1. Introduction
Vocairo ("we," "us," or "our") operates the Vocairo language learning platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
2. Information We Collect
Account Information
- Email address and password (or Google OAuth profile)
- Display name (if provided)
- Language preferences and learning goals
- Assessment results and proficiency level
Learning Data
- Exercise responses, scores, and session statistics
- Dictionary words and phrases you save
- AI Tutor conversation history
- Grammar progress and error patterns
- Text, books, subtitles and other material you import for learning
- Text you confirm and submit after a speaking exercise
The speaking recorder keeps its audio clip on your device for playback and does not upload that clip to Vocairo. If you separately enable browser speech recognition, the browser may send audio to its recognition service. Text you confirm and submit is processed as a learning answer.
Payment Information
Stripe processes payment details. Vocairo receives subscription status, payment references and billing information needed to manage your plan; it does not collect your full card number in its own forms.
Technical Data
- Browser type, operating system, and device information
- IP address and approximate location
- Pages visited, session duration, and interaction patterns
- Error logs and performance metrics
3. How We Use Your Information
- Provide and personalize the learning experience
- Track your progress and adapt exercise difficulty
- Generate AI-powered tutoring responses
- Process payments and manage subscriptions
- Send service-related communications
- Monitor and improve platform performance
- Detect and prevent fraud or abuse
4. Third-Party Services
We use the following third-party services that may process your data:
- Supabase — Authentication and database hosting
- Cloudflare R2 — Storage of imported books, videos, subtitles and related import objects
- Google — Sign-in when selected, Gemini AI processing and text-to-speech generation
- OpenAI — AI text processing and text-to-speech generation when this provider is selected
- DeepL and Google Translate — Translation of selected text and relevant context through the available translation provider
- DictionaryAPI.dev — Dictionary definitions for requested words
- Vercel and Railway — Hosting and delivery of the application and backend services
- Stripe — Payment processing and subscription management
- Sentry — Error monitoring and crash reporting
- PostHog — Product analytics (with cookie consent)
5. Data Storage and Security
We use HTTPS for the public service, authenticated sessions and access controls for account data. Supabase Auth handles password authentication. Hosting and processing locations depend on the service and provider configuration. No online service can guarantee absolute security. You can read more on our data security page.
6. Your Rights (GDPR)
If you are in the European Economic Area, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Request deletion of your data
- Restrict or object to processing
- Data portability (receive your data in a structured format)
- Withdraw consent for processing that relies on it, without affecting earlier lawful processing
- Lodge a complaint with your data protection authority
To exercise these rights, contact us at [email protected].
7. Cookies and Analytics
We use essential cookies for authentication and session management. Analytics cookies (PostHog) are only activated after you provide consent via our cookie banner. You can change your choice at any time on the cookie preferences page. Declining analytics does not prevent sign-in or learning.
8. Data Retention
Account and learning data support your ongoing use of the service. You can request account deletion in your profile or contact us about a specific record. Retention depends on the data category and purpose: providing your account, completing a request, protecting the service, resolving a dispute or meeting an applicable legal obligation. Payment records, operational logs and provider backups may have separate retention requirements. Contact us for information about your request and any records that must be retained.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. We will explain relevant changes before new processing begins. Updating this notice does not replace consent when separate consent is required.
10. Contact Us
If you have questions about this Privacy Policy, contact us at: [email protected]