, proof of acceptance of the terms).

E-mails. We use your e-mail address only to send you service e-mails: confirming your address, creating, resetting or changing the password, notices about your access or plan, notices of suspension or reactivation of the account, notices of an account deletion request and of deletion, security or incident notices, and notices of changes to our terms or this policy. They are essential to the service and you cannot unsubscribe from them while you have an account. They are sent through our e-mail delivery provider, Resend.

If someone types your address to sign up without your consent, you receive a confirmation e-mail by mistake. You can then ask us to stop writing to you: we put your address on a do-not-send list (see section 6), and no account can be opened with it any more.

We send no promotions and no newsletters and we do not pass your address to third parties for them to do so. If this were to change, we would ask you first, with a separate checkbox and a simple way to unsubscribe.

Free access codes. A code entered at sign-up is kept on your account until your e-mail address is confirmed, then it is applied and erased from that place. We then keep the use of the code (which code, when, new access end date) to enforce the limit of one code per account. A code gives access time only: it has no link to your payment method.

Organization accounts. If your account is provided by an organization, the organization administrator sees your progress (see section 2). They see neither your password nor the detail of your answers. A notice ("Your organization can see your progress.") is shown in the service. For organization accounts with an e-mail address, we also send, as service e-mails: the address confirmation when the account is created, the invitation sent by the organization, and, to organization administrators only, a warning 30 days and then 7 days before the organization's access ends. An account without an e-mail address receives no e-mail, no notification, no advertising: for a lost password, the organization administrator generates a new temporary one that you must replace at your next sign-in.

Consent. We do not ask you for separate consent: your information is used to provide the service. If a processing activity ever required it, we would ask for a separate checkbox, and you could withdraw it. At sign-up, the checkbox is only used to accept the terms of use and this policy.

We use your information for no other purpose without informing you. For residents of the European Union, our legal bases are performance of the contract (providing the service), our legitimate interest (security, abuse prevention), our legal obligations and, where applicable, your consent.

4. Cookies

Get Phrasal uses only cookies that are strictly necessary for the service you ask for:

a session cookie: it keeps you signed in (30 days at most, 7 days without activity);
two security cookies against forged requests: they disappear when the browser is closed;
a language preference, which remembers whether you view the interface in English or in French;
only if you sign in with Google, a temporary cookie that protects the exchange with Google.

They are not used for advertising, tracking or audience measurement, and Get Phrasal loads no content from another site, with a single exception: the payment page, which loads the script of our reseller Paddle.com (Paddle.js) and displays its payment window. Paddle may use its own cookies and technologies there, needed for payment and fraud prevention, under its own privacy policy. The browser may also keep the site's static files (images, styles) in memory to make it faster; this memory contains no personal data. Because these cookies are essential to the service you ask for, they do not require consent; blocking them will prevent you from signing in.

5. Who we share it with

Only with providers that help us run Get Phrasal, and only for what they have to do:

a host (servers and database), whose data centers may be located in Canada or abroad;
a storage provider, separate from the host, which keeps our backup copies and whose servers may also be located in Canada or abroad;
an e-mail delivery provider, Resend, located outside Canada, to whom we entrust the delivery of our service messages: it receives the recipient's address and the content of the message, and may not use them for its own account;
Our official reseller, Paddle.com (Merchant of Record): it is the seller of your plan; it collects the payment, collects and remits the taxes, and receives the payment data you give it, as well as the e-mail address of your account, which we send it to pre-fill the payment page and send your receipt. It handles them under its own privacy policy, for which it is responsible;
Google, if you choose that sign-in method.

We may also disclose information if the law or a court order requires it, or to protect our rights against fraud. If the business were sold or merged, the information would follow, under the same commitments.

If your account is provided by an organization, the organization administrators see your progress (see section 2) and manage your account (creation, removal, temporary password for an account without an e-mail address). We give them access to no other information about you, and no organization sees another's accounts.

Only authorized staff of Scalinata Software inc. access the administration console and the data, which is protected by two separate passwords.

Where the data is processed

Your information, like its backup copies, is hosted with our providers, who may be located in Canada or abroad: it may therefore be processed outside Quebec and Canada. Some of our providers (Paddle.com, the official reseller that processes payment, the Google sign-in service if you choose it) and our e-mail delivery provider, Resend, located outside Canada, may process part of this information outside Quebec and Canada. We entrust it to them only with contractual protection commitments equivalent to those required by the applicable law.

6. How long we keep it

Information	Duration
Individual account (free trial or paid plan)	As long as you use it. The account is deleted 90 days after your last sign-in; if you have a paid plan, these 90 days are counted from the end of the paid period or your last sign-in, whichever is later. A paid plan in progress never causes this deletion. We send no e-mail before the deletion.
Account, answers and learning history	As long as your account exists; erased immediately when you delete your account, without delay or any possibility of recovering them.
Account of an organization member (including without an e-mail address)	Access is blocked as soon as the organization removes you or its access ends; the account and its data are erased 90 days later.
Organization invitation (single-use link)	7 days; only the fingerprint of the link is kept.
Account whose e-mail address was never confirmed	7 days after sign-up, erased automatically (most often, an address typed by mistake).
Sessions and security tokens	Until they expire, then erased at the latest 30 days later.
Event and error logs (IP address fingerprint, browser type)	90 days.
Log of service e-mails sent (fingerprint of the recipient's address, message type, date, fingerprint of the content: used to limit the number of e-mails sent to the same address)	7 days.
Administration audit log	1 year.
Free access code entered at sign-up, not yet applied	Until your e-mail address is confirmed (it is then applied and erased), or until the unconfirmed account is erased (7 days).
Use of a free access code (which code, when, new access end date)	With the account; it no longer identifies you once the account is deleted.
Payment records (amount, taxes, date and e-mail address of the person who paid)	Kept 6 years (the period required by accounting and tax law), even after your account is deleted. The e-mail address is used only to answer a request or a dispute about that payment; it is erased after 6 years.
Refunded customers (e-mail address, customer identifier at our reseller, refund date)	Kept 6 years after the refund, even if you close your account (see below), then erased.
Proof of acceptance of the terms	Kept in a non-identifying form after the account is deleted.
Fingerprint of your e-mail address (free trial already used) and identifiers banned for abuse	The address fingerprint is kept 12 months after the account is deleted, then erased: it is used so that the free trial is not offered twice. It is not the address itself, but it makes it possible to recognize that an address has already been used, and it remains personal information. Identifiers banned for abuse are kept as long as needed to prevent abuse.
Address on our do-not-send list	If you ask us to stop writing to you, or if an abusive sign-up uses your address, we put that address (or its domain) on a list: no e-mail is sent to it any more and no account can be opened with it. It is kept as long as needed to respect that request and prevent abuse, even without an account; you can ask us to remove it (section 11).

After a refund

When a refund is granted, we keep the following information, even if you close your account:

your e-mail address;
your customer identifier at our official reseller, Paddle.com;
the refund date.

This information is used only to prevent refund abuse: if you wish to buy again after a refund, we will ask you to contact us. It is never sold or shared, except with Paddle.com, our official reseller, for payment processing. It is kept for 6 years, then deleted.

When a refund is made, we also copy into the payment record a summary of your use (number of answers, of different senses and of completed quizzes, dates of first and last activity), without the content of your answers. It is used to respond to an abusive refund request or a dispute, and it is kept with the payment record, 6 years.

7. Your rights

You can ask for:

access to the information we hold about you, and a copy, including in a structured, commonly used format (portability: being able to take your data elsewhere);
correction of inaccurate information;
deletion of your information and your account;
to withdraw a consent given, where applicable, to restrict processing or to object to it, where the law provides for it.

From "My data" (account menu), you can delete your account yourself: it is then erased immediately and permanently. You can also erase your history while keeping your account, and close all your sessions ("Sign out everywhere"). When your trial or plan ends, your account stays open but limited: help, choosing a plan, "My data" (without changing the password) and sign-out remain available, but not study, set-aside senses or statistics.

If your account is provided by an organization, it is managed by that organization: you can contact the organization administrator, and there is no self-service deletion for this account.

The account's e-mail address cannot be changed: to use another one, create a new account.

For any request about your information, write to us with the subject "Privacy". We may ask you to confirm your identity, and we reply within 30 days. If you are not satisfied, you can file a complaint with the data protection authority of your region or country.

8. Security

We protect your information with measures suited to its sensitivity: encrypted connection (HTTPS), passwords kept as a strong hash and of at least 15 characters, session tokens kept as a fingerprint, protection against forged requests (anti-CSRF), access to data limited to what is strictly necessary. As no system is infallible, we keep a register of privacy incidents and, if an incident presents a risk of serious harm, we notify you and the competent authority.

9. Children and minors

Get Phrasal has no minimum age, but any minor (under 18, or below the age of majority in their country) uses it only with the permission of a parent or guardian (see the terms of use). This permission also covers the processing of their personal information, including for children under 14, for whom Quebec law (Law 25) requires the consent of the person with parental authority or the guardian, and elsewhere under local law. The parent or guardian can exercise all the rights described in section 7 on the child's behalf. We voluntarily collect nothing other than what is necessary for the service, and we delete a child's account at the request of a parent or guardian.

When an organization (a school, for example) enrolls minor students (under 18, or below the age of majority in their country), it is the organization that declares it holds the permission of the parent or guardian required by law (in Quebec, Law 25) and that is responsible for it: Scalinata Software inc. collects no consent in its place (see section 2). Accounts of young students may have no e-mail address and carry only a nickname or a number chosen by the organization (which we ask not to enter a first or family name); no e-mail, no notification, no advertising is ever sent to them. The parent or guardian contacts the organization, or us through the contact form on the scalinatasoftware.com site, to exercise their rights.

10. Changes to this policy

We may change it. For an important change, we notify you at least 30 days in advance by e-mail or by a notice in the service. The date at the top of the page shows the version in force.

11. Contact us

Scalinata Software inc., through the contact form on the scalinatasoftware.com site (subject "Privacy"). This form is unique: it is operated by the Scalinata Software inc. site (scalinatasoftware.com), not by Get Phrasal, which keeps no contact messages.

The person responsible for the protection of personal information at Scalinata Software inc. is the head of the company. You can reach them through the same contact form, with the subject "Privacy": they receive and handle your requests for access, correction and deletion and your questions about this policy.

Version v1