Privacy Policy
Last updated: [FOUNDER: publish date]
Mamagayo (“we”, “us”, “our”) is an AI-powered spoken-language tutoring service. This policy explains what personal data we collect, why, who we share it with, and what rights you have over it.
1. Who we are
Data controller: [FOUNDER: legal entity name — e.g. “Jane Doe, micro-entrepreneur, SIRET XXXXXXXXX”]
Registered address: [FOUNDER: address]
Contact for privacy requests: [FOUNDER: email, e.g. privacy@mamagayo.app]
If you are in the EU/EEA/UK/Switzerland, you have the right to lodge a complaint with your national data protection authority (in France: the CNIL, www.cnil.fr) in addition to contacting us directly.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Email address, authentication credentials | To create and secure your account |
| Profile data | Native/target language, CEFR level, learning goals, life situations | To personalize lessons |
| Conversation content | What you say and type during sessions, tutor responses, corrections, vocabulary flagged | This is the product — the tutor needs your speech/text to respond and to teach |
| Voice recordings — tutor | Audio of the tutor’s spoken replies | Playback, listening drills |
| Voice recordings — you | Audio of your spoken turns | Powers the “hear your progress” voice-comparison feature. Optional — turn this off any time in your profile; we stop recording new audio immediately, existing clips are deleted on request or full account deletion |
| Session summaries | Auto-generated takeaways, vocab learned, recurring error patterns, CEFR-level read | Lets the tutor remember your progress across sessions without replaying full history every time |
| Long-term learner profile | Vocabulary mastery, recurring grammar issues, strengths, and biographical facts you explicitly mention (e.g. your job, city, family situation, an upcoming appointment) | Personalizes future sessions and rehearsal/debrief prompts for real events you’ve told us about |
| Diary entries | Polished write-ups of “daily diary” mode sessions | A feature you use on purpose — this is content you asked us to help you write |
| Feedback | Thumbs up/down and optional comments | Product quality |
| Usage/quota data | Turns used this month, session counts | Enforcing your plan’s limits |
| Technical/analytics | Device/app version, session timing, feature usage, error events | Keeping the service working and improving it. We never send your conversation content, transcripts, or audio to our analytics tools — this is enforced by a filter in our own code, not just a policy promise |
We do not collect payment card details directly — a payment processor handles that (see §4).
3. Why we process your data (legal basis)
- Performance of a contract (GDPR Art. 6(1)(b)): account, profile, conversation content, session memory — we can’t provide the tutoring service without these.
- Consent (Art. 6(1)(a)): recording your own voice for the voice-comparison feature; lifecycle emails such as practice reminders and progress recaps (opt-in checkbox during onboarding — withdraw any time via the unsubscribe link in every email or the toggle in app settings).
- Legitimate interest (Art. 6(1)(f)): product analytics and error telemetry to keep the service reliable, balanced against your privacy (which is why we never send conversation content to analytics tools).
4. Who we share it with
We use a small number of service providers (“sub-processors”) to run Mamagayo. We never sell your personal data. For the full, maintained list of each provider, the learner data it receives, its processing region, and the transfer safeguard that applies, see our sub-processor list. The summary below covers the same providers.
| Provider | What they process | Where | Their commitments |
|---|---|---|---|
| Vercel (hosting) | All app traffic | Primarily US (see their DPA) | SOC 2 Type 2, encryption in transit/at rest, EU Standard Contractual Clauses for international transfer |
| Supabase (database, authentication, file storage) | Everything in §2 | [FOUNDER: confirm project region] | SOC 2 Type 2, ISO 27001 |
| Microsoft Azure (speech-to-text, text-to-speech, AI tutor responses) | Your spoken/written turns, generated tutor responses, voice audio | Azure region we operate in | Your prompts and completions are not used to train Microsoft’s or any third party’s AI models, and are not shared with the underlying AI provider outside Microsoft’s own infrastructure. A limited abuse-monitoring process may allow authorized reviewers to examine flagged content for policy violations |
| PostHog (product analytics) | Usage events only — never your conversation content, transcripts, or audio | EU or US depending on configuration | Participates in the EU-US Data Privacy Framework; does not use your data to train AI models; supports full data deletion on request |
| [FOUNDER: payment processor once chosen] | Billing/subscription data | — | — |
| Resend (email delivery) | Your email address and the emails we send you (practice reminders and progress recaps — these may include coarse stats like session counts and streaks, never your conversation content); delivery and click events | US (runs on AWS) | Data Processing Agreement with EU Standard Contractual Clauses; SOC 2 Type 2 |
We may also disclose data if required by law, to protect our rights, or in connection with a business transfer (merger/acquisition), in which case we’ll notify you.
5. International data transfers
Because some of our providers are US-based, your data may be processed outside the EU/EEA/UK/Switzerland. Where that happens, transfers are covered by Standard Contractual Clauses and/or the relevant Data Privacy Framework certifications, as detailed by each provider above.
6. How long we keep your data
- While your account is active: most of your data (profile, conversations, learner memory, diary entries) is retained so the tutor can remember you and so you can review your own history.
- Session summaries and biographical facts influence tutor prompts for a limited window (roughly 30-45 days, or until they’re superseded/marked resolved) but remain stored beyond that window until you delete your account — we don’t currently auto-delete them on a rolling basis.
- Internal error/performance logs: deleted automatically after 90 days.
- Duplicate-request safety records: deleted automatically after 24 hours.
- Account deletion: request deletion any time in your profile settings. We hold a 30-day grace period (in case you change your mind), then permanently delete every record we hold about you — profile, conversations, learner memory, diary entries, vocabulary data, feedback, voice recordings, and your analytics identity — across every system we use, including our AI/hosting/analytics providers where applicable.
7. Your rights
If GDPR or an equivalent law applies to you, you have the right to: access, correct, delete, export (portability), restrict, or object to our processing of your personal data, and to withdraw consent at any time where processing is based on consent. Contact us at [FOUNDER: privacy email] to exercise any of these. Deletion is also self-service in your account settings.
8. Children
Mamagayo is not directed at children under 16. We don’t knowingly collect data from children under that age. [FOUNDER: confirm target age policy and align with actual store-listing age rating.]
9. Security
We use industry-standard technical and organizational measures (encryption in transit and at rest, access controls, row-level security on every database table) to protect your data. No system is 100% secure; if a breach affecting you occurs, we will notify you and the relevant authority as required by law.
10. AI-generated content note
Your tutor’s responses are generated by a large language model. See our Terms of Service for what that means for accuracy and reliability — this policy covers data handling only.
11. Changes to this policy
We’ll update the “Last updated” date above and, for material changes, notify you in-app or by email before they take effect.
12. Contact
[FOUNDER: privacy email / postal address]