Privacy policy

Who we are

Brama (brama-app.com) is a service for preparing for Polish language exams. The controller responsible for your personal data is ADUSOLUTIONS LTD. For any question about this policy or your data, write to olga@ottio-ai.com.

What data we collect

• Account. Your email address and, if you give it, your name. Sign-in codes are sent to your email. If you sign in with Google, we receive the name, email address and profile picture Google shares with us.
• Practising without an account. When you start practising without signing up, we create an anonymous account so your progress is saved. It is kept on your device by a cookie. To keep free practice limits from resetting when cookies are cleared, we store a one-way code made from your IP address (never the address itself) with the anonymous account for up to 30 days.
• Your exam practice. Written answers, speaking recordings and their transcripts, scores, feedback, mistakes, saved words, and the exam and level you choose.
• Questions and messages. Your answers to onboarding questions (for example, which exam you are taking and when), optional survey answers, and messages you send through "Report a problem".
• Teacher codes. If you redeem a code from a teacher, that teacher can see your progress and scores in Brama.
• Payments. When paid plans are available, payments are processed by Stripe. We receive a confirmation and the amount, never your full card number.
• Usage and technical data. See "Analytics and cookies" below.

How we use your data, and on what basis

• To provide Brama: signing you in, grading your answers, giving feedback and saving your progress. Basis: performing our contract with you.
• To keep Brama secure and working: server logs and error reports, and preventing abuse of free practice limits. Basis: our legitimate interest in a reliable, secure service.
• To understand how Brama is used and improve it: analytics. Basis: your consent for analytics cookies and session recordings, and our legitimate interest for anonymous measurement that stores nothing on your device (described below).

We do not sell your data and do not use it for advertising.

AI grading

To grade your answers, we send your written answers, speaking recordings and transcripts to Google (Gemini API), and short excerpts of text to TypeSafe AI to classify corrections. They are sent only to produce your feedback.

Videos (YouTube)

Videos in Listening practice are played by YouTube (Google), embedded in our pages. When a lesson video loads, YouTube receives your IP address and browser details and may store its own cookies and similar data on your device, under Google's privacy policy. If you are signed in to YouTube, it may link what you watch to your YouTube account. We do not control these cookies; you can block them in your browser's settings for third-party cookies.

To show you only videos that play where you are, our server looks up the country of your IP address in a local copy of DB-IP's free database (IP geolocation by DB-IP, CC BY 4.0). The lookup runs on our server: your IP address is not sent anywhere for it and is not stored. If YouTube's player reports that a video can't be played for you, we note that for your account so the video no longer appears.

Analytics and cookies

We use PostHog (EU cloud) to understand how Brama is used.

• Before you choose: PostHog records page views, clicks and errors anonymously. Nothing is stored on your device, a new random ID is used on each visit, nothing is recorded as video, and nothing is linked to your account.
• If you accept: a PostHog cookie and local storage keep a consistent ID so we can see how Brama is used across visits. If you are signed in, it is linked to your account (user ID, email, role and plan). Sessions may be recorded so we can see where the app is confusing; text you type is masked and never recorded.
• If you reject: your browser sends nothing to PostHog.

Errors that happen on our server are reported to PostHog so we can fix them. They are linked to your PostHog ID only if you accepted analytics.

You can change your choice at any time with the button on this page.

Cookies and storage we use:

• Sign-in session cookie (necessary): keeps you signed in, or keeps your anonymous progress. Lasts up to 400 days for an anonymous account.
• Language cookie (necessary): remembers the language you chose.
• Your cookie choice (necessary, stored in your browser's local storage).
• PostHog cookie and local storage (analytics): only if you accept.
• YouTube cookies (set by YouTube): when a lesson video loads.

Who processes data for us

• Hetzner Online GmbH: our servers, in Helsinki, Finland. The app, the database and speaking recordings are stored here.
• Google (Gemini API): AI grading and feedback.
• TypeSafe AI: AI classification of corrections.
• Resend: sending sign-in emails.
• PostHog: analytics (EU cloud).
• Stripe: payments, when paid plans are available.

Some of these providers may process data outside the European Economic Area, for example in the United States. Where they do, the transfer relies on safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep your data

We keep your data for as long as your account exists. When you delete your account in your profile, we delete it together with your practice data, including speaking recordings. Data from an anonymous account is kept until you delete it or ask us to. Analytics data stored in PostHog can be deleted on request.

Your rights

Under the GDPR, you can ask us to give you a copy of your data, correct it, delete it, export it, restrict how we use it, or object to how we use it. You can withdraw your consent to analytics at any time; this does not affect anything done before you withdrew it. To use any of these rights, write to olga@ottio-ai.com. You can also delete your account yourself in your profile.

If you think we handle your data unlawfully, you can complain to the data protection authority in your country (in Poland, the President of the Personal Data Protection Office, UODO).

Changes to this policy

We may update this page from time to time. The date at the top shows when it last changed.