Privacy Policy
Last updated: 2 November 2026
This policy explains what personal data Sprechly (sprechly.live, operated by Abdelmounim Moulim, Safi, Morocco) collects, why, and what your rights are. Contact: hello@sprechly.live.
1. What we collect
Account data — email address, password hash, chosen exam type, language preference.
Voice recordings — when you take a drill or mock exam, your microphone audio is recorded and streamed to our AI providers so the examiner can respond to you and so your performance can be scored. This is the core of the Service; it does not work without it. We ask for your explicit consent before your first recording.
Transcripts and scores — the written transcript of what you said, the AI's responses, your scores and feedback reports.
Usage and technical data — pages visited, mocks started and completed, device type, browser, approximate country (from IP address), error logs.
Payment data — handled entirely by our merchant of record, Paddle. We never see or store your card number. We receive from Paddle your email, country, the product bought, and the transaction status.
We do not knowingly collect data from anyone under 18.
2. Why we process it (legal bases)
| Purpose | Data | Basis |
|---|---|---|
| Running the mock exam and producing your score | voice, transcripts | performance of our contract with you |
| Showing you your history and progress | transcripts, scores | contract |
| Billing, invoices, fraud prevention | payment data via Paddle | contract, legal obligation |
| Improving our scoring prompts and task bank | anonymised transcripts and scores | legitimate interest (you can object, see §6) |
| Security, debugging | technical data | legitimate interest |
| Product emails (new features, tips) | consent — unsubscribe any time |
We do not sell your data, and we do not use your voice recordings to train AI models of our own or of third parties beyond the processing needed to deliver the Service.
3. Who we share it with (processors)
- Google (Gemini API) — real-time speech and language processing during the exam, and scoring. Google's API terms state that paid-tier API data is not used to train Google models.
- Microsoft Azure (Speech Services) — pronunciation assessment.
- OpenAI — may be used as an alternative speech/scoring provider.
- Supabase — database and authentication.
- Cloudflare — DNS, security, and storage of audio files.
- Vercel — hosting.
- Paddle.com Market Ltd — merchant of record and payment processor (acts as an independent controller for billing data; see paddle.com/legal/privacy).
- Email delivery provider — transactional emails.
These providers are located in or transfer data to the United States and the European Union under standard contractual clauses or equivalent safeguards.
4. How long we keep it
- Voice recordings: deleted automatically 30 days after the session. You can delete them earlier from your account.
- Transcripts, scores and feedback: kept while your account is active so you can review your progress; deleted 90 days after account deletion.
- Account data: until you delete your account, then 90 days.
- Billing records: kept by Paddle and by us as required by tax law (typically up to 10 years).
- Anonymised data (no voice, no name, no email) may be kept indefinitely to improve scoring.
5. Security
Data is encrypted in transit (TLS) and at rest. Access is limited to the operator. No system is perfectly secure; if a breach affects your data we will notify you as required by law.
6. Your rights
Depending on where you live (including the EU/EEA under the GDPR and India under the Digital Personal Data Protection Act, 2023), you may have the right to access, correct, delete, or export your data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority. To exercise any right, email hello@sprechly.live from your account address. We answer within 30 days.
You can delete your account and all recordings yourself from the account settings page at any time.
7. Cookies
We use only strictly necessary cookies (login session) and privacy-respecting analytics without cross-site tracking. No advertising cookies are set without your consent.
8. Changes
We will post any changes here and update the date above. Material changes will be announced by email to registered users.