Revision 14 September 2026.
The controller is ILYA KHARYN, an individual using the Qellum brand. Address: ul. Długa 40/4, 41-506 Chorzów, Poland. For data enquiries, contact support@lexilex.com, +48 576 674 597 or in-app support.
Account operation, learning, purchases and support are based on the contract — GDPR Article 6(1)(b). Required accounting records are kept under the law — 6(1)(c). Protecting the service and legal claims is based on legitimate interests — 6(1)(f). Optional analytics and diagnostics require consent — 6(1)(a); you can change your choice in privacy settings without losing core features.
Providing data is voluntary, but a feature cannot work without the information it needs. Google/Apple sign-in supplies data within the permissions granted. Microphone and photos are used for the relevant features; device settings control permissions. Do not upload sensitive information about yourself or others’ confidential data.
Data for the relevant features are processed by:
Providers receive data needed for their function. Uploading learning material does not itself publish it in the shared catalogue. Authorised support personnel and public authorities may access data where legally justified. Stores are independently responsible for their processing. Monetisation transition notices are delivered in the app, without an email mailing.
Primary hosting is in the EU. Some providers and their contractors may process data outside the EEA, including in the United States and Zoho support access from India.
Covered transfers to certified Google entities in the United States use the EU–US Data Privacy Framework; other relevant transfers use Standard Contractual Clauses (SCCs). Google, Firebase and Gemini describe the applicable safeguards.
OpenAI Ireland provides for onward transfers under SCCs or an adequacy decision. RevenueCat, Voyage AI, AWS and Zoho provide for SCCs for relevant transfers. You may ask us for information about the safeguard applicable to your data and a copy.
The account, materials and progress are kept until the relevant data or account are deleted. Recognition source files are deleted when no longer needed for processing; saved materials remain in the account.
Logs and correspondence are kept while needed to resolve the issue, protect the service or handle claims. Necessary accounting records are retained for the statutory period; dispute evidence until the claim period or proceedings end. This does not justify keeping the entire account indefinitely. Backups are replaced within a limited cycle; erasure is reapplied after restoration.
Google Analytics retains event data for 2 months and user-level data for 14 months, with the latter period restarting on new activity. These periods do not cover standard aggregated reports. Crashlytics keeps crash information and identifiers for 90 days before starting deletion from live and backup systems.
Where GDPR conditions apply, you may access and obtain a copy of your data, correct, erase, restrict or port them, object to legitimate-interest processing and withdraw consent. Withdrawal does not affect the lawfulness of earlier processing.
Use support or the contact details above. Account deletion is also available in privacy settings. You do not need to give a reason; we may verify account ownership where needed. Data without a continuing lawful basis are erased without undue delay. If some records must remain, we explain why and for how long.
We inform you of action within one month. In legally permitted complex cases, the response period can be extended by two further months with an explanation during the first month. This is a response deadline, not one deadline for erasing every copy. You may complain to UODO or another competent authority where you live, work or believe an infringement occurred.
LexiLex is for users aged 18 and over. Tell us if a minor’s data have entered the service. AI assesses learning answers and selects learning activities; it is not used to make decisions with legal or similarly significant effects.
We apply safeguards appropriate to the processing risks. Personal-data breaches are handled under GDPR requirements.
We notify you in advance of material changes to processing. Any required new consent is requested separately. Earlier versions are preserved.
From 1 November 2026 in Polish time, we may show Google AdMob advertising in the free version. Google/AdMob receives data needed to serve and measure ads: IP address, app or device identifiers to the extent permitted by the system and selected mode, approximate location where inferred or used for advertising, ad impressions and interactions, and technical or diagnostic data. Purposes include ad delivery, frequency capping, measurement and ad security. Ads may be personalized, non-personalized or limited depending on available signals, region, device settings and the user’s choice; we do not promise that any particular mode will always be available.
Advertising processing is not enabled by accepting the Terms, acknowledging the notice, or consenting to analytics or diagnostics. It uses a separate choice and separate withdrawal through a Google-certified CMP/UMP where required. Data is shared with Google and its engaged providers under the selected mode and may be processed outside the EEA with applicable safeguards. We do not state a fixed Google retention period here: it depends on data type and Google settings; our advertising choices and consent records are kept only as needed to operate the feature, evidence the choice and comply with law, then deleted or anonymized.
Where the law requires consent for personalization, access to device data or storage of advertising signals, the legal basis is your consent (GDPR Article 6(1)(a)), which you may withdraw. For a non-personalized or limited mode lawfully available without that consent, the basis for the remaining delivery, frequency capping, aggregate measurement, fraud prevention and security processing is our and our partners’ legitimate interests in funding and protecting the free version (GDPR Article 6(1)(f)), unless the law requires consent. If the CMP/UMP and device settings do not confirm an available mode and legal basis, the app does not request ads.