Privacy Policy

1. Who we are

KodaLang ("we", "us") provides an AI-powered English coaching service at kodalang.com. For any privacy question — access, correction, deletion, or a complaint — contact us at the email shown at the bottom of this page. We act as the data controller for your account and learning data under the EU General Data Protection Regulation (GDPR).

2. What we collect

• Account data: your name, email address, and password (stored only as a secure hash by our authentication provider — we never see your password).
• Learning data: your CEFR level, goals, practice history, XP, streaks, vocabulary, quiz and exercise results.
• Voice recordings and your Accent DNA profile: when you practise speaking, we record your voice to analyse pronunciation at the phoneme level and build your persistent phonetic profile ("Accent DNA"). Voice is biometric data, so we ask for your explicit consent before the first recording, and you can withdraw it at any time.
• Payment data: subscriptions are processed by Stripe. We receive confirmation of your plan and billing status, but never your card number.
• Technical data: device type, app version, and error logs we need to keep the service running.

3. Why we use it (legal bases)

• Contract: providing the coaching service you signed up for (account, learning history, subscriptions).
• Consent: processing your voice recordings and building your Accent DNA profile. You give this consent separately during signup and can withdraw it anytime in Settings — withdrawal stops future voice processing immediately.
• Legitimate interest: keeping the service secure, preventing abuse, and measuring aggregated usage to improve the product.

4. AI transparency

In line with the EU AI Act (Article 50), we disclose clearly: you are interacting with an AI system, not a human teacher. Prompts sent to our AI providers are stripped of directly identifying information first, and our speech-to-text provider is instructed not to retain your audio after transcription.

5. Who we share data with

We do not sell your personal data. We share the minimum necessary with:

• Supabase — hosts our database (PostgreSQL) and authentication in the EU region.
• Stripe — processes subscription payments (PCI-DSS compliant).
• OpenAI and ElevenLabs — provide the conversational AI, speech recognition and voice synthesis. They receive anonymised prompts and audio, never your account identity.

6. How long we keep it

Your account and learning data are kept while your account is active. Voice recordings are kept only as long as needed to give you pronunciation feedback and maintain your Accent DNA profile. When you delete your account, your learning data, voice recordings and phonetic profile are permanently deleted, and a deletion request is queued for your login itself.

7. Your rights (GDPR)

You have the right to:

• Access — get a copy of your data (Settings → Export my data gives you a JSON download instantly).
• Rectification — correct inaccurate data in Settings or by email.
• Erasure — delete your account and data in Settings → Delete account.
• Portability — receive your data in a machine-readable format (the same export).
• Withdraw consent — stop voice processing at any time, without affecting past lawful processing.
• Object or restrict processing in certain situations, and to lodge a complaint with your national data-protection authority (in France: the CNIL).

8. Minors

In France, you may create a KodaLang account on your own from age 16. If you are under 16, a parent or legal guardian must create the account for you and give explicit consent before any voice data is collected. We block voice features until that consent is recorded.

9. Voice cloning consent

Any feature that models or reproduces your own voice (for example, playing back a corrected version of your pronunciation in a voice resembling yours) requires a separate, explicit consent — it is never bundled into the general terms. You can revoke it at any time, and revocation immediately deletes the associated voice model.

10. Cookies

We use strictly necessary cookies and local storage to keep you signed in and remember your theme and preferences. We also use Google Analytics 4 to measure aggregated usage (pages visited, session length). Google may set its own cookies (such as _ga) and process truncated IP addresses on our behalf under Google's data-processing terms. We use no advertising cookies and no cross-site trackers. A cookie-consent banner for EU visitors is on our roadmap; until then you can opt out of analytics at any time with a browser add-on such as Google's own Analytics Opt-out.

11. Changes to this policy

If we change this policy in a way that affects your rights, we will notify you in the app or by email before the change takes effect. The "last updated" date at the top always shows the current version.