1. Introduction

Welcome to Conversaio ("we," "our," or "us"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service").

Important: By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, do not use our Service.

2. Information We Collect

2.1 Personal Information

We may collect the following types of personal information:

Account Information: Your name and email address from Sign in with Apple (which may be a private relay address), an optional profile photo, and the learning profile you choose: the language you learn, your native language, level, learning reasons and interests
Conversation Data: Text transcripts of your conversations with the AI tutor and the feedback created from them (corrections, words to keep and an estimated CEFR level). Your voice is streamed in real time to our AI provider; we do not store audio recordings
Device Information: Device name and model, operating system version, an identifier created by the app, your push notification token, and an App Attest key that lets our server check requests come from the genuine app
Usage Data: When conversations and warm-ups start and end, minutes used, your lesson schedule, vocabulary review progress, invites you send or accept, and in-app events such as screens viewed and buttons tapped

2.2 Automatically Collected Information

Server logs and first-party analytics events (through our provider Blainks)
IP address, used for security and to limit abuse; we do not work out your location from it
Our website uses no tracking cookies; a short-lived session cookie is set only when you send the contact form. The app uses no cookies and does not track you across other companies' apps or websites
Error logs and diagnostic information when something goes wrong

2.3 Features That Work on Your Device

Microphone: used only while you are in a conversation or using Say it again
Speech recognition (Say it again): the app uses Apple's speech recognition to check which words you said. It runs on your device when your language supports it; otherwise Apple processes the audio under Apple's privacy policy. The audio and the recognised text are never sent to Conversaio or stored
Share cards: created on your device and shared only when you choose to. They show your language, minutes, level and weekly streak, never your name or what you said
Invite a friend: your invite link carries a personal code. When a friend joins through it, we store which account invited which, when the link was opened and redeemed, and whether the reward was granted. Your friend's identity is not shown to you, and yours is not shown to your friend

3. How We Use Your Information

3.1 Primary Uses

We use your information for the following purposes:

Service Delivery: Providing and maintaining our AI conversation services
Personalization: Tailoring conversations, warm-ups, reminders and the words and corrections you practise to your profile and progress
Analytics: Understanding how features are used, in aggregate, to improve the app
Communication: Sending lesson and streak reminders (which you can turn off) and service notifications
Support: Providing customer service and technical support

3.2 AI Processing

Your conversation data is used only to:

Run the live conversation with the AI tutor
Create your feedback after each conversation: corrections, words to keep and an estimated CEFR level
Choose words and corrections for you to practise in later conversations and warm-ups
We do not use your conversations to train AI models, ours or anyone else's

4. In-App Purchases and Subscriptions

4.1 Subscriptions

Subscriptions are sold through the Apple App Store and managed with RevenueCat:

Payment is processed by Apple; we never see or store your payment card details
Apple and RevenueCat tell us your subscription status (plan, renewal and expiry dates), linked to your account
We use this status to give you your plan's weekly conversations and daily warm-ups
Bonus conversations from inviting friends are practice time only; they are not purchases and have no cash value

4.2 Purchase Analytics

We use subscription data only to:

Provide the plan you paid for
Understand, in aggregate, which plans are used
Prevent abuse, such as one purchase being used across many accounts
Comply with financial reporting requirements

5. Third-Party AI Data Sharing and OpenAI Integration

5.1 AI Data Sharing Disclosure

To provide our AI-powered language learning service, we share certain personal data with OpenAI, L.L.C. ("OpenAI"), a third-party artificial intelligence service provider. Before using our conversation features, you will be asked to provide explicit consent to this data sharing. The following personal data is sent to OpenAI when you use our AI conversation features:

Your name — used to personalize AI tutor conversations
Your selected learning language — used to tailor the conversation language
Your language proficiency level — used to adjust conversation difficulty
Your learning reasons and goals — used to customize conversation topics
Your personal interests and topics — used to make conversations relevant to you
Your conversation content: your voice, streamed in real time, and the text of the conversation
After a conversation, its transcript is sent to OpenAI again to create your feedback. The tutor's instructions for your next conversations and warm-ups also include a few of your words due for review and recent corrections

This data is shared solely for the purpose of delivering personalized AI language tutoring sessions. No data beyond what is listed above is shared with OpenAI.

5.2 User Consent for AI Data Sharing

We obtain your explicit consent before sharing any personal data with OpenAI:

Before your first AI conversation, the app will present a clear consent screen explaining what data is shared and with whom
Your consent is voluntary — you may decline, but AI conversation features will not be available without consent
You may withdraw your consent at any time through the app settings, which will disable AI conversation features
Your data will not be shared with any other third-party AI service without separate, explicit consent

5.3 About OpenAI (Third-Party AI Provider)

OpenAI, L.L.C. is our third-party AI service provider. OpenAI provides the following data protections:

OpenAI's API data usage policy states that data sent via the API is not used to train their models
OpenAI maintains SOC 2 Type II compliance and enterprise-grade security standards
Data is sent to OpenAI over encrypted connections and is subject to OpenAI's data retention and deletion policies
OpenAI's privacy policy and data processing practices are available at openai.com/privacy

We chose OpenAI because its commitments for API data meet the standards we apply to your data

5.4 OpenAI Compliance

In accordance with OpenAI's usage policies:

We prohibit use of the service for illegal activities
OpenAI's safety systems apply to the tutor's responses
We may review transcripts to investigate reports of misuse, and may suspend accounts for misuse
Age restrictions apply as described in our Terms of Use

5.5 AI Data Processing

When processing your data through AI services:

Under OpenAI's API policy, OpenAI may keep data it receives through the API for up to 30 days to monitor abuse, and then deletes it
Your personal data and conversations are not used to train AI models
Our servers store the conversation transcript and its feedback so you can see your history; see Data Retention below
You can withdraw consent at any time in Profile > AI Data Sharing

6. Data Security and Protection

6.1 Technical Safeguards

We implement industry-standard security measures:

HTTPS Encryption: All connections between the app and our servers use HTTPS (TLS)
Storage: Your data is stored on our servers hosted by DigitalOcean
Access Controls: Only the people who run the Service can access production systems
App Verification: The app proves it is genuine with Apple's App Attest, and our server checks this when a conversation starts
Backups: Daily database backups, kept for up to 6 months, so data can be recovered after a failure

6.2 Data Retention

Account and learning data (profile, transcripts, feedback, vocabulary, schedule, invites): kept until you delete your account. Deleting your account removes it from our database immediately
Backups: copies in database backups are deleted as the backups expire, within 6 months
Server logs and analytics events: kept for a limited time for security, troubleshooting and aggregate statistics

6.3 Incident Response

In the event of a data breach, we will:

Notify affected users without undue delay
Report to relevant authorities as required by law
Provide detailed information about the incident and our response
Implement additional security measures to prevent future incidents

7. Information Sharing and Disclosure

7.1 Third-Party Service Providers

We share only what each provider needs to do its job:

AI Service Providers: OpenAI, for conversations and feedback (see section 5)
Notifications and Analytics: Blainks, for push notifications, links, app text and first-party analytics
Cloud Infrastructure: DigitalOcean, for hosting our servers and database
Subscriptions: Apple and RevenueCat, for purchases and subscription status
Apple: Sign in with Apple, App Attest and speech recognition for Say it again
Email: Google (Gmail), for the welcome email and replies to messages you send us

We do not sell your personal data or share it for advertising.

7.2 Legal Requirements

We may disclose your information when required by law or to:

Comply with legal process or government requests
Protect our rights, property, or safety
Prevent fraud or security threats
Enforce our terms of service

7.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity with equivalent privacy protections.

8. Your Privacy Rights

8.1 Data Subject Rights

Depending on your location, you may have the following rights:

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete information
Erasure: Request deletion of your personal data
Portability: Receive your data in a machine-readable format
Restriction: Limit processing of your personal data
Objection: Object to certain types of data processing
Withdrawal: Withdraw consent for data processing

8.2 Account Controls

You can manage your data in the app and in iOS Settings:

Delete your account and all its data: Profile > Delete Account
Withdraw consent to AI data sharing: Profile > AI Data Sharing
Turn microphone or speech recognition access off in iOS Settings
Manage notifications in Profile or in iOS Settings
Ask for a copy of your data by email at info@conversaio.ai

9. International Data Transfers

Your information may be processed in countries other than your own, for example by OpenAI in the United States. We protect it through:

Standard Contractual Clauses approved by relevant authorities
Adequacy decisions by data protection authorities
Data processing agreements with our providers
Other legally recognized transfer mechanisms

10. App Store

10.1 Apple App Store

The app is available only on the Apple App Store. In line with Apple's App Store Review Guidelines:

We provide clear information about data collection and usage
Users can access, correct, and delete their personal data
The app is not directed at children under 13 and we do not knowingly collect their data; we rely on the App Store age rating and Apple's parental controls
We do not collect location data
We follow Apple's guidelines for AI and machine learning features

11. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes through:

In-app notifications
Email notifications to registered users
Prominent notice on our website
Updated "Last Updated" date at the top of this policy

Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

12. Contact Information

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

Email: info@conversaio.ai

Response Time: We will respond to your privacy-related inquiries within 3 working days of receipt.