Privacy Policy

1. Who is responsible

The controller for personal data processed on this website is
NEXT DATA CONSULTING (ABN 41 448 410 750)
68 Ridge St, Merewether NSW 2291, Australia
Email: hello@speaka.app. See also our legal notice.

We apply the EU General Data Protection Regulation (GDPR) as our baseline standard for every user worldwide, and handle personal information in accordance with the Australian Privacy Principles.

2. What data we process

• Account data: your email address (when registering by email) or email, name and profile picture (when signing in with Google).
• Data sent to a third-party AI service (Google Gemini): the conversation partner, your feedback, custom scenes and translations are generated by Google’s Gemini API (Google LLC). Only after you agree in the app’s permission prompt, the app sends Google: (a) your microphone audio, streamed in real time and only while a conversation is running; (b) the transcript of the conversation, to write your feedback; (c) text you enter or select — scene descriptions you type, lesson topics, and words or sentences you ask to translate; and (d) the practice context — the scene, the language you are learning, the language for explanations, and your level. Google processes this only to generate the reply, feedback, scene or translation and returns the result to the app. We do not record or store your voice audio. The app shows the transcript during the conversation.
• Learning and progress data: saved vocabulary, feedback on your speaking, completed scenes and a daily usage counter.
• Usage and session data: for every conversation we store server-side the time, duration, practised language, scene, level and your plan, plus technical connection-quality data (e.g. response and waiting times, disconnects, and your browser/device type — never conversation content), linked to your user ID, not your email — to enforce the usage limit, diagnose faults and statistically improve the service.
• Waitlist: if you join, your email and the time — so we can notify you at launch.
• Consent records: the time and version of the terms you accepted at registration and, where applicable, a redeemed access code (plan level).
• Subscription status: if you buy a plan, the store you bought it through — Polar on the web, Apple in the iOS app — informs us of the subscription’s status (plan, trial/active/cancelled). We never receive or store payment details such as card numbers.
• Support messages: if you contact us through the in-app support form, we store your message, your account email and the time — to answer you and improve the service.
• Marketing preference: whether you have opted in to occasional product updates and learning tips (with time and version of your choice). We only send such emails with your consent, and you can withdraw it any time in Settings or via the unsubscribe link in any such email.
• Server logs: when you visit the site our host technically processes e.g. IP address, date/time, requested page and browser identifier (log files).

3. Purposes and legal bases

We process this data to provide the service (account, speaking practice, storing your progress) — legal basis: performance of the contract (Art. 6(1)(b) GDPR). Sending your data to Google Gemini as described in section 2 additionally rests on your consent (Art. 6(1)(a) GDPR), which you give in the app’s permission prompt before your first conversation and can withdraw at any time in Settings. The waitlist rests on your consent (Art. 6(1)(a) GDPR); server logs and consent records rest on our legitimate interest in secure, demonstrably lawful operation (Art. 6(1)(f) in conjunction with Art. 7(1) GDPR). Usage and session data serve to enforce the usage limit (contract performance, Art. 6(1)(b) GDPR); their statistical analysis to improve the service rests on our legitimate interest (Art. 6(1)(f) GDPR). Billing-related data is processed to perform the subscription contract (Art. 6(1)(b) GDPR). Marketing emails are sent only with your consent (Art. 6(1)(a) GDPR; express consent under the Australian Spam Act 2003); support messages are processed to handle your request (Art. 6(1)(b)/(f) GDPR).

4. Withdrawing consent

You can withdraw any consent at any time with future effect (Art. 7(3) GDPR) — sharing with Google Gemini in Settings under “AI data sharing” (microphone access additionally in your browser or device settings); the waitlist by emailing the address above. The lawfulness of processing before withdrawal is unaffected.

5. Recipients / processors

We use the following service providers:

• Google (Firebase Authentication & Firestore database, and the Gemini API — a third-party AI service that generates the conversation partner’s replies, feedback, custom scenes and translations from the data listed in section 2). The database is located in the EU (europe region). On the paid tier of the Gemini API, Google does not use the content to train its models. Google processes this data on our behalf under its data processing terms, which provide the same or equal protection of your data as described in this policy.
• Apple (Apple Inc. and its affiliates) — seller and payment processor for subscriptions bought in the iOS app through In-App Purchase. Apple processes your Apple ID and payment data as an independent controller; we receive only a signed record of the subscription’s status, which we verify with Apple.
• Vercel (website hosting, including the server logs mentioned above).
• Polar (Polar Software, Inc., Dover, Delaware, USA) — reseller (merchant of record) and payment processor for paid subscriptions. When you buy, Polar processes your email, payment and billing data as an independent controller; Polar’s privacy policy additionally applies. We ourselves never receive or store payment details (no card numbers) — only the subscription status.

6. International transfers

We operate from Australia, our database is hosted in the EU, and Google and Vercel may process data in the USA. For users in the EU/UK this means personal data may be transferred outside the EEA/UK. Google and Vercel are certified under the EU-US Data Privacy Framework; for transfers to us in Australia and otherwise, we rely on the European Commission’s Standard Contractual Clauses and equivalent safeguards. You can request details of these safeguards using the contact address above.

7. Retention

Account, learning and progress data are stored until you delete your account. Usage and session data are kept only as long as needed for the purposes above and deleted at the latest with your account. Microphone audio is not permanently stored by us; on the paid tier Google may retain data briefly for abuse monitoring only. Server logs are deleted automatically by the host after a short period.

8. Your rights

You have the right of access, correction, erasure, restriction, data portability and objection. You can delete your account and all associated data yourself at any time via “Delete account” (in Settings while signed in). To exercise any right, an informal email to the address above is enough — we respond within 30 days.

You can also complain to a regulator: in Australia the Office of the Australian Information Commissioner (oaic.gov.au); in the UK the Information Commissioner’s Office (ico.org.uk); in the EU the data protection authority of your country of residence.

9. Cookies, local storage & analytics

We use only technically necessary local storage (e.g. to keep you signed in, remember your translation language and cache your progress) — this does not require consent under EU/UK ePrivacy rules. For reach measurement we use Vercel Web Analytics — a cookieless, privacy-friendly statistic from our host that collects aggregated metrics (page views, country of origin, device type) without cookies or cross-device tracking and builds no profiles identifiable to us (Art. 6(1)(f) GDPR, legitimate interest). There is no third-party advertising tracking — which is why the site needs no cookie banner.

10. Data security

All transmission is TLS-encrypted (HTTPS). Access to your data stored in Firestore is restricted to your own account by security rules.

11. No automated decision-making

No automated decision-making with legal effect within the meaning of Art. 22 GDPR takes place. The AI outputs (conversation, feedback, level estimate) serve your learning only.

12. Users in California

We do not sell personal information, and we do not share it for cross-context behavioural advertising. You can exercise access and deletion rights as described in §8.

13. Minimum age

Use of the service is reserved for persons aged 16 or over; younger learners need the consent of a parent or guardian.

14. Changes

We amend this policy when the service or the legal situation changes. The version published here applies.