Vocamemo Privacy Policy

1. Overview

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have. If anything is unclear, you are welcome to contact us.

2. Data Controller

The controller of your personal data is:

Łukasz Ciastko Software Development
Łukasz Ciastko, sole proprietorship registered in Poland (CEIDG)
NIP: 9492245030
Address: ul. Włoszczowska 34, 42-230 Koniecpol, Poland

For privacy-related questions or to exercise your data protection rights, contact us at privacy@vocamemo.com.

We are not required to appoint a Data Protection Officer under Article 37 of the GDPR. For all data protection inquiries, please use the email address above.

3. Account Requirement

A Vocamemo account is required to use the app. You create an account using Sign in with Apple or Sign in with Google. Apple provides us with your email address (or an Apple-generated private relay address, if you choose to hide your email). Google provides us with the email address and the name of your Google account. We need this information to create your account, sync your learning progress, and provide the service. If you sign in with Apple and with Google using the same email address, both sign-in methods open the same Vocamemo account.

You do not need an account to subscribe to the Vocamemo newsletter on our website (see Section 6a).

4. Data We Collect

4a. Speaking Exercises

In the exercises you can answer out loud. For this, the app asks for access to the microphone and to speech recognition. The speech recognition of your device turns your speech into text on the device, and the app compares that text with the expected answer. The recording of your voice and the recognised text are not sent to us or to anyone else, and the app does not store them. We receive only the result of the exercise, as with an answer that you type, which is part of your learning data.

Answering out loud is optional: you can type your answers or choose words instead. You can turn off the access to the microphone and to speech recognition at any time in the settings of your device.

5. Where Data Comes From

• From you: information you provide when creating your account, writing to the ExplAIn tutor, subscribing to the newsletter on our website, or contacting support.
• From Apple: identity token claims received during Sign in with Apple (including your email address where provided). If you subscribe, the signed purchase information that the app receives from the App Store and sends to our server, and the notifications that the App Store sends our server when your subscription changes.
• From Google: identity token claims received during Sign in with Google (your Google account identifier, email address and name).
• From your app activity: study actions, sync events, and service diagnostics generated as you use Vocamemo, and the information that the app sends with each request to our servers.
• From the app on your device: the crash and error reports from the app (see Section 6d).
• From your browser: the information that your browser sends with each request to our website, and the information collected by our website analytics (see Section 6c).

6. How We Use Data and Our Legal Bases

The table below describes each processing purpose, the data involved, and the legal basis we rely on under Article 6(1) of the GDPR.

We do not sell your personal data. We do not use personal data for advertising or ad-targeting profiles.

We rely on consent (Art. 6(1)(a)) only for the marketing cookies of our website, described in Section 6b.

6a. Vocamemo Newsletter

On our website you can subscribe to the Vocamemo newsletter, which brings news about the app and its courses. We send it to perform the newsletter contract described in Section 7 of the Website and Newsletter Terms, which is concluded when you confirm your subscription. This contract is our legal basis for sending the newsletter (Art. 6(1)(b) of the GDPR). By sending your email address with a newsletter form, you also give the consent to receive commercial information by email that Article 398 of the Polish Electronic Communications Act of 12 July 2024 requires. We store your email address, the language of the website page where you subscribed (the newsletter is sent in that language), the first language set in your browser, the place on our website where you subscribed, the code of the team link you came through (if any), and the date, time and version of your consent. The newsletter is not linked to a Vocamemo account. Before we send the first newsletter, we send an email with a link to confirm the subscription to the address you entered, and we send the newsletter only to confirmed addresses.

You can unsubscribe at any time, with the link in each email or by writing to privacy@vocamemo.com. Unsubscribing withdraws this consent and ends the newsletter contract. It does not affect the emails sent before.

6b. Cookies and Browser Storage on Our Website

Our website stores the items below in your browser. Necessary items are always used. Marketing cookies are used only with your consent, which the website asks for with a notice at the bottom of the page before it would store one. The website analytics described in Section 6c use no cookies and store nothing in your browser.

Without your consent, the code of a team link is used only on the pages you open through the link, for example in their App Store links and newsletter forms, and is not stored in your browser.

You can change your answer at any time with “Cookie settings” at the bottom of the website, or by deleting the cookies of vocamemo.com in your browser. When you reject the marketing cookies, the website deletes them.

6c. Website Analytics

To learn how visitors use our website and how they find it, we use Umami, an open-source analytics program. We run it ourselves on our own server in the European Union region of the same cloud infrastructure provider as the rest of the service. No analytics company receives the data.

On each page, the Umami script sends our server the address and title of the page, the address of the page you came from, your screen size and the language of your browser. It also sends events: clicks on download and navigation links, the sections of a page that you scroll to, your use of the demos on the website (for example the course you choose, whether your answers are correct and the suggested ExplAIn questions you pick), the FAQ questions that you open, the audio that you play, your answer to the cookie notice, and newsletter subscriptions (the form you used, not your email address). The page address and some events contain the code of the team link you came through, if any. The questions that you type in the ExplAIn demo are not sent.

From your IP address and the user-agent of your browser, our server works out your country, region and city, and your browser, operating system and device type. The location comes from a database on our server, so your IP address is not sent to anyone else. Umami does not store your IP address or your user-agent. It combines them with a secret key and the current month into an identifier, so that it can count the visits of one browser in a month, and gives each visit its own identifier. The identifier changes every month and does not tell us who you are.

Umami sets no cookies and stores nothing in your browser. We use the analytics data only for statistics about our website. We do not use it for advertising, we do not link it to your Vocamemo account or your newsletter subscription, and we do not sell or share it. Our cloud infrastructure provider processes it on our behalf (see Section 8).

Heatmaps. On every page of our website, the website also loads the Umami recorder. For a share of visits that we choose in Umami, which can be all visits, it records where on the page you click and how far you scroll, with the size of the page and of your window. It records no content of the page and nothing that you type. Recordings of whole visits (session replays) are turned off. We look at heatmaps as a picture of many visits together.

Turning off the analytics. You can turn off the website analytics at any time with the “Turn off analytics” button in the footer of our website (“Wyłącz statystyki odwiedzin” on the Polish website). The website then loads no analytics script in that browser, and keeps your choice in the necessary cookie vocamemo-analytics for 1 year (see Section 6b). The same button then reads “Turn on analytics”. If your browser sends a Global Privacy Control or Do Not Track signal, the website loads no analytics and shows no button. Your choice applies to the browser in which you make it. If you delete the cookies of vocamemo.com, the analytics are turned on again, unless your browser sends one of these signals.

Turning off the analytics stops the collection of new data. The data of your earlier visits contains no name, email address or IP address, so we usually cannot tell which records are yours (Article 11 of the GDPR). It is deleted at the end of the period below.

How long the data is kept. We keep the analytics data for 25 months and then delete it. As with every request to our servers, our cloud infrastructure provider also records the requests to the analytics server in its request logs, which it keeps for up to 30 days (see Section 10).

6d. Crash and Error Reports from the App

When the app crashes or stops responding, or when an error occurs in it, the app sends a technical report to our crash reporting provider. The provider stores the reports in the European Union on our behalf (see Sections 8 and 9). The app also sends a record of each start, so that we know how often it fails.

A report contains the details of the error, the version of the app, technical data about your device and its settings, and the last technical events in the app before the error. Examples of such events are a screen that appeared and a request sent by the app. It also contains identifiers of the installation of the app, which are created for these reports. It does not contain your name, email address or account identifier. The provider works out the country, region and city from your IP address and does not store the address. We use the reports only to find and fix errors in the app.

Turning off the reports. You can turn off the reports at any time in the settings of the app, which is also how you object to this processing (see Section 13). The app then stops sending the reports and the records of its starts. The reports sent earlier do not identify you, so we usually cannot tell which reports are yours (Article 11 of the GDPR). They are deleted at most 90 days after they are received.

7. Legitimate Interests

Where we rely on legitimate interests as a legal basis, we have assessed that our interests are not overridden by your interests or your fundamental rights and freedoms. Specifically:

• Service security and abuse prevention: The request logs of our cloud infrastructure provider contain the IP address and user-agent of each request to our website and servers. We use them to detect unauthorised access, prevent automated abuse, and investigate security incidents. Our own database stores no IP addresses and no user-agents. This processing is limited to what is necessary for these purposes, and the data is not used for profiling or marketing.
• Service reliability: We record technical diagnostics (the type, details and time of an event, for example a setting sent by the app that our server could not read) to find and fix errors in the service. These records contain no IP address and no user-agent, and access to them is restricted.
• Crash and error reports from the app: We need the reports to learn about the crashes and errors in the app on the devices of our users and to fix them, because an app that fails cannot provide the service. The reports are limited to technical data about the app and the device, and we do not add your name, email address or account identifier to them. The IP address is not stored, and each report is deleted at most 90 days after it is received. You can turn the reports off (see Section 6d).
• Improving ExplAIn: Our team may read ExplAIn conversations to check the tutor's answers and to improve ExplAIn and our course content. We do not use ExplAIn conversations to train AI models. Excerpts we keep for this purpose do not contain information that identifies you. Do not share personal or sensitive information in ExplAIn. You can object to this review at any time by emailing privacy@vocamemo.com; we will then stop reviewing your conversations.
• Record of the ExplAIn notice: We store the date you most recently accepted the ExplAIn notice to show that you were informed before using ExplAIn.
• Team links: When you come to our website through a link shared by a member of our team, we store the code of that link with your newsletter subscription, so that we know which content brings visitors to Vocamemo. The code names the team member, not you.
• Languages of subscribers: We store the first language set in your browser with your newsletter subscription, so that we can decide which languages to add to the app and the website.
• Website analytics: We measure how visitors use our website and how they find it, so that we can improve the website and its content. We run the analytics ourselves, without cookies, and the analytics data contains no IP addresses. It shows only general information about your device and your location at city level, we look at it as statistics of many visits, and we do not use it for advertising or share it. You can turn the analytics off at any time with one click, and they stay off when your browser sends a Global Privacy Control or Do Not Track signal (see Section 6c).
• Request logs and form limits: Our cloud infrastructure provider records each request to our website and servers, so that we can keep them running and investigate errors and attacks. Our website also holds the IP address of each submission of a newsletter form in its memory, to allow at most 5 submissions from one address in 10 minutes and so stop automated sign-ups. The logs are kept for a short time, and we do not use them for analytics or marketing.

You have the right to object to processing based on legitimate interests at any time. See Section 13 below.

8. Who We Share Data With

We share personal data only when necessary for the purposes described above:

We do not share your personal data with advertisers or ad networks.

9. International Transfers

We primarily store and process your personal data on infrastructure located in the European Union. The Vocamemo service, our website and its analytics run in the European Union region of our cloud infrastructure provider.

Our cloud infrastructure provider is based in the United States. It may process some data, such as its request logs, in the United States to run its platform. For these transfers we rely on the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

Some services we use (such as Sign in with Apple, Sign in with Google and the App Store) may involve international data transfers. Where transfers occur, we rely on appropriate safeguards under applicable law, including adequacy decisions where available.

When you use ExplAIn, our AI service provider generates the reply in the European Union. Where the provider accesses this data from outside the European Union, we rely on the European Commission's Standard Contractual Clauses.

Our crash reporting provider stores the crash and error reports from the app in the European Union (Germany). The provider is based in the United States and may access the reports from there, for example to keep its service running or to give us support. For these transfers we rely on the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

10. How Long We Keep Data

11. Account Deletion and Restoration

You can delete your account in the app, or ask us to delete it without the app. The steps are on the page Delete Your Vocamemo Account.

When you request deletion of your account:

1. Your account is immediately blocked and all active sessions are revoked. You will be signed out.
2. A 21-day restoration window begins. During this period, your data is retained but inaccessible. If you sign in again during this window, your account will be restored and the deletion cancelled.
3. After the restoration window closes, your data is scheduled for permanent deletion. Permanent deletion is targeted to complete within 30 days of the original request.
4. After permanent deletion, your account data, learning data, and associated records are irreversibly removed. Privacy audit logs may be retained in pseudonymised form for up to 730 days for legal accountability purposes (see Section 10).

12. Data Export

You can export your data from within the app. The export is delivered as a ZIP file containing CSV files of your account and learning records and a JSON file of your ExplAIn conversations, in a structured, commonly used, machine-readable format.

The export does not include newsletter data, which is not linked to your account. To receive a copy of your newsletter data, write to privacy@vocamemo.com.

The export does not include the crash and error reports from the app either, which are not linked to your account (see Section 6d).

13. Your Privacy Rights

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of access (Art. 15): You can request a copy of the personal data we hold about you. You can also generate a data export directly from within the app.
• Right to rectification (Art. 16): You can ask us to correct inaccurate personal data.
• Right to erasure (Art. 17): You can request deletion of your account and personal data. You can initiate this from within the app (see Section 11).
• Right to restriction of processing (Art. 18): You can ask us to restrict how we process your data in certain circumstances.
• Right to data portability (Art. 20): You can receive your data in a structured, commonly used, machine-readable format. The in-app export provides this.
• Right to object (Art. 21): You can object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests. This includes the review of your ExplAIn conversations described in Section 7. You can object to the website analytics at any time with the “Turn off analytics” button at the bottom of our website, or with a Global Privacy Control or Do Not Track signal in your browser (see Section 6c). You can object to the crash and error reports from the app at any time by turning them off in the settings of the app (see Section 6d).
• Right to withdraw consent (Art. 7(3)): You can withdraw your consent to the marketing cookies of our website at any time (see Section 6b). You can also withdraw your consent to receive the newsletter by email at any time, by unsubscribing (see Section 6a).

To exercise any of these rights:

• Use the in-app Export your data feature for a self-service data copy (Art. 15 and 20).
• Use the in-app Delete account option to request erasure (Art. 17).
• Use the Turn off analytics button at the bottom of our website to object to the website analytics (Art. 21).
• Email privacy@vocamemo.com for all other requests, including any request about newsletter data.

We will respond to your request without undue delay and in any event within one month, as required by Article 12(3) of the GDPR. We may need to verify your identity before processing your request.

Right to Lodge a Complaint

If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. The supervisory authority for our operations is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych):

Urząd Ochrony Danych Osobowych (UODO)
ul. Stawki 2, 00-193 Warszawa, Poland
https://uodo.gov.pl

You may also lodge a complaint with the supervisory authority in your EU/EEA Member State of residence or place of work.

Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 of the GDPR).

Vocamemo uses an algorithmic spaced-repetition system to schedule vocabulary review items. This is a core feature of the service and does not constitute automated decision-making under Article 22, as it does not produce legal or similarly significant effects.

14. Children

Vocamemo is not directed to children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at privacy@vocamemo.com and we will take steps to delete that information.

15. Security

We use technical and organisational safeguards designed to protect personal data, including access controls, encrypted storage, and session management controls. No system is perfectly secure, but we continuously work to improve our protections.

16. Changes to This Policy

We may update this Policy when our services or legal requirements change. We will publish the updated version on this page and update the effective and last-updated dates. Where changes are material, we may also provide notice in the app.

17. Contact

For privacy inquiries: privacy@vocamemo.com