Privacy Policy

Last Update: 2026-08-30

Who we are

Leuven Language Buddies is a group of volunteers who help you with practicing your languages. This website is maintained by Ward Segers.

How you can contact us

You can contact us through the means on the contact page. We will get back to you as soon as possible.

Information we collect

If you come to our website and make an account:

Email address and a hashed version of your password so you can log in. If you set up a passkey or two-factor authentication (via an authenticator app or WebAuthn security key), we store what's needed to verify it, but never the underlying secret or biometric data itself.
If you subscribe to a language, we keep that preference (and whether you asked for email digests or just starred it) so we can inform you of new events.
If you submit or host an event, we link it to your account. Your account name is shown publicly next to events you host.
If you use our personal calendar (iCal) feed, we generate a private link for you. Anyone with that link can see the event feed it's tied to, so don't share it.

If you use our contact form, we forward your message and email address to our volunteer team's inboxes so we can reply. We don't store contact-form submissions in our database.

If you RSVP through Meetup or Facebook, their privacy policies might also apply.

Who we share information with

When an event is approved, we may cross-post it to our Discord server and Mastodon account, and submit it to the Whadup events platform, to help it reach more people. These posts include the event's public details (name, description, time, location, language). Discord and Mastodon posts also show the host's account name, but never their email address. Our Whadup submissions don't include any host or organizer information.

We use a small number of external services to help run this website, each of which processes data on our behalf under a data processing agreement (DPA) where applicable:

Hetzner — hosts our server (we have a signed DPA).
BunnyCDN — stores and serves uploaded images and static files (we have a signed DPA).
SendPulse — delivers the emails we send you (account emails, digests, notifications). DPA
Sentry — helps us catch and diagnose errors on the site (we have a signed DPA).

We don't sell your data, and we don't share it with anyone else beyond what's described above.

Cookies

We use a session cookie to keep you logged in, a security cookie (CSRF token) to protect your account from cross-site attacks, and a cookie to remember that you've dismissed our cookie banner. We don't use any analytics or advertising cookies.

Your rights

As we're in Europe, we fall under GDPR and you have all its rights granted:

The right to be informed.
The right to rectification. If you spot a mistake in the data we have on you, you may ask us to change it (or change it through our website).
The right of access. You can always ask us to provide you the data we have on you.
The right to be forgotten (erasure). You can ask us to delete all data we have related to you, or use the "delete account" option on your profile page. Note that events you've hosted or submitted stay on the site, but are no longer linked to your account.
The right to restrict the processing of your data. We don't use your data for insights/marketing, but if we did in the future, you could ask us not to.
The right to data portability. If you ask, we can provide the data we have on you in a machine-readable format.
The right to object. You may also ask us not to process your data. As we've mentioned above, you can always delete your data.
Rights regarding automated profiling and decision making, but this doesn't apply to LLB.

How to excercise your rights, ask questions or contact us

Changes

We might update this Privacy Policy from time to time. We'll keep the last updated date at the top. Check this document regularly to see whether it has been updated.