Privacy Policy

Bella Ruso is an independent digital Russian-learning service operated from Spain. For the processing described here, Bella Ruso is the data controller. Contact us at privacy@bellaruso.com.

This policy applies to bellaruso.com, our learner accounts, games, competitions, support channels, and related services that link to it.

• Account data: email address, authentication identifiers, verification and security status.
• Google sign-in data: when you choose Google, Google may provide your name, email address, profile image, and a provider-specific account identifier. We do not receive your Google password.
• Invitation and access data: an inviter may give us your email address before you register. We record invitation status, validity dates, the issuing administrator, redemption method, access status and source, cohort membership, and access-event history.
• Promotion and benefit data: promotional code redemptions, campaign source, eligibility outcomes, associated tags, feature access, and entitlements such as premium access and their validity dates.
• Learner profile: preferred name, native country and language, interface language, learning level, profile image if supplied, accessibility/display preferences, and marketing choice.
• Learning activity: saved vocabulary, answers, game attempts, progress, scores, badges, recommendations, challenge participation, and leaderboard privacy choices.
• Content and communications: feedback, support reports, custom-game requests, and information you voluntarily submit.
• Technical data: IP address, device/browser information, timestamps, diagnostic logs, security events, and essential session identifiers. Aggregate traffic measurements may be collected when analytics is enabled.
• Bot-protection data: Cloudflare Turnstile may process IP address, browser and device signals, interaction data, and a short-lived verification token to distinguish people from abusive automated traffic.
• Transaction data: if paid features are introduced, purchase status and transaction references. Payment providers process full payment-card details; Bella Ruso does not intend to store them.

A Bella Ruso administrator or authorized team member may create an invitation for your email address. In that case, we receive the address from the inviter rather than directly from you. We use it only to prepare, deliver, secure, and administer the invitation; match it to the same verified address if you register; prevent duplicate or abusive access; and keep necessary accountability records.

We process pending invitation information for our legitimate interests in operating controlled access and preventing misuse. If you redeem an invitation, we process the resulting membership and access records to perform our contract with you. You are not required to register and may ask us to remove an unused invitation associated with your address.

• Provide authentication, maintain your profile, save progress, and deliver requested services under our contract with you.
• Personalize difficulty, recommendations, language, and accessibility settings with your consent or as part of the requested learning service.
• Protect accounts, prevent abuse, investigate failures, enforce rules, and maintain service integrity based on our legitimate interests and legal duties.
• Operate opt-in competitions and public leaderboards according to the visibility choices you select.
• Validate invitations and promotions, grant or remove platform access, assign cohorts, apply benefits, enforce limits, and maintain an auditable redemption history under our contract with you and our legitimate interests in fair, secure administration.
• Respond to support and legal requests and keep records required by law.
• Send optional news or offers only where you have consented; you may withdraw consent at any time.

We do not sell personal data. We do not use Google account data for advertising, credit decisions, or unrelated profiling. We request only the basic Google identity scopes needed to authenticate you.

Google sign-in is optional. Bella Ruso uses Google-provided identity data only to create or locate your account, display your chosen profile details, prevent duplicate profiles, and secure your session. Use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.

You may revoke Bella Ruso’s access from your Google Account permissions. Revocation stops future Google sign-in access but does not automatically erase the Bella Ruso account; request deletion as described below.

We disclose data only as necessary to operate the service, comply with law, protect people or the service, or complete a transaction you request. Current infrastructure categories include:

• Supabase: authentication, database, and file storage.
• Vercel: website hosting, delivery, security logs, and optional aggregate analytics.
• Google: optional Google authentication and linked Google services you intentionally open.
• Cloudflare: Turnstile bot and abuse protection on account authentication forms.
• Payment and email providers: only when those features are enabled or requested.

Providers act under their own terms and, where applicable, processor agreements. We may also disclose information during a lawful business reorganization, subject to confidentiality and applicable notice duties.

Our providers may process information outside Spain, the European Economic Area, the United Kingdom, or your home country. Where required, transfers rely on an adequacy decision, standard contractual clauses, or another lawful safeguard. You may contact us for information about safeguards relevant to your data.

• Account, profile, learning, cohort, and active entitlement data: retained while your account is active, then deleted or irreversibly anonymized within 90 days after a valid deletion request or account closure, unless an exception below applies.
• Pending invitations: retained until they are redeemed, revoked, or expire. An unused recipient email address is deleted or irreversibly anonymized within 12 months after revocation or expiry.
• Invitation and promotional redemption records: retained while the account or benefit remains active and for up to 24 months afterward to enforce one-use and eligibility limits, resolve disputes, and prevent abuse; identifying fields are then deleted or anonymized.
• Access and security events: retained for up to 24 months from the event, unless a longer period is reasonably required to investigate an active security incident, enforce a claim, or comply with law.
• Marketing consent records: retained while consent is active and for up to 24 months after withdrawal as evidence of the instruction and our compliance. Marketing messages stop after withdrawal is processed.
• Transactions and legal records: retained for the period required by tax, accounting, consumer-protection, or other applicable law, or while necessary for an active legal claim.

We review these periods at least annually. When a period ends, we delete the data, irreversibly anonymize it, or isolate only the minimum record still required by law. Encrypted backup copies are not restored for routine use and expire on the applicable provider backup cycle.

To delete your account or an unused invitation, email privacy@bellaruso.com. For an account request, write from the account address where possible; for an unused invitation, identify the invited address. We may verify identity before acting. We aim to complete valid requests within 30 days or the period required by applicable law and will explain any lawful retention exception.

Bella Ruso uses essential cookies and browser storage for authentication, security, language, theme, accessibility, and learning continuity. These are necessary to provide settings or services you request. Cloudflare Turnstile may store or access strictly necessary security information to verify a request and prevent abuse; its verification token is short-lived, while related security events follow the retention period stated above. If we introduce non-essential analytics or advertising technologies requiring consent, we will provide an appropriate consent choice before activating them.

Depending on where you live, you may request access, correction, deletion, portability, restriction, or objection; withdraw consent; or appeal/refuse certain processing. You will not be discriminated against for exercising applicable rights. We may request proportionate identity verification and may decline or limit requests only where law permits.

EEA users may complain to the Spanish Data Protection Agency (AEPD) or their local supervisory authority. UK users may contact the ICO. California and other US state residents may use the same contact channel for applicable access, correction, deletion, and opt-out rights. Bella Ruso does not sell or share personal information for cross-context behavioral advertising as those terms are defined by California law.

The service is not directed to children under 13. A person below 16—or the higher minimum age required where they live—may use an account only with authorization and supervision from a parent or legal guardian. If we learn that personal data was collected without required consent, we will take reasonable steps to delete it. Guardians may contact us.

We use access controls, encrypted transport, provider security features, and separation between public and authenticated data. No system is completely secure, so we cannot guarantee absolute security. Notify us promptly if you suspect unauthorized access.

The service may automatically recommend a game or difficulty based on profile and learning activity. These educational recommendations do not produce legal or similarly significant effects and can be changed through available profile controls.

We may update this policy when the service, providers, or law changes. We will publish the revised date and, when required, provide prominent notice or request renewed consent. Material changes do not apply retroactively where prohibited by law.