Privacy policy

Data controller

The data controller is Pembet TSANGHOU, whose registered office is located at 2 rue Françoise Dolto, 44800 Saint-Herblain, France. For any question or request about your data, write to dpo@speakasyou.com.

Purposes

The data collected on SpeakAsYou serves the following purposes:

• Portrait. Establishing the learning profile from the answers to the ten questions of the onboarding path.
• Lessons. Generating and serving daily lessons, adapted to the level and to recurring errors.
• Voice. Transcribing speech to text (Deepgram) and synthesising Léa’s voice (ElevenLabs). Raw audio is never retained.
• Progress. Tracking completed lessons, errors categorised, and the streak of consistency.

Legal bases

Processing is based on contract performance (access to the service), consent (optional features), and legal obligation (billing, accounting retention).

Recipients

The data is accessible to the publisher for providing the service, to its technical service providers listed by category (hosting, email delivery, speech transcription and synthesis, language models), and to public authorities in the cases provided for by law. The detailed identity of these providers is disclosed upon legitimate written request addressed to dpo@speakasyou.com.

Cookies

The site sets cookies strictly necessary for its operation: portrait session, SOS session, technical cookies for invitations and discovery, plus the cookies set by the authentication layer at sign-in and by the payment processor at subscription. The full details — name, purpose, lifetime — are listed in the legal notice.

Retention periods

Retention periods are set per data category, according to the actual needs of the service and the Publisher’s legal obligations. Each period states what the product actually DOES — what is purged automatically, and what is not.

• Account and pedagogical content. Retained as long as the account is active. An account with no sign-in for THREE YEARS is flagged to the operator, who decides if and when to anonymise it by hand. No automated task deletes inactive accounts at this time. Upon an erasure request exercised by the subscriber from their “My data” area, a SEVEN-DAY grace period applies before execution; during this period, access is suspended, the decision may be reversed by signing back in.
• Portrait started without an account. A portrait started without creating an account, and never linked to an account, is deleted THIRTY DAYS after it was started by an automated nightly task. After seven days, it can no longer be linked to an account. A portrait linked to an account follows that account.
• Billing. Closed subscriptions are retained TEN YEARS from their closure date, pursuant to the Publisher’s accounting obligations. Beyond that, an automated nightly task deletes them permanently.
• Audit logs. Cockpit setting changes, catalogue changes, access and organisation events: retained THREE YEARS. Beyond that, an automated nightly task deletes them. The review module’s log is not purged: it records who reviewed what, and when — that traceability must remain verifiable.
• Consents. Acceptance of the terms of sale, declaration of legal capacity, strictly necessary cookies, waiver of the right of withdrawal: follow the account to which they are attached. Upon account anonymisation, they are anonymised with it.
• Payment provider technical events. Retained THREE YEARS. Beyond that, the nightly billing-purge task deletes them.

Raw audio of the subscriber’s speech or of Léa’s voice is NEVER retained, neither by the Publisher nor by its providers — only the textual transcription is processed and then persisted in the European databases.

CONNECT community space

When you use CONNECT, the space where learners ask each other questions and answer them, the questions you ask and the answers you write are passed on to the CONNECT members who take part. The periods below are decisions we have made, for the reasons given: they are imposed on us neither by the General Data Protection Regulation nor by the European Digital Services Act.

• Questions and answers. We have decided to retain them for 365 DAYS from the publication of the question, because a permanent history is not necessary for the service to work. Beyond that, an automated nightly task deletes the question together with the answers it received.
• Erasure of your account. Your questions and answers are detached from your account, but their text remains, for those to whom it was addressed, until the 365-day deadline. Detaching a text from its author does not remove what the text contains: if you wrote your name or a detail that identifies you in it, it is this period that bounds it.
• Report files. We have decided to retain a report file for FIVE YEARS from the decision that closes it, so as to be able to establish what was reported and decided in the event of a dispute; this period follows the ordinary civil limitation period (article 2224 of the French Civil Code). The file keeps its own excerpt of the reported content, which therefore survives the deletion of that content. Beyond that, an automated nightly task deletes the file, unless it is subject to a reasoned hold, reviewed when due.

Transfers outside the European Union

The hosting of data is located within the European Union. Some specific PROCESSING operations do involve transmission outside the European Union: the transcription of speech to text, the synthesis of Léa’s voice, and the generation of lessons by a language model. These operations are performed by providers established outside the European Union, whose transfers are governed by the European Commission’s standard contractual clauses. Raw audio is never retained, neither by us nor by these providers — only the textual transcription is processed and then persisted in our European databases.

Your rights

In accordance with the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, restrict, object to and port your data. You may exercise these rights by writing to dpo@speakasyou.com. You also have the right to lodge a complaint with the French data protection authority (CNIL).

Contact

For any question about this policy, write to dpo@speakasyou.com.