Privacy Policy

Who we are (the controller)

• Operator: Vontix Daniel Ltd.
• Company no. (ח.פ): 517337184
• Address: 13 HaNarkis St., Ashdod 7722930, Israel
• Website: tospeak.ai
• Contact for privacy matters: support@tospeak.ai, phone +972 52-375-3936

What we do NOT collect

• We do not record your camera or microphone. Both stay on your device and are streamed in real time to the avatar provider only while a lesson is active. We do not save the audio or video on our side.
• We do not track you across the web. There are no advertising cookies, no third-party trackers, no fingerprinting. Our analytics tool (Plausible) is cookieless and privacy-friendly.
• You can browse the site and run a short daily lesson without an account. You only share personal data if you choose to sign up or subscribe.

What we collect

• Standard server logs. When you load a page, our server records the request (IP address, page, timestamp, browser). We use this only to keep the service running and to debug problems. Logs are kept for about 14 days and are not used for profiling.
• Aggregated usage analytics. We use Plausible, a privacy-friendly analytics tool that counts page views and lesson starts without cookies and without identifying individual users.
• What you say during a lesson. Your speech is streamed in real time to Deepgram for speech-to-text conversion (the audio is held only as long as it takes to transcribe and is not stored), and the resulting text is sent to Anthropic to generate the tutor's reply. We do not store the audio on our servers. For anonymous lessons we do not store transcripts at all. For signed-in users, transcripts are saved in the Lesson history feature (see below).
• If you create an account, optionally: your name (requested at signup) and phone number (optional). We use them to address you naturally in the product and, if you provided a phone, to reach you about your account. We do not sell or share contact details for marketing.
• If you create an account: we store your email address (used to send sign-in links) and a session cookie that identifies you while you are logged in. We do not store a password; sign-in is by one-time magic link.
• If you subscribe to a paid plan: Stripe, our payment processor, handles your card and billing data on a PCI-DSS hosted payment page. We store only an opaque Stripe customer ID and the current subscription status (active/cancelled). We never see or store your card number or CVV.
• Account-tied lesson data. When you are signed in, we save lesson timestamps, duration, full transcripts, the vocabulary you bookmark and the tutors you favourite, so you can review them later. Each lesson has a delete button in the history view, and you can wipe everything from your profile or by emailing support@tospeak.ai.
• Your learner profile (optional). If you fill in the About you card on your profile (name, level, goals, interests, age group, native language), we store those fields and include them at the start of each lesson so the tutor can address you by name and tailor the conversation. We also pass a short list of your last few lessons (topic, tutor, date, duration) and the words you have saved. Other students never see any of this. You can turn the whole feature off with one switch on the profile page, or wipe the profile entirely.

Is providing data mandatory?

You are not legally obliged to give us any personal data, and much of the product works without it. The following note describes the practical consequences of not providing certain data.

• Browsing and a short daily lesson: no personal data is required.
• Email address: required to create an account, because sign-in works by sending a one-time link to your inbox. Without it you cannot have an account or save lesson history.
• Name: requested at signup so the tutor can address you; you may use any name you wish.
• Phone number: entirely optional; not providing it simply means we will not call or text you about your account.
• Payment and billing data: needed only if you subscribe to a paid plan, and it is collected directly by Stripe, not by us. Without it you can still use the free tier.
• Learner profile fields: optional; not providing them only means lessons are less personalised.

Purposes and legal basis

We process personal data to provide the service you asked for (running lessons, your account and history), to operate and secure the website, to process subscription payments, to communicate with you about your account, and to comply with legal obligations such as tax record-keeping. Where the law requires consent (for example certain communications), we rely on your consent, which you can withdraw at any time; otherwise we rely on the performance of our agreement with you, our legitimate interest in running a secure service, and compliance with law.

Retention

Server logs: about 14 days. Sign-in tokens: 24 hours. Account email and subscription status: kept while your account exists. Lesson history, saved vocabulary and favourite tutors: kept while your account exists and deletable from your profile. Stripe billing records: retained as required by Israeli tax and bookkeeping law (the Income Tax (Bookkeeping) Regulations), typically about 7 years, as well as per Stripe's own terms. When you delete your account we erase the linked data promptly, except records we are legally required to keep.

Who processes your data

We rely on a small number of vendors. Each is bound by its own privacy terms and processes data on our behalf.

• Anthropic: generates the tutor's replies. The text of your speech is sent to their API. See anthropic.com/legal/privacy.
• LiveAvatar / HeyGen: renders the avatar video; receives the text the tutor should say. See heygen.com/policy.
• Deepgram: converts your spoken words to text in real time. Audio is streamed over a per-lesson token directly from your browser; we do not store it. See deepgram.com/privacy.
• SendGrid (Twilio): delivers sign-in magic-link emails; receives your email address.
• Stripe: processes subscription payments on a PCI-DSS hosted payment page; receives card and billing details directly from your browser.
• DigitalOcean: hosts our servers.
• Plausible: cookieless, aggregated analytics; does not receive identifying information about you.

Transfer of data abroad

Some of the processors above are located outside Israel, mainly in the United States and the European Union. This means your data may be transferred to and processed in those countries. We transfer data abroad only as permitted under the Protection of Privacy Law and the Privacy Protection (Transfer of Information to Databases Abroad) Regulations: either because the recipient country is subject to a level of data protection comparable to Israeli law (for example, EU/EEA countries recognised as providing adequate protection), or on the basis of binding contractual undertakings that require the recipient to protect the data and to honour the rights you have under Israeli law. The relevant processors are also bound by contractual confidentiality and data-protection commitments and maintain appropriate safeguards, and where the GDPR applies we use recognised transfer mechanisms. You may contact us at support@tospeak.ai for details of the specific safeguards applied to a given transfer.

Cookies and tracking

We use only essential cookies needed to run the service. The most important one is the session cookie that keeps you signed in. We do not use advertising cookies or third-party tracking cookies, and our analytics (Plausible) is cookieless. Where the law requires consent for any non-essential cookie, we will ask for it before setting that cookie; you can also control cookies through your browser settings, though disabling the session cookie will prevent you from staying signed in.

Security

We apply technical and organisational measures to protect personal data, including encryption of traffic in transit (HTTPS), access controls and limited internal access on a need-to-know basis, short retention of logs and tokens, and not storing audio, video or card data on our servers. Payment data is handled exclusively by Stripe, a PCI-DSS compliant processor, so full card numbers and CVV never reach us. No system is perfectly secure, but we work to keep risk low and to respond quickly to any security incident.

Children

Tospeak is suitable for learners of all ages, including children, and is offered as a learning tool. Where a learner is a minor under applicable law, registration, saving lesson history and any paid subscription are intended to be carried out only by, or with the consent and supervision of, a parent or legal guardian, who is responsible for the minor's use of the service and for the payment.

When a child uses the service, we may collect and store the same data described above in the What we collect section, namely: the account email (used for sign-in links), an optional name and phone number, lesson history and transcripts for signed-in users, saved vocabulary and favourite tutors, optional learner-profile fields (such as level, goals, interests, age group and native language), and, for paid plans, an opaque Stripe customer ID and subscription status. As with all users, we do not record or store the camera or microphone feed and we do not store payment card numbers or CVV.

A parent or guardian may, at any time, review the data tied to a child's account, correct it, turn off personalisation, or have the account and its linked data deleted, using the controls on the profile page or by contacting us at support@tospeak.ai or +972 52-375-3936. If you are a parent or guardian and believe a child has created an account or provided data without your consent, contact us and we will delete the account and its data promptly, subject only to records we are legally required to keep.

Your rights under Israeli law

Under the Protection of Privacy Law, 1981 (as amended by Amendment 13), you have the following rights regarding personal data we hold about you:

• Right of access (section 13): to review the personal data we hold about you. By law we will respond to an access request within 30 days (this period may be extended in the circumstances permitted by law).
• Right to correction (section 14): to ask us to correct, update or delete data that is inaccurate, incomplete, unclear or out of date. We will act on a correction request within the time required by law.
• Right to deletion: to ask us to delete your data, subject to records we are legally required to keep (such as tax and billing records).

To exercise any of these rights, contact support@tospeak.ai or phone +972 52-375-3936. We will respond within the time required by law.

Your rights (GDPR / UK GDPR / CCPA)

If the GDPR, UK GDPR or CCPA applies to you, you also have the right to access, correct, delete, restrict or receive a portable copy of your personal data, and to object to processing. You can exercise the most common rights yourself from your profile page:

• Access / portability. Profile, About, Download my data. We email you a JSON export with everything tied to your account (profile, lesson history, saved vocabulary, favourites).
• Correction. Edit your name, phone and learner-profile fields directly on the profile page.
• Deletion (right to be forgotten). Profile, About, Delete my account. This wipes your account and all linked data: profile, lesson history, vocabulary, favourites, quota record. Stripe billing records are retained per tax law (see Retention).
• Object / restrict processing. Toggle the Share with tutor switch on the profile page to stop us passing your profile and recent lessons into the model prompt while keeping your account.

For anything not self-serve, email support@tospeak.ai and we will respond within 30 days. EU/UK residents may also lodge a complaint with their local data-protection authority.

Changes to this policy

We will update this page when our practices change. The Last updated date at the top reflects the most recent version.

Contact

Vontix Daniel Ltd., 13 HaNarkis St., Ashdod 7722930, Israel. Email support@tospeak.ai, phone +972 52-375-3936.