Privacy Policy

Last updated: 14 October 2026

This policy explains what personal data Fluensay processes when you use the website fluensay.com, the web app and the Fluensay iOS app, why, and what rights you have. In short: we use your data only to run your language practice, we keep your data in the EU wherever possible, we never sell it, there is no advertising and no tracking, and your voice recordings are not stored.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

[to be added]
[to be added]
Email: support@fluensay.com

For anything about your data, write to support@fluensay.com. We have not appointed a data protection officer, as we are not required to.

2. What we process, and why

Your account

Name, email address, password (stored only as a salted scrypt hash, never in plain text), whether you confirmed your email, the language you learn and your native language, your level, whether you want practice tips by email, and when you accepted these terms. If you sign in with Google, we receive your name, email address and a Google account ID from Google.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). Practice tips by email are only sent if you opt in (consent, Art. 6(1)(a) GDPR); you can withdraw that at any time.

Your practice

Your pronunciation attempts and scores, the text the speech recognition heard, words that were hard for you, your conversations with the AI partners (your transcribed lines and the replies), grammar and vocabulary you practise, placement results, your streak and weekly reports. We need this to score you, show your progress and choose what you practise next.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Your voice

When you hold the microphone button, the app records audio and sends it over an encrypted connection to Azure AI Speech (Microsoft, data centre in Sweden) to recognise what you said and score your pronunciation. The recording is processed and then discarded: neither we nor Microsoft store it. Your voice is not used to identify you, and we do not analyse emotions. The app only accesses the microphone after you allow it in your device settings.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) — scoring your speech is the service.

AI features

Conversation replies, coaching feedback and weekly reports are written by an AI model from OpenAI. For this we send OpenAI the practice content needed for the answer: the sentence, what was recognised, your scores and the conversation so far. We do not send your name, email address or account ID. More on how we use AI: How Fluensay uses AI.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Emails

We send emails to confirm your address and to reset your password, from support@fluensay.com through Microsoft 365. When you write to us, we use your message and address to answer you.

Legal basis: Art. 6(1)(b) GDPR; for enquiries also our legitimate interest in answering them (Art. 6(1)(f) GDPR).

Technical data and security

Our servers log each request (IP address, time, address requested, browser/app version, status code) to keep the service secure and fix errors. We limit how often certain functions can be used to prevent abuse.

Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

Cookies and local storage

We only use cookies that are strictly necessary: a session cookie that keeps you signed in, and cookies that protect sign-in forms against forgery. The app stores your sign-in and a few settings on your device. We use no analytics, advertising or tracking cookies, so we do not ask for cookie consent (§ 25(2) TDDDG). Fonts are served from our own server.

3. Who receives data

We use these service providers, bound by data processing agreements (Art. 28 GDPR):

• Microsoft Ireland Operations Limited (Ireland) — hosting, database and logs in Microsoft Azure data centres in Ireland and Sweden; Azure AI Speech (Sweden) for speech recognition, pronunciation scoring and the voices; Microsoft 365 for sending emails. Microsoft processes this data within the EU (EU Data Boundary).
• OpenAI (OpenAI Ireland Ltd., Ireland, and OpenAI, L.L.C., USA) — writing conversation replies, feedback and weekly reports. OpenAI does not use this data to train its models and keeps it for at most 30 days to detect abuse. The data is processed in the USA; see section 4.

Independent controllers you choose to use:

• Google (Google Ireland Limited) — only if you choose "Continue with Google". Google's own privacy policy applies to that sign-in.
• Apple — if you download the iOS app (App Store, TestFlight). Apple's privacy policy applies.

We do not sell your data and do not pass it to anyone else, unless we are legally obliged to.

4. Data outside the EU

Only the AI features involve a transfer outside the EU, to OpenAI in the USA. It is based on the EU adequacy decision for the EU-U.S. Data Privacy Framework where OpenAI is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in OpenAI's data processing addendum. Everything else stays in the EU.

5. How long we keep data

• Account and practice data: until you delete your account. Deleting it removes your data from our database at once; encrypted database backups expire after 7 days.
• Voice recordings: not stored.
• Server logs: 3 days. Monitoring logs: at most 30 days.
• OpenAI: at most 30 days (abuse monitoring), not used for training.
• Support emails: as long as needed to answer you, then deleted, unless the law requires us to keep them longer.

6. Your rights

You have the right to:

• access the data we hold about you and get a copy (Art. 15 GDPR) — also in a machine-readable format (Art. 20);
• have wrong data corrected (Art. 16) and your data deleted (Art. 17) — you can delete your account yourself in the app under Profile;
• restrict processing (Art. 18);
• object to processing based on legitimate interests (Art. 21);
• withdraw a consent at any time, with effect for the future (Art. 7(3)) — e.g. for practice tips by email;
• complain to a data protection supervisory authority (Art. 77), for example the one where you live.

Write to support@fluensay.com; we answer within one month.

7. Do you have to provide data?

An email address and password (or a Google sign-in) are needed for an account; pronunciation scoring needs the microphone. Without them we cannot provide those parts of the service. There is no automated decision with legal or similarly significant effect on you (Art. 22 GDPR): scores and feedback are practice aids only.

8. Age

Fluensay is for people aged 16 and over.

9. Security

All connections are encrypted (HTTPS/TLS). Data is encrypted at rest in Azure, secrets are kept in Azure Key Vault, access to the database is restricted, and passwords are only stored as hashes.

10. Changes

We update this policy when the service changes. The date at the top shows the current version; for material changes we will tell you in the app or by email.