Privacy Policy & Data Protection

1 Overview & Data Controller

This Privacy Policy applies to all services, mobile applications (iOS, Android, Apple Watch), and web platforms operated by BellaSpeak Inc. ("BellaSpeak", "we", "us", or "our"). We act as the Data Controller responsible for your personal data under the General Data Protection Regulation (GDPR) and related international data protection laws.

Our mission is to help people achieve effortless conversational fluency without ever compromising their personal sovereignty, confidentiality, or digital dignity. We design our platforms with privacy-by-design principles from the ground up.

2 Information We Collect

We collect only the minimum necessary information required to provide an exceptional, personalized educational experience:

• Account Identification Data: When registering, we collect your display name, email address, password hash, and language preferences. If you authenticate via third-party providers (Apple, Google), we receive your authenticated token and associated verified email.
• Learning Progress & SRS Telemetry: To personalize review schedules, our Spaced Repetition System (SRS) records card interactions, quiz accuracy scores, lesson completion timestamps, and active engagement time.
• Device & Technical Telemetry: Operating system version, app build version, device model, crash analytics, and IP addresses are processed strictly for stability and platform security.

3 Microphone & Voice Data Policy

When you grant microphone permission, the app processes your audio stream either on-device or via secure, encrypted transient streams to compute acoustic phonetic scores. Your voice is never fed into public AI datasets, never used for commercial advertising, and never preserved on our permanent databases.

4 How We Use Your Information

All gathered data is applied strictly toward educational and operational purposes:

• Calculating precise Spaced Repetition (SRS) recall intervals to prevent vocabulary decay.
• Delivering targeted AI-assisted explanations (Explain My Error - EME) when a wrong answer is submitted.
• Managing subscription access, billing entitlements, and profile personalization.
• Monitoring system uptime, detecting abusive automated bots, and ensuring fast server response times.

5 Third-Party Processors & Services

We partner exclusively with enterprise-grade providers who maintain rigorous security certifications:

• Paddle: Serves as our Merchant of Record for web-based subscription checkouts, handling PCI-DSS Level 1 compliant payment processing. BellaSpeak never sees or stores full credit card details.
• Apple & Google: Facilitate in-app purchases and app distribution under their respective store privacy frameworks.
• Cloud Infrastructure: High-security isolated containers (PostgreSQL 17, Redis, RabbitMQ) hosted in SOC-2 compliant data centers.

6 Data Retention & Immediate Account Erasure

We retain learning data only as long as your account remains active. Under GDPR Article 17 (Right to Erasure), you have the absolute right to permanently delete your account and all associated data at any time.

7 Children's Privacy Protection

BellaSpeak is designed for general audiences and language learners. We strictly comply with the Children’s Online Privacy Protection Act (COPPA) and GDPR-K regulations. We do not knowingly collect personal identifiable information from children under 13 (or under 16 in certain EU jurisdictions) without verifiable parental consent.

8 Security Architecture & Encryption

We employ modern multi-layered security controls to protect your data against unauthorized access, alteration, or disclosure:

• Encryption in Transit: All web and mobile communications are enforced using modern TLS 1.3 encryption with strict HTTPS headers.
• Encryption at Rest: Database volumes and backups are encrypted using enterprise AES-256 protocols.
• Role-Based Access Control (RBAC): Internal staff access is isolated into strict content bundles with zero access to user payment credentials.

9 Your International Legal Rights

Depending on your location, you hold guaranteed statutory rights regarding your personal information:

• Right to Access: Request a full copy of all data records associated with your account.
• Right to Rectification: Correct any inaccurate or incomplete personal profile information.
• Right to Portability: Export your progress and account details in a machine-readable JSON format.
• Right to Restrict or Object: Opt-out of non-essential communications and processing activities.

10 Contact Our Privacy Team

If you have questions, data protection inquiries, or requests regarding this Privacy Policy, please contact our Data Protection Officer directly: