Privacy Policy

Account & profile data: your email address, a hashed password (or, if you sign in with Google, your Google account email and basic profile), and the preferences you set — target language, level, interface language, daily goal, optional display name and profile picture.

Learning data: your lesson attempts, phase progress, XP, level, streaks, collected vocabulary (your word vault), and the pronunciation, fluency and grammar scores generated as you practise.

Voice & conversation data:during a spoken practice session your microphone audio is streamed in real time to our speech providers to transcribe what you say, assess your pronunciation, and generate the coach’s replies. We store the resulting transcripts and scores so we can show your feedback and track progress; we do not retain the raw audio stream after processing.

Payment data: your subscription status and plan. Card details are entered directly with our payment processor (Stripe) and are never seen or stored by us.

Technical & usage data: logs, usage counters and rate-limit signals (including your IP address for the anonymous preview and abuse prevention) needed to run the Service, meter your plan, and keep it secure.

Under the GDPR we rely on the following legal bases (Art. 6 GDPR):

Performance of a contract — to create and run your account, deliver the coaching experience, show your feedback and progress, and process your subscription.

Legitimate interests — to keep the Service secure, prevent abuse, enforce fair-use limits and cost controls, and improve the product. We balance these against your rights.

Consent — to access your microphone for spoken practice (you can decline or revoke browser permission at any time). Where consent is the basis, you may withdraw it without affecting prior processing.

Legal obligation — to keep records required by tax and accounting law for payments.

We do not use your data for advertising, and we do not sell it.

We share the minimum necessary with the service providers (“processors”) that make Parlo work, each under a data-processing agreement and only for the purposes below:

Supabase — database, authentication and file storage. Deepgram — speech-to-text. Microsoft Azure — pronunciation assessment. Anthropic— the coach’s replies and grammar feedback. Cartesia — text-to-speech. Upstash — rate limiting and usage metering. Stripe — payments. Vercel and Fly.io — hosting. Sentry — error monitoring. Google — optional sign-in. PostHog — product analytics (latency and usage), where enabled.

We do not sell your personal data or share it with advertisers.

Some processors are located outside the EU/EEA (for example in the United States). Where data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the providers’ own compliance frameworks, so your data keeps an equivalent level of protection.

We keep your account and learning data for as long as your account is active. Short-lived operational data (rate-limit counters, usage meters, one-time tickets) expires automatically within hours to a couple of months. Payment records are retained as required by law. When you delete your account, your personal data is erased as described below.

Subject to applicable law, you have the right to:

Access a copy of your data; rectify inaccurate data; erase your data; restrict or object to certain processing; port your data; and withdraw consent at any time.

You can delete your account and all associated data yourself at any time from Profile → Delete account. This permanently erases your profile, learning data, voice transcripts and scores, and cancels any active subscription — it cannot be undone.

To exercise any other right, email us at supportparlo@gmail.com. You also have the right to complain to a data-protection supervisory authority.

We protect your data with encryption in transit, row-level access controls so you can only reach your own records, server-side secrets that are never exposed to the browser, and rate limiting against abuse. No system is perfectly secure, but we take reasonable measures appropriate to the risk.

We use strictly necessary cookies and browser storage to keep you signed in, remember your preferences, and (for the anonymous preview) track your free-minute allowance. We do not use advertising or cross-site tracking cookies.

Parlo is not directed at children under 16. If you are younger, please use Parlo only with the consent of a parent or legal guardian, as required where you live. We do not knowingly collect data from children without such consent.

We may update this policy; we will post the new date above and, for material changes, notify you in the app or by email. Continuing to use Parlo after an update means you accept the revised policy.

Questions or requests about your data? Email supportparlo@gmail.com. Controller: Petr Vitula, Bezručova 923, 667 01 Židlochovice, Czech Republic.