Privacy Policy

This Privacy Policy describes how Mando (“Mando”, “we”, “us”, or “our”) collects, uses, and discloses information about you when you use our website and Mandarin learning application (collectively, the “Service”). We are based in New York, New York, United States. By using the Service, you agree to the practices described in this Policy.

1. Information we collect

We collect the following categories of information:

• Account information. Your name and email address when you register. If you sign in with Google, we receive basic profile information (such as your name, email, and Google account identifier) from Google.
• Authentication data. A hashed version of your password and session and security tokens used to keep you signed in. We never store your password in plain text.
• Learning data. Your placement level, the lessons generated for you, the words and grammar you mark as known or for review, assessment activity, and your progress across HSK levels.
• Content you submit. Text you type into the assessment or the live tutor, and similar inputs used to deliver those features.
• Usage and device information. Technical information automatically collected when you use the Service, such as IP address, browser type, pages and features used, and timestamps, which we use to operate, secure, and improve the Service.
• Payment information. If and when paid plans become available, payments will be processed by a third-party payment processor. We do not collect or store your full payment card number.

2. How we collect information

• Directly from you, when you create an account or use the Service.
• Automatically, through your use of the Service and essential cookies.
• From third parties, such as Google when you choose to sign in with Google.

3. How we use information

• To provide, operate, and maintain the Service.
• To generate lessons at your level, read them aloud, and run the live tutor.
• To track your progress and personalize what you study next.
• To secure the Service, prevent abuse, and enforce our Terms.
• To communicate with you about your account and important changes.
• To comply with legal obligations and protect our rights.

4. AI providers and other service providers

To deliver core features we share limited information with trusted service providers who process it on our behalf, including: AI model providers (such as Google) to generate lessons and power the live tutor; a text-to-speech provider to produce lesson audio; cloud hosting and infrastructure providers; and, when paid plans launch, a payment processor. These providers are permitted to use the information only to provide services to us. We do not sell your personal information.

5. How we share information

We may disclose information:

• To service providers as described above.
• To comply with law, regulation, legal process, or a lawful government request, or to protect the rights, property, or safety of Mando, our users, or others.
• In connection with a merger, acquisition, financing, or sale of assets, in which case information may be transferred as a business asset, subject to this Policy.
• With your consent or at your direction.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to protect your account (for example, secure session and CSRF tokens). We do not use cookies for advertising. Because we rely on essential cookies, blocking them may prevent the Service from working.

7. Data retention

We retain your account and learning data for as long as your account is active. When you delete your account, we delete or de-identify your personal information from our active systems within a reasonable period, except where we are required or permitted by law to retain it.

8. Data security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including encrypted connections and hashed credentials. No system is completely secure, so we cannot guarantee absolute security.

9. International users

We are located in the United States and process information here. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

10. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information, and to object to or restrict certain processing. You can update or delete your account from your settings, or contact us using the details below. We will not discriminate against you for exercising these rights.

11. Your California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you certain rights. In the preceding 12 months we have collected the categories of personal information described in Section 1 (including identifiers, account and customer records, commercial information, and internet or other electronic network activity), for the business purposes described in this Policy.

You have the right to:

• Know and access the personal information we have collected about you.
• Request deletion of your personal information.
• Request correction of inaccurate personal information.
• Opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law.
• Not be discriminated against for exercising your rights.

To exercise these rights, contact us at the email below. We will verify your request before responding, and you may use an authorized agent where permitted by law.

12. Other U.S. state privacy rights

Residents of certain other states (such as Virginia, Colorado, Connecticut, and Utah) may have similar rights to access, correct, delete, and obtain a copy of their personal data, and to appeal a denied request. You may exercise these rights by contacting us as described below.

13. Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us and we will take appropriate steps to delete it.

14. Third-party links

The Service may link to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we encourage you to review their privacy policies.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice where appropriate. Your continued use of the Service after changes take effect means you accept the updated Policy.

16. Contact us

If you have questions about this Policy or your personal information, contact us at [email protected], or by mail to Mando, New York, New York, United States.