Privacy Policy

1. Who controls your data

Aldaim Digital Ltd (registered in England and Wales, company number 17327688) is the data controller for Speak & Stay. We keep the personal data we hold to the minimum needed to run the service. For any privacy question, or to exercise your rights, email support@speakandstay.com.

2. What we collect

Account details (your email address, and a password if you do not use Google sign-in); your settings (the language you choose, what you are preparing for, and your test date); your practice conversations, their transcripts and feedback, and any topic you prepare; and basic usage events (for example, that a practice was started). If you buy a paid plan, our payment provider handles your card details; we receive confirmation and limited billing information, not your full card number. We also process technical data such as your IP address, device and browser type when you use the site.

3. Google sign-in

If you sign in with Google, we receive your email address and confirmation that it is verified. We do not receive or store your Google password.

4. Voice recordings

When you practise speaking, your audio is processed to transcribe and mark your answers. We keep the transcript so you can review your feedback. The turn audio itself is deleted after 90 days, unless you have given consent for us to keep examples to check and improve marking quality.

5. Cookies and analytics

We use a small number of essential cookies and similar storage to keep you signed in and remember your settings. These are needed for the service to work and do not require consent.

With your consent, we also use the Meta (Facebook) Pixel and Conversions API to understand how people find and use Speak & Stay and to measure our advertising. This is off until you accept it in the cookie banner, and you can decline. When it is on, Meta receives your IP address, browser information, and details of the pages and actions you take. On a few events (such as creating an account) we send your email address to Meta in a hashed (scrambled) form so it can match the event without us sharing your address in the clear. We do not send your practice content, transcripts, or audio to Meta. You can change or withdraw your choice at any time by clearing the site data in your browser, and control ad personalisation in your Facebook settings.

6. Practice emails

On some of our free pages you can ask us to send you practice emails. This is optional and separate from your account. When you give us your address we send you one email with a confirmation link, and nothing else is sent unless you click it (double opt-in). We store your email address, the page you signed up from, its language, and a hashed form of your IP address, which we use only to limit abuse of the form. Resend, our email provider, sends these emails for us. Every email has a one-click unsubscribe link that needs no sign in, and mail apps such as Gmail can unsubscribe you directly. If you unsubscribe we keep your address on a suppression list so that we do not email you again by mistake. If you would rather we erased it completely, email support@speakandstay.com and we will delete the record. Addresses that are never confirmed are deleted after 30 days.

7. Why we use your data (lawful bases)

To provide your account and give you feedback and study tools (to perform our contract with you); to keep the service secure, prevent abuse, and improve it (our legitimate interests); to take payments and meet our legal and accounting duties (legal obligation); and for optional analytics, advertising measurement, sending the practice emails you asked for, and keeping audio examples to improve marking (your consent, which you can withdraw). We do not sell your data.

8. Automated marking

Your practice is marked automatically by AI. This is practice feedback to help you learn. It is not an official result and has no legal or immigration effect. A real test is set and marked by the test provider, not by us.

9. Who we share it with

We use trusted service providers who process data only on our instructions: Cloudflare (hosting, database, and email routing), Deepgram (speech to text and voice), Anthropic (the AI examiner and marking), Resend (sending account emails and practice emails), Stripe (payments), and, only with your consent, Meta Platforms (advertising analytics). We share personal data with authorities only where the law requires it.

10. Where your data goes

Some of our providers are based outside the UK and the European Economic Area, including in the United States. Where your data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses.

11. How long we keep it

We keep your account data while your account is open. Turn audio is deleted after 90 days (see section 4). When you delete your account we remove your personal data, keeping only what the law requires (for example, payment records) or what you have consented to for quality improvement.

12. Your rights

You can ask to access, correct, delete, or receive a copy of your data, and to restrict or object to certain uses. Where we rely on consent, you can withdraw it at any time. To delete your account or exercise a right, email support@speakandstay.com. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk).

13. Security and children

We use encryption in transit, hashed passwords, and access controls to protect your data, though no service can be completely secure. Speak & Stay is for adults: you must be 18 or over to use it, and it is not directed at children.

14. Changes and contact

We may update this policy; we will change the date above and, for significant changes, tell you in the app or by email. For any privacy question, email support@speakandstay.com.