Privacy Policy

Last updated: September 27, 2026

This Privacy Policy explains how Mr Muffin collects, uses, shares, and protects your personal data when you use our English-language learning application, available online at mrmuffinapp.com.

We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) and applicable Romanian data protection law.

1. Data Controller

The data controller responsible for your personal data is:

IONESCU N.E. MIHAELA, Persoană Fizică Autorizată (PFA)
Registration number (CUI/CIF): 48214068
Registered address: Aleea Prislop, Nr. 11, Bl. 23, Sc. A, Et. 3, Ap. 16, Municipiul Ploiești, județul Prahova, Romania
Contact email: contact@mrmuffinapp.com or office@mrmuffinapp.com

For any privacy-related questions or requests, please contact us at the emails above.

2. What Data We Collect

2.1. Account data

You create and access your account through the sign-in options offered in the app (email and password, or Google, Facebook or Apple sign-in). Depending on the provider and your settings, we may receive your name, your email address, a unique account identifier and, where made available, a profile picture. We never receive or store your password with those providers.

2.2. Subscription and payment data

Payments are processed by Stripe, our third-party payment processor. We do not collect or store your full card number or other sensitive payment credentials — this information is collected and stored directly by Stripe. We may receive limited transaction information from Stripe (for example payment status, transaction date, subscription status and the last four digits of your card) in order to manage your access to premium features, provide billing support and keep the accounting records required by law.

2.3. Usage and learning data

lessons and exercises completed, answers, scores, streaks and progress;
saved words and your chosen native language;
time spent in the app and session frequency;
basic technical data such as browser or device type and diagnostic information.

2.4. Communications

If you contact us — by email or through the in-app support form — we collect the information you provide, such as your email address, the content of your message and any file you choose to attach.

2.5. What we do not collect

Voice recordings. The app plays the audio aloud so you can listen and repeat, but it does not record you and never asks for access to your microphone.
Location and contacts. The app does not access your device's location or your contacts.
Advertising identifiers. The app contains no advertising and no tracking SDKs, and we do not use your data to advertise to you on other apps or websites.

3. How We Use Your Data

to create and manage your account;
to provide, operate and personalize the lessons and features of the app;
to process and manage your subscription;
to track and display your learning progress and statistics;
to diagnose technical issues and maintain the security of the service;
to respond to your support requests;
to comply with legal obligations, including the tax and accounting records required of a PFA in Romania;
to send service-related communications, such as subscription confirmations or changes to these policies.

We do not sell your personal data, we do not display third-party advertising in the app, and we do not use your data for third-party advertising purposes.

4. Legal Basis for Processing (GDPR)

Performance of a contract — to create your account, provide the core functionality of the app and manage your subscription.
Consent — where required, for example for non-essential cookies or optional communications. You may withdraw consent at any time.
Legitimate interests — to improve the app and ensure its security, where this does not override your fundamental rights.
Legal obligation — to comply with applicable tax, accounting and regulatory requirements.

5. Sharing Your Data

We share personal data only with the following categories of recipients, and only to the extent necessary:

Google LLC — for sign-in authentication and for generating the spoken audio of the lessons.
Meta Platforms, Inc. and Apple Inc. — for sign-in authentication, if you choose to sign in with Facebook or Apple.
Stripe, Inc. — to process subscription payments and manage billing.
Hosting and infrastructure providers — including our application platform provider, which stores and processes app data on our behalf under a data processing agreement.
AI and speech service providers — OpenAI, Microsoft Azure and ElevenLabs — used to generate audio pronunciation, translations and exercise assistance within the app.
Legal and regulatory authorities — where required by law, court order, or to protect our legal rights.

We require all third parties who process data on our behalf to implement appropriate security and confidentiality measures.

6. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where this occurs, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the provider's participation in an approved data transfer framework, so that your data remains protected.

7. Data Retention

We retain your personal data for as long as your account is active, plus a reasonable period afterwards in order to comply with legal obligations (such as Romanian tax and accounting record retention requirements) or to resolve disputes. If you delete your account, we delete or anonymize your personal data within a reasonable timeframe, except where retention is legally required.

8. Children's Privacy

The app is not directed at children under 13, and we do not knowingly collect personal data from children under this age without appropriate parental consent. Users aged 13–16 may use the app only with the consent and involvement of a parent or legal guardian, consistent with our Terms & Conditions.

If you believe a child has provided us with personal data without appropriate consent, please contact us at contact@mrmuffinapp.com so that we can take appropriate action, including deletion of that data.

9. Your Rights (GDPR)

access the personal data we hold about you;
rectify inaccurate or incomplete data;
erase your data ("right to be forgotten"), subject to legal exceptions;
restrict or object to certain processing activities;
receive your data in a structured, commonly used format (data portability);
withdraw consent at any time, where processing is based on consent;
lodge a complaint with a supervisory authority. Our lead authority is the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro. You may also complain to the data protection authority of your own country of residence or workplace.

To exercise any of these rights, contact us at contact@mrmuffinapp.com. You can also delete your account and associated data directly from the My Account page in the app. We will respond within the timeframes required by applicable law.

10. Users Outside the EU/EEA

Mr Muffin is available worldwide. Our data is hosted in the European Union and, as a matter of policy, we apply the GDPR standard described above to all users, wherever they live. In addition, if the law of your country grants you further or different rights, you may exercise those rights by writing to contact@mrmuffinapp.com. The following clarifications apply to specific regions:

United Kingdom. We process UK users' data in accordance with the UK GDPR and the Data Protection Act 2018. You may complain to the Information Commissioner's Office (ICO), ico.org.uk.
Switzerland. Swiss users are protected by the Federal Act on Data Protection (FADP) and may contact the Federal Data Protection and Information Commissioner, edoeb.admin.ch.
California and other U.S. states. We do not sell or share your personal information for cross-context behavioural advertising, and we do not use sensitive personal information for purposes other than providing the service. California residents may exercise their rights to know, delete, correct and opt out under the CCPA/CPRA, and we will not discriminate against you for doing so. Residents of other U.S. states with comparable privacy laws have equivalent rights.
Brazil. Brazilian users have the rights provided by the LGPD (Lei Geral de Proteção de Dados) and may contact the ANPD, gov.br/anpd.
Canada. Canadian users have the rights provided by PIPEDA and may contact the Office of the Privacy Commissioner of Canada, priv.gc.ca.
Latin America. Users in Mexico, Argentina, Chile, Colombia, Peru, Uruguay and other countries in the region have the rights granted by their national data protection laws and may contact their respective supervisory authority.
Asia-Pacific. We respect the rights granted by the applicable local laws, including Japan (APPI), South Korea (PIPA), China (PIPL), Taiwan (PDPA), Hong Kong (PDPO), Singapore and Malaysia (PDPA), Thailand (PDPA), Indonesia (PDP Law), Vietnam (PDPD), the Philippines (Data Privacy Act), India (DPDP Act 2023), Australia (Privacy Act / Australian Privacy Principles) and New Zealand (Privacy Act 2020). You may exercise those rights by contacting us, and you may also complain to your national authority.
Middle East and Africa. Users in Turkey (KVKK), Israel, Saudi Arabia (PDPL), the United Arab Emirates, Nigeria (NDPA), Kenya, South Africa (POPIA) and other countries in these regions have the rights granted by their local law and may contact us or their national authority.
Anywhere else. If your country is not listed, you still benefit from the GDPR-level protections described in this policy, and you may exercise any additional local rights by writing to us.

Important notes for non-EU users. Mr Muffin is operated from Romania (European Union) and offered as an online service worldwide. We do not maintain local establishments, local representatives or local data storage in individual countries, and we do not comply with data-localisation requirements that would require storing data inside a specific country (for example mainland China). If your country's law prohibits the transfer of your personal data outside its borders, please do not use the App. Where your local law requires it, by creating an account and continuing to use the App you consent to the cross-border transfer of your data to the European Union and to our service providers described in Sections 5 and 6.

Languages. The App's interface supports translations into many native languages, but this Privacy Policy and our Terms & Conditions are provided in English, which is the authoritative version. Any translation is provided for convenience only; in case of discrepancy, the English text prevails, except where your local consumer-protection law requires otherwise. If you need help understanding this policy in your own language, contact us at contact@mrmuffinapp.com.

By using the App from outside the European Union, you understand that your personal data will be transferred to and processed in the European Union and in the countries where our service providers operate, under the safeguards described in Section 6.

11. Data Security

We implement reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, misuse or alteration. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Cookies

We use cookies and similar technologies for essential functionality such as keeping you signed in. Where required by law, we ask for your consent before placing non-essential cookies. See our Cookie Policy for details.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes in the app or by email and will update the "Last updated" date above. Continued use of the app after the changes take effect constitutes acceptance of the revised policy.

14. Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or your personal data, please contact: