TalkLoop Privacy and Cookies Policy

1. Data Controller

Controller: Vinnik Ireneusz Winnik, ul. Krótka 13, 47-180 Otmice, Poland, tax ID (NIP): 7532334372, REGON: 389808901, email: [email protected].

Data protection contact: the legal or support email provided by the controller.

2. Data We Process

• account data: email, user identifier, language settings, password hash where password login is used,
• learning data: CEFR level, goals, selected plans, topic preferences, progress, scores, language errors, saved vocabulary and exercise history,
• exercise content: speech transcripts, text answers, AI feedback, conversation scenarios and analysis results,
• audio or audio streams sent for speech recognition when you use microphone features,
• technical data: IP address, user agent, diagnostic events, error logs, cookies/localStorage identifiers,
• payment data: payment status, Stripe session identifiers, plan, amount and entitlement history; full card data is handled by Stripe.

Google or Facebook Sign-in

You can optionally sign in with Google or Facebook (Meta). The provider sends us your email address and basic profile details (an identifier and, if available, a name). We use the email address to create or link your account; Google must confirm that it is verified. We do not store the profile name, identifier or provider tokens on your account. We do not receive your password or access to posts and contacts. If a suitable email is unavailable, you can sign in with your email and a code.

Sign-in supports your account as part of contract performance. A short-lived sign-in security cookie expires after 10 minutes. Google and Meta handle sign-in under their own privacy policies. You can request deletion of your TalkLoop account and data at [email protected]; instructions are at /usuwanie-danych.

3. Purposes and Legal Bases

• contract performance - account, exercises, courses, payments, Plus access and certificates,
• legal obligations - accounting, taxes, complaints and consumer law obligations,
• legitimate interest - security, diagnostics, abuse prevention, product quality improvement and basic analytics,
• consent - marketing email, optional marketing/analytics cookies and other consent-based features where enabled.

4. Providers and Recipients

Data may be shared with providers needed to run the service: hosting and infrastructure, Stripe for payments, Resend or another email provider, Deepgram or another STT provider, OpenAI or another AI provider, TTS, push and diagnostics providers.

Providers receive data only to the extent needed to deliver the service, maintain security, process payments or communicate with users.

5. Transfers Outside the EEA

Some global providers may process data outside the European Economic Area. In such cases we use GDPR mechanisms such as standard contractual clauses or other available safeguards.

6. Retention

• account data - while the account exists and for the required legal/accounting period,
• payment and accounting data - for the period required by tax and accounting law,
• learning and progress data - while you use the service or until account deletion, subject to backups and legal obligations,
• technical logs - usually for a short period needed for diagnostics, security and abuse prevention,
• marketing data - until consent is withdrawn or an objection is made.

7. Your Rights

You have the right to access, correct, delete, restrict processing, port data, object to legitimate-interest processing and withdraw consent where processing is based on consent.

You also have the right to lodge a complaint with a data protection supervisory authority.

8. Cookies and localStorage

TalkLoop uses cookies and localStorage to maintain sessions, remember language, local user ID, app settings, security and basic analytics.

Optional analytics or marketing cookies, if introduced, will be used according to consent requirements and settings available in the app.

9. AI Decisions

AI feedback, speech scoring and recommendations are generated automatically but are educational support. We do not use them to make decisions producing legal effects for users.

10. Kids Course (Leo for Kids)

In the "Leo for Kids" course, audio is normally streamed to Deepgram for speech recognition. We set mip_opt_out=true for these requests: Deepgram does not retain the audio or transcript after processing or use them to improve its models. Technical request metadata and usage logs may be retained for up to 90 days. TalkLoop does not store the child's voice recordings.

If Deepgram is unavailable, the browser may perform speech recognition instead; its provider then processes audio under the browser's privacy terms.

If Leo speaks the child's name, text containing that name is sent to an external text-to-speech provider. By default the name is saved only on the parent or child's device, not in our database.

Lesson progress stays on the device by default (localStorage). If a parent creates an account, progress can also sync to that account - without storing the child's name in our database.

A parent can set a weekly plan (lesson days and time) and turn on email reminders sent on the planned days to the account address (plus a plan confirmation with a calendar link, a weekly summary of the child's progress and, once every four weeks, a link to a new printable calendar). The plan is then stored on the parent's account together with the topics the parent marked as already known by the child. We store the child's name on the account and use it in those reminders only if the parent ticks a separate consent on the plan page; the consent can be withdrawn there at any time, which deletes the name from our database. Reminders can be turned off on the plan page or via the link in every message.

The microphone test stores recognised text and test results locally on the device; the parent can clear that history on the test page.

Before the first use of the microphone in the course, we show the parent/guardian a consent screen. Without consent, the course works in touch-only mode, without the microphone.

We collect anonymous usage statistics for the course: which lessons are started and completed, and visits to the course pages, without voice recordings or data identifying the child.

A parent or guardian may request deletion of data related to the child's course at any time by writing to the contact address listed in section 1.