Privacy policy

Who we are

Spanish Out Loud: AI Tutor (“Spanish Out Loud”, “we”, “us”) is made by Habo Ltd, registered in England and Wales, company number 17147678. Habo Ltd is the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018), and is registered with the Information Commissioner’s Office (ICO) as a data controller, registration number ZC228252. This policy covers this website, learnspanishoutloud.com, and the Spanish Out Loud app.

For anything about your data, email [email protected].

On this website

The waitlist

If you join the waitlist, we store:

• your email address;
• the date and time you signed up;
• which form you used (for example the homepage or an article), and any campaign tag in the link you followed;
• the web page that sent you to us, if your browser shares it;
• the country Cloudflare detects from your connection, as a two-letter code. We don’t store your IP address or your city.

We use this to email you when the app is live and to understand which pages bring people to the waitlist. To stop automated sign-ups, your IP address is turned into a scrambled code (a hash) that counts sign-up attempts. That code is deleted automatically within about 15 minutes, and the IP address itself isn’t stored.

The waitlist is stored with Cloudflare. We keep your entry until you ask us to remove you, or at most 12 months after the app launches, whichever comes first. To come off it, email [email protected] and we’ll delete your entry.

Analytics and cookies

We use Cloudflare Web Analytics to count visits. It doesn’t use cookies and doesn’t follow you across other websites. It tells us things like which pages were viewed, the page that sent the visitor, the type of browser and device, and the country. This site doesn’t use cookies for analytics, advertising or tracking.

Hosting and security

This website runs on Cloudflare. Like any web host, Cloudflare processes your IP address and basic browser details to deliver pages and protect the site from attacks.

In the app

Using the app without an account

You can use the app without signing in. Your progress, review cards, topics, settings and what Carlitos knows about you are saved on your phone. The app creates a random ID for your installation (a device ID) and sends it, with the type of phone system (for example iOS), when it talks to our server. That ID isn’t linked to your name or email unless you create an account.

Talking with Carlitos

When you speak, the app sends your voice to our server, which passes it to xAI to turn it into text. That text, tidied up to remove things like “eh” and “em”, is sent with the recent conversation to xAI so Carlitos can reply. Carlitos’s replies, and phrases you practise, are sent to xAI to turn them into speech.

• Recordings: we don’t keep recordings of your voice. Audio is used to make the text and is then discarded.
• Conversations: the text of your conversations is kept on your phone, not on our servers. If you have an account, we store a summary of each session (such as how long it lasted and how many words and corrections there were), not what was said.
• Generated audio: to make playback smooth, the audio of a sentence may be held in a short-lived cache for up to 15 minutes.

What Carlitos knows

After a conversation, the app can send it to xAI to pick out facts you’ve shared, like your job or an upcoming trip, so Carlitos can follow up next time. These facts are saved on your phone (and with your account, if you have one) and sent with your chats so Carlitos can use them. You can see every fact, delete any of them, or switch memory off in the app under “What Carlitos knows”.

Made-for-you topics

If you ask for a topic about your own life, what you describe (and, if memory is on, what Carlitos knows) is sent to xAI to write the phrases.

If you create an account

An account is optional. It backs up your learning and lets you use it on more than one device. You can sign in with Apple, or with your email address and a one-time code that we email to you. We store:

• your email address (with Sign in with Apple this can be a private relay address Apple creates for you) and the ID Apple gives us for your sign-in;
• your sign-in sessions and the devices you use, with the dates they were created and last used. Session tokens and sign-in codes are stored only in scrambled (hashed) form;
• your synced learning data: your profile (the name you give Carlitos, your level, daily goal and settings), progress, review cards, topics, what Carlitos knows and session summaries.

This data is stored in a Cloudflare database located in the European Union. Sign-in emails are sent through Cloudflare.

Pro subscriptions

Pro is bought through the Apple App Store. Apple handles the payment, and we don’t see your card details. We use RevenueCat to manage subscriptions. RevenueCat receives a random app user ID (or your account ID, if you’re signed in) and the purchase details from Apple, and tells our server whether Pro is active. We store whether Pro is active, which product you chose, the store, whether it renews and when it ends.

Usage counts

To keep the service fair and protect it from abuse, our server counts how much each device and account uses the speaking features each day. It also keeps a count for each network, using a scrambled (hashed) form of the IP address rather than the address itself. It also adds up your speaking minutes each month.

Checking Carlitos’s Spanish

Once a day, we check a small random sample of Carlitos’s replies and his English explanations from the day before, using an AI model from xAI, to make sure his Spain Spanish is natural and his translations are right. Before saving anything for this, we automatically remove words you used, names and numbers, skip conversations about health or other sensitive topics, and keep no account or device ID with it. Nothing is saved for this if memory is switched off. It’s automatic, so now and then a detail Carlitos puts in his own words may stay in. Lines that aren’t picked for the sample are deleted, and everything is deleted after 14 days.

Reminders and calls from Carlitos

Daily reminders and surprise calls are scheduled on your phone. We don’t receive a push notification token for them.

App updates and server logs

The app downloads updates from Expo, which receives standard technical details such as your IP address and app version. Our server keeps short technical logs (for example which feature was used, whether it worked and how long it took) to keep things running. These logs don’t include what you say or type.

Why we use your data (lawful bases)

• Consent: the waitlist and our launch email. You can withdraw consent at any time by emailing us.
• Contract: running the app for you, including conversations with Carlitos, what Carlitos knows, your account and sync, and Pro.
• Legitimate interests: keeping the site and app secure, preventing abuse, usage counts, server logs, visit counts and checking the quality of Carlitos’s Spanish. We’ve kept these as light as we can, and you can object (see your rights below).
• Legal obligation: keeping records we’re required to keep by law.

Who helps us run Spanish Out Loud

We use these companies to provide the service. They act on our instructions:

• Cloudflare: hosts this website, the waitlist, our server and database, sends sign-in emails and provides visit counts.
• xAI: turns your voice into text, writes Carlitos’s replies, turns text into speech, picks out what Carlitos knows, writes made-for-you topics and runs the daily quality check.
• RevenueCat: manages Pro subscriptions.
• Apple: Sign in with Apple and App Store purchases. Apple also acts under its own privacy policy.
• Expo: delivers app updates.

We don’t sell your personal data or use it for advertising. We would share it with others only if the law requires it, or as part of a sale or reorganisation of the business, in which case this policy would continue to apply to it.

Data outside the UK

Some of these companies process data outside the UK, including in the United States. Our account database is in the European Union. Where data leaves the UK, we rely on the transfer safeguards set out in each provider’s data protection terms.

How long we keep it

• Waitlist: until you ask us to remove you, or at most 12 months after the app launches, whichever comes first.
• Voice recordings: not kept.
• Your account and synced learning data: until you delete your account, or until 2 years have passed without you signing in, when we delete the account. Deleting an account removes everything stored with it on our servers.
• Sign-in codes: deleted after one day. Ended sign-in sessions: deleted after 30 days.
• Daily usage counts: deleted after 8 days. Monthly speaking minutes: deleted after 13 months.
• Quality check sample: deleted after 14 days.
• Pro status: deleted with your account. We keep the IDs of subscription events from RevenueCat, without anything linking them to you, to avoid processing the same event twice.
• Device blocks: if a device has been blocked for abuse, we keep that block (with no notes about you) even if the account is deleted.
• Data on your phone: stays there until you delete it in the app or delete the app.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have it corrected if it’s wrong;
• have it deleted;
• restrict or object to how we use it;
• get a copy in a portable format;
• withdraw your consent at any time, where we rely on consent.

In the app you can do much of this yourself: “Export my data” downloads everything stored with your account, and “Delete account” permanently deletes it. If you pay for Pro, cancel the subscription in your App Store settings too. For anything else, email [email protected]. We’ll reply within one month.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk.

Children

Spanish Out Loud isn’t meant for anyone under 16, and we don’t knowingly collect their data. If we learn that we hold data from someone under 16, we delete it. If you think someone under 16 has given us their data, email [email protected].

Keeping your data safe

Data is encrypted between the app or your browser and our server. Sign-in codes and session tokens are stored only in scrambled form. No system is perfectly secure, but we work to protect your data and will tell you and the ICO about a serious breach where the law requires it.

Changes to this policy

We’ll update this page when the website or the app changes how it uses your data, and change the “Last updated” date at the top. If a change matters, we’ll also tell you in the app or by email before it takes effect.

Contact

Habo Ltd, registered in England and Wales, company number 17147678. Email [email protected].