Privacy Policy

1. Who is responsible

The controller for personal data processed on this website is
NEXT DATA CONSULTING (ABN 41 448 410 750)
68 Ridge St, Merewether NSW 2291, Australia
Email: hello@speaka.app. See also our legal notice.

We apply the EU General Data Protection Regulation (GDPR) as our baseline standard for every user worldwide, and handle personal information in accordance with the Australian Privacy Principles.

2. What data we process

• Account data: your email address (when registering by email) or email, name and profile picture (when signing in with Google).
• Voice and conversation data: during a conversation your microphone audio is streamed in real time to Google (Gemini) and processed there to make the conversation possible. The app displays transcripts of the conversation.
• Learning and progress data: saved vocabulary, feedback on your speaking, completed scenes and a daily usage counter.
• Usage and session data: for every conversation we store server-side the time, duration, practised language, scene, level and your plan, plus technical connection-quality data (e.g. response and waiting times, disconnects, and your browser/device type — never conversation content), linked to your user ID, not your email — to enforce the usage limit, diagnose faults and statistically improve the service.
• Waitlist: if you join, your email and the time — so we can notify you at launch.
• Consent records: the time and version of the terms you accepted at registration and, where applicable, a redeemed access code (plan level).
• Subscription status: if you buy a plan, our payment provider Polar informs us of the subscription’s status (plan, trial/active/cancelled). We never receive or store payment details such as card numbers.
• Support messages: if you contact us through the in-app support form, we store your message, your account email and the time — to answer you and improve the service.
• Marketing preference: whether you have opted in to occasional product updates and learning tips (with time and version of your choice). We only send such emails with your consent, and you can withdraw it any time in Settings or via the unsubscribe link in any such email.
• Server logs: when you visit the site our host technically processes e.g. IP address, date/time, requested page and browser identifier (log files).

3. Purposes and legal bases

We process this data to provide the service (account, speaking practice, storing your progress) — legal basis: performance of the contract (Art. 6(1)(b) GDPR). Processing of microphone audio additionally rests on your consent (Art. 6(1)(a) GDPR), which you give by starting a conversation and can withdraw at any time by ending it. The waitlist rests on your consent (Art. 6(1)(a) GDPR); server logs and consent records rest on our legitimate interest in secure, demonstrably lawful operation (Art. 6(1)(f) in conjunction with Art. 7(1) GDPR). Usage and session data serve to enforce the usage limit (contract performance, Art. 6(1)(b) GDPR); their statistical analysis to improve the service rests on our legitimate interest (Art. 6(1)(f) GDPR). Billing-related data is processed to perform the subscription contract (Art. 6(1)(b) GDPR). Marketing emails are sent only with your consent (Art. 6(1)(a) GDPR; express consent under the Australian Spam Act 2003); support messages are processed to handle your request (Art. 6(1)(b)/(f) GDPR).

4. Withdrawing consent

You can withdraw any consent at any time with future effect (Art. 7(3) GDPR) — microphone audio by ending the conversation or revoking microphone permission in your browser; the waitlist by emailing the address above. The lawfulness of processing before withdrawal is unaffected.

5. Recipients / processors

We use the following service providers:

• Google (Firebase Authentication & Firestore database, and the Gemini API for speech processing). The database is located in the EU (europe region). On the paid tier of the Gemini API, Google does not use the content to train its models.
• Vercel (website hosting, including the server logs mentioned above).
• Polar (Polar Software, Inc., Dover, Delaware, USA) — reseller (merchant of record) and payment processor for paid subscriptions. When you buy, Polar processes your email, payment and billing data as an independent controller; Polar’s privacy policy additionally applies. We ourselves never receive or store payment details (no card numbers) — only the subscription status.

6. International transfers

We operate from Australia, our database is hosted in the EU, and Google and Vercel may process data in the USA. For users in the EU/UK this means personal data may be transferred outside the EEA/UK. Google and Vercel are certified under the EU-US Data Privacy Framework; for transfers to us in Australia and otherwise, we rely on the European Commission’s Standard Contractual Clauses and equivalent safeguards. You can request details of these safeguards using the contact address above.

7. Retention

Account, learning and progress data are stored until you delete your account. Usage and session data are kept only as long as needed for the purposes above and deleted at the latest with your account. Microphone audio is not permanently stored by us; on the paid tier Google may retain data briefly for abuse monitoring only. Server logs are deleted automatically by the host after a short period.

8. Your rights

You have the right of access, correction, erasure, restriction, data portability and objection. You can delete your account and all associated data yourself at any time via “Delete account” (in Settings while signed in). To exercise any right, an informal email to the address above is enough — we respond within 30 days.

You can also complain to a regulator: in Australia the Office of the Australian Information Commissioner (oaic.gov.au); in the UK the Information Commissioner’s Office (ico.org.uk); in the EU the data protection authority of your country of residence.

9. Cookies, local storage & analytics

We use only technically necessary local storage (e.g. to keep you signed in, remember your translation language and cache your progress) — this does not require consent under EU/UK ePrivacy rules. For reach measurement we use Vercel Web Analytics — a cookieless, privacy-friendly statistic from our host that collects aggregated metrics (page views, country of origin, device type) without cookies or cross-device tracking and builds no profiles identifiable to us (Art. 6(1)(f) GDPR, legitimate interest). There is no third-party advertising tracking — which is why the site needs no cookie banner.

10. Data security

All transmission is TLS-encrypted (HTTPS). Access to your data stored in Firestore is restricted to your own account by security rules.

11. No automated decision-making

No automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place. The AI outputs (conversation, feedback, level estimate) serve your learning only.

12. Users in California

We do not sell personal information, and we do not share it for cross-context behavioural advertising. You can exercise access and deletion rights as described in §8.

13. Minimum age

Use of the service is reserved for persons aged 16 or over; younger learners need the consent of a parent or guardian.

14. Changes

We amend this policy when the service or the legal situation changes. The version published here applies.