Privacy Policy
This policy explains what data we process, why we process it, and the choices you have.
1. Data Controller
- ITC GROUP (SASU)
- 12 avenue du Maréchal Maunoury, 94130 Nogent-sur-Marne, France
- hello@polyvoca.com
- hello@polyvoca.com
2. What data we collect
- Voice recordings: processed in real time via the OpenAI Whisper API for speech recognition. Not stored after the session unless you explicitly opt in.
- Email address: collected via newsletter signup only. Stored in Resend.
- Usage data: lesson progress, session duration, streak — stored in Supabase.
- Device info: OS version, app version — collected anonymously.
- Payment data: processed by Apple / Google / Stripe. Never stored by Polyvoca.
3. How we use it
App functionality (contract basis). To deliver core features (AI conversation practice, pronunciation feedback, progress tracking), and provide account-related services.
Newsletter (consent basis). To send product updates and learning content if you opted in, and to manage unsubscribes.
App improvement / analytics (legitimate interest). To understand what works, improve reliability and UX, and measure aggregated usage patterns.
Legal compliance (legal obligation). To comply with applicable laws, respond to lawful requests, and protect our rights and users.
4. Legal basis per GDPR Article 6
| Purpose | Legal basis | Retention |
|---|---|---|
| App functionality | Contract — Art. 6(1)(b) | See Section 7 |
| Newsletter | Consent — Art. 6(1)(a) | Until you unsubscribe |
| App improvement / analytics | Legitimate interests — Art. 6(1)(f) | See Section 7 |
| Legal compliance | Legal obligation — Art. 6(1)(c) | As required by law |
5. Third-party processors
| Name | Role | Country | Privacy policy |
|---|---|---|---|
| Supabase | Database | Ireland (EU) | https://supabase.com/privacy |
| Cloudflare | Hosting + analytics | USA (with SCCs) | https://www.cloudflare.com/privacypolicy/ |
| OpenAI | Voice processing | USA (with SCCs) | https://openai.com/privacy |
| Resend | USA (with SCCs) | https://resend.com/legal/privacy-policy | |
| Apple / Google / Stripe | Payments + distribution | See their policies | [À COMPLÉTER — liens vers les politiques Apple / Google / Stripe] |
6. International data transfers
Some processors are located in the United States. Where applicable, transfers rely on Standard Contractual Clauses (SCCs) and other safeguards.
You can request more information about safeguards by contacting us (see Section 13).
7. Data retention
| Data type | Retention period |
|---|---|
| Voice | 0 (real-time only) |
| Until unsubscribe | |
| Usage data | 3 years or until account deletion |
| Logs | 90 days |
8. Your rights (GDPR)
- Access
- Rectification
- Erasure
- Portability
- Objection
- Lodge a complaint with your supervisory authority
9. Children
The app is not directed at children under 13 (under 16 in the EU). We do not knowingly collect personal data from minors. If you believe a minor provided data to us, contact us and we will delete it.
10. Cookies & tracking
See our Cookie Policy at /legal/cookies. Currently:
- No advertising pixels are active.
- Cloudflare Web Analytics is cookieless.
11. Advertising pixels
Currently no advertising pixels are active. This section will be updated before any paid advertising campaign launches.
12. Changes
If we make material changes, we will notify you via the app or email (where appropriate).
13. Contact
Contact: hello@polyvoca.com — response within 30 days.
14. Last updated
May 5, 2026