Privacy Policy — SpeakBritish

1. Who We Are

SpeakBritish is an online English education platform. This policy explains how we collect, use, and protect your personal data in compliance with the UK GDPR, EU GDPR, and Turkish KVKK (Kişisel Verilerin Korunması Kanunu).

2. Data We Collect

Account data: name, email address, password (hashed), age group, English level
Booking data: name, email, phone number, preferred schedule, messages
Voice recordings:when you use a speaking exercise or talk to an AI tutor, your device's microphone records what you say and we send that audio to Google (Gemini) to turn it into text. The microphone is only ever active while you are holding or have started a speaking task — never in the background. We keep the resulting text so your tutor and teacher can see how you are getting on; we do not keep the audio file after it has been transcribed.
Conversation transcripts: what you and the AI tutor say to each other, the corrections it offers, and how long you spoke for. This is what the progress report is built from.
Learning data: lesson progress, quiz scores, vocabulary review schedule, session attendance
Payment data: processed by Stripe — we never see or store your card number. For a free trial we may ask Stripe to place a temporary hold on your card. A hold is not a charge: no money leaves your account unless you book a lesson and do not attend it without telling us.
Technical data: IP address, browser type, device information (via server logs)

2a. Children

Our children's courses are bought and managed by a parent or guardian, and a child's account is created by them. Children's speaking exercises work the same way as everyone else's — the microphone records only during a task, the audio is transcribed and not kept, and the text is visible to the parent and the teacher. We do not show children advertising and we do not use their data to build profiles for marketing. A parent may ask us to delete a child's data at any time using the address below.

3. How We Use Your Data

To provide and personalise our education services
To process payments and manage bookings
To send transactional emails (booking confirmations, session reminders, password resets)
To track learning progress and provide appropriate lesson content
To improve our platform and services

4. Legal Basis (GDPR / KVKK)

Contract: processing necessary to deliver the service you signed up for
Consent: for marketing communications (you can opt out at any time)
Legitimate interest: to improve our service and prevent fraud

5. Data Sharing

We share data only with the services that make the product work:

Google (Gemini) — speech-to-text for your voice recordings, and the AI tutor's replies
ElevenLabs and Inworld — text-to-speech, so the tutors have a voice. They receive the text to be spoken, not your recordings.
Stripe — payment processing and card holds
Cal.com — trial lesson scheduling (name, email, chosen time)
Resend — transactional email delivery
Neon — database hosting (EU region)
Vercel — website hosting and media storage

We do not sell your data to third parties, and we do not use it for advertising.

6. Data Retention

We retain your data for as long as your account is active plus 12 months after deletion. Payment records are retained for 7 years as required by law.

7. Your Rights

Under GDPR and KVKK, you have the right to:

Access your personal data
Correct inaccurate data
Delete your account and data
Export your data in a portable format
Object to processing based on legitimate interest
Withdraw consent at any time

8. Children’s Data

For students under 18, accounts must be created with parental consent. Parents may access, modify, or delete their child’s data at any time by contacting us.

9. Security

We use industry-standard security measures including encrypted connections (HTTPS), hashed passwords (bcrypt), and secure session management. Payment data is handled entirely by Stripe’s PCI-compliant infrastructure.

10. Contact

For privacy-related requests, contact us at hello@speakbritish.org.