Privacy Policy

1. Controller

SEOLOAD LLC, 2880 W Oakland Park Blvd STE 225C, Fort Lauderdale, FL 33311, USA. Email: mgundlach@seoload.de

The controller is established outside the European Union but offers the service to people in the EU. No representative in the Union pursuant to Art. 27 GDPR has been appointed at present. Until one is appointed, you can reach us directly at the address above.

No data protection officer has been appointed; in our assessment there is no legal obligation to do so.

2. What data we process

• Account: email address, password (stored only as a hash), display name, time zone, interface language.
• Learning profile: native and target language, learning goal, interests, daily learning time, placement and skill scores.
• Learning data: answers to exercises, assessments, recurring mistakes, conversation histories, mission progress, learning times.
• Voice recordings: recordings you make in exercises, during shadowing or in conversations, and their transcripts. While you record, we also measure in your browser when you start speaking and how often you pause (fluency); only these figures are transmitted.
• Speaking samples (optional): if you expressly consent, we store short speaking samples for a fixed task (e.g. “Introduce yourself”) so that you can compare your pronunciation and fluency over months.
• Your own content: texts, audio files and documents you upload, and descriptions of your day (“Learn from my day”; the description itself is not stored).
• Usage and billing data: number of sessions, seconds of speech and AI requests per day; for paid plans, the subscription status (we do not hold any payment details).
• Usage statistics: pseudonymous learning events (see section 5), unless you have switched them off.
• Technical data: server logs with IP address, time and requested address; one cookie for signing in and one for the chosen language.

3. Purposes and legal bases

• Providing the learning platform, your personal learning plan and feedback: performance of a contract (Art. 6(1)(b) GDPR).
• Processing your voice for speech recognition, pronunciation assessment and live conversations: your consent, given by actively starting the recording or conversation (Art. 6(1)(a) GDPR). You can continue learning without a microphone at any time.
• Long-term storage of speaking samples for before-and-after comparison: your separate, express consent on the progress page (Art. 6(1)(a) GDPR). You can withdraw it there at any time; the speaking samples are then deleted immediately.
• Security, abuse prevention and error analysis: legitimate interest (Art. 6(1)(f) GDPR).
• Pseudonymous usage statistics to improve the learning units: legitimate interest (Art. 6(1)(f) GDPR); you can object at any time in the settings.
• Billing and statutory retention: legal obligation (Art. 6(1)(c) GDPR).

4. Use of AI services

Learning content, exercises, assessments and conversation partners are generated with AI models from OpenAI. For this we transmit the content required in each case (e.g. your answer, your level, your text or your recording) to OpenAI. Your email address and name are not sent. No automated decision with legal effect is made; the assessments serve solely your learning progress.

Live conversations: when you start a live conversation, your browser connects directly to OpenAI; the audio is transmitted there in real time and does not pass through our servers. We store only the transcript.

5. Our own usage statistics

To see whether learning units are started, completed and resumed on later days, we store a small number of learning events in our own database (Supabase, Frankfurt am Main, Germany): registration, completed setup, start and completion of a learning unit, the task shown (internal identifier and position) and ending a unit via “End”. In addition: time, learning area, languages, learning mode, plan, platform and app version; for the completed setup, the learning goal you chose; and for the registration, a campaign identifier (for example “linkedin”) if the link you signed up through carried one.

Instead of your account identifier, the events carry a random identifier that is linked to your account only through a protected mapping table. Your answers, recordings, texts, email address and name are not stored with them. There is no disclosure to third parties, no advertising and no tracking before registration.

The events are deleted automatically after 90 days. When you delete your account, the mapping is removed and the events can no longer be attributed to any person. You can switch off the usage statistics at any time in the settings under “Privacy & data”; from then on nothing new is recorded. Learning and reporting problems work regardless.

6. Recipients and processors

• Supabase (database, sign-in, file storage) – server location Frankfurt am Main, Germany.
• Vercel (application hosting) – server functions run in Frankfurt am Main, Germany.
• OpenAI (language models, speech recognition, speech output, live conversations) – processing also in the USA.
• Microsoft Azure Speech (pronunciation assessment), if enabled.
• Stripe (payment processing), if you book a paid plan.
• Resend (email delivery), Sentry (technical error reports, stored in the EU; without learning content, answers, recordings, email address or cookies) and Upstash (counters for request limits), each if enabled.

Data processing agreements are in place with all service providers. For transfers to the USA we rely on the EU-U.S. Data Privacy Framework or on standard contractual clauses.

In addition, the controller itself is established in the USA, so your data is also processed there. Despite the safeguards mentioned, a level of protection equivalent to the European level cannot be guaranteed in every case; in particular, authorities there have broader access rights and legal remedies are more limited.

7. Children and young people

When the account is set up, it is stated who is learning. If “a child” or “a teenager” is selected, the account can only be used after a parent or legal guardian has confirmed their consent (Art. 8 GDPR). We store the time of this confirmation. No learning data is collected before the confirmation.

We process the same data from minors as from adults and no more: account, learning history, answers and – only if the microphone is used – voice recordings. There is no advertising, no profiling for advertising purposes and no disclosure to third parties for their own purposes. The parent or legal guardian can withdraw consent at any time at the address above and request deletion of the account; deletion is also possible at any time in the settings.

8. Retention periods

• We delete recordings made for repeating, minimal pairs and shadowing immediately after assessment. All other voice recordings are deleted automatically after 90 days; transcripts and assessments remain part of your learning history. You can delete all recordings at any time in the settings.
• Speaking samples you have consented to storing are exempt from the 90-day deletion. We keep them until you withdraw your consent, delete all recordings, start over with “Start over” or delete your account.
• We keep account and learning data for as long as your account exists. Deleting your account in the settings removes them irreversibly.
• We delete usage statistics events after 90 days.
• We retain billing records for the statutory periods.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. You will find a full export of your data and the deletion of your account directly in the settings. You also have the right to lodge a complaint with a data protection supervisory authority.

10. Cookies

We only use technically necessary cookies (sign-in, language choice, display). There are no advertising cookies.