Privacy Policy

Your privacy matters to us. At Language Lab we follow a few simple principles:

• We collect only what we need to teach you a language and to run and protect the service.
• We keep personal information only for as long as we have a reason to keep it.
• We do not sell your personal information for money, and we do not use your conversations or voice recordings to train AI models.
• We tell you plainly which companies help us, where your information goes, and why.
• You stay in control: you choose optional cookies, you can delete conversations, and you can ask us to access, correct, export or delete your information at any time.

Below is our Privacy Policy, which puts those principles into detail.

1. Who we are and what this policy covers

Language Lab is operated by Settlebuddy Technologies, Building No. 3871, Mauli Jagran Complex, Chandigarh 160102, India (“we”, “us”, “our”). We are the controller (in some laws, the “data fiduciary” or “business”) responsible for your personal information. We are established in India only and have no branch, office or other establishment in the European Union, the European Economic Area, Switzerland or the United Kingdom. We have not appointed a data protection officer because the laws that apply to us do not currently require one; privacy questions go to the contacts in section 17. Our representative in the European Union under Article 27 GDPR is Prateek Singh, reachable at [email protected].

This policy applies when you use:

• our website language-lab.io and its language versions, including our blog, guides, phrasebooks and tools;
• the Language Lab web app, including lessons, exercises and flashcards, workbooks, Street Smart scenarios, graded news, the Pronunciation Coach, Sonia (our AI conversation tutor), progress and certificates, the Earn Lessons programme and any beta or invite-only version of the app;
• emails, messages and support conversations with us.

Together we call these the “Services”. This policy does not cover third-party websites or services that you open from Language Lab — for example Google sign-in, the Dodo Payments checkout, YouTube or social networks. They have their own privacy policies. SettleBuddy (settlebuddy.io), another product of Settlebuddy Technologies, has its own privacy policy.

2. Creative Commons licence

This Privacy Policy is adapted from the privacy policy published by Automattic Inc. in its Legalmattic repository under the Creative Commons Attribution-ShareAlike 4.0 International licence. We have rewritten it to describe our own practices. In keeping with that licence, you may copy and adapt this policy under the same licence, provided you credit Automattic and Language Lab and describe your own practices.

3. Information we collect

We collect information in three ways: when you give it to us, automatically when you use the Services, and from other sources.

3.1 Information you give us

• Account information. Your name, email address and password when you create an account. The password is stored in hashed form by our authentication provider; we never see it. You also enter your date of birth at sign-up. It is checked to confirm you meet our minimum age, and we store only the result (that you meet the minimum age and whether you are under 18), not the date itself.
• Profile information. Your WhatsApp number (optional in the app; asked for on our website’s early-access form), the language you are learning, your level, the language you speak, the country you are moving to and when, whether you are planning a move or already abroad, and how you heard about us. You can also give a separate, optional consent to hear about other Settlebuddy Technologies products such as SettleBuddy.
• Learning information. Your answers, scores, lesson history, streaks, goals, saved words, flashcard schedule, pronunciation results and settings. If you generate a certificate, the name you enter is saved to your account.
• Conversations with Sonia. The messages you type, your voice when you speak to Sonia (see section 5), transcripts of what you said, Sonia’s replies and corrections. Sonia also keeps learning notes about you so she can pick up where you left off: the first name you told her, personal facts you mentioned (for example your job, city or plans), short summaries of your past conversations in each language written by the AI, the mistakes you make most often and how often, how many sessions you have had, your last scenario and the vocabulary level she speaks at.
• Pronunciation recordings. Short recordings you make in the Pronunciation Coach and in speaking exercises.
• Photos you choose to share in photo-based practice.
• What you agree to. When you accept our Terms and Privacy Policy at sign-up, tick the box before paying, confirm you are 18 or older for Bestie mode, see the AI notice or declare your age, we record what you agreed to, which version, and when.
• Replies you report. If you report one of Sonia’s replies, we keep that reply, the reason you picked, the language, Sonia’s style and the time — not your account or the rest of the conversation.
• Earn Lessons programme. Your social media handle, the platforms you follow us on, links to your posts, the posts themselves (including any video, images, voice and your appearance in them), screenshots you upload as proof, and any product ideas you send us. Screenshots may show other people’s names or comments — please crop out anything we don’t need.
• Purchases. Paid plans are sold by Dodo Payments, which acts as our merchant of record and processes your payment. We receive the payment reference, the email address used at checkout, the plan purchased and whether the payment succeeded, was refunded or was disputed. We do not receive your full card number.
• Communications. Messages you send us (for example support questions, complaints, feedback or privacy requests) and our replies.
• Waitlist and invitations. If you joined our earlier beta waitlist: your email, name, WhatsApp number, target language, whether you follow us on social media, your consent choices and your country (derived from your IP address at sign-up). Joining never required agreeing to marketing. If you received a personal invitation link: the email address of the approved account the link is tied to, and how much of each trial feature (for example Sonia minutes or lessons) you have used.

Your name, email address, password (unless you use Google sign-in) and confirmation of your age are required to create an account, and microphone access is required for voice features. Everything else is optional or collected only when you use the related feature. If you don’t provide required information, we can’t provide the account or feature that needs it.

3.2 Information we collect automatically

• Log and device information. Like most online services, our hosting and security providers receive information your browser sends, such as IP address, browser and operating system, device type, language setting, referring page and the date and time of your request.
• Security and abuse-prevention records. Counters that limit how often a feature can be used, keyed to your IP address, account ID or invitation; when an invitation link is opened, the time, IP address and browser type; and reports of blocked content-security events.
• Learning activity. Only if you allow analytics: events such as which lesson or exercise you opened, whether an answer was right and how long it took, linked to your account if you are signed in. We use these to find broken lessons and improve practice. That you acknowledged the AI notice is always recorded, because the law asks us to show it.
• Error reports. If something breaks, the error message, technical details, the page and your browser type. No identifier is attached.
• Analytics — only with your consent. If you allow analytics: pages you view, clicks and other interactions, performance measurements and, for a sample of sessions, a session replay in which all on-screen text and everything you type is masked. When you are signed in, analytics is linked to your account ID (not your name or email). See our Cookie Policy.
• Advertising measurement — only with your consent. If you allow marketing, advertising tags from Meta, Google (Google Ads), TikTok and LinkedIn record visits and sign-ups so we can measure and improve our advertising. They never run in the Android app or for under-18s.
• Page-performance measurement. Cloudflare Web Analytics measures how fast our pages load without using cookies or tracking individual visitors.
• Approximate location. Your country, derived from your IP address.
• Cookies and similar technologies. See our Cookie Policy.

3.3 Information we receive from other sources

• Google sign-in. If you sign in with Google, we receive your name, email address, profile picture and Google account identifier. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
• Dodo Payments. Payment status and the details listed under “Purchases” above.
• Social platforms. When we verify an Earn Lessons claim, we look at the public post and follow status you point us to.
• SettleBuddy. Language Lab and SettleBuddy (settlebuddy.io) are both run by Settlebuddy Technologies and share one sign-in system. If you use SettleBuddy’s housing service, you use the same account: signing in there with Google can create your account, and SettleBuddy reads your name, WhatsApp number and relocation details from your Language Lab profile to fill in your move profile so you don’t have to type them again. SettleBuddy’s own privacy policy explains what it does with that information.

4. How and why we use information

4.1 Purposes

• To provide the Services: create and secure your account, deliver lessons, exercises, audio and certificates, run Sonia and the Pronunciation Coach, keep your progress in sync across devices, and grant the plan you bought.
• To personalise your learning: choose the next lesson, adapt how Sonia speaks to you, and bring back words you struggle with.
• To keep the Services safe and fair: prevent fraud, abuse and spam, enforce plan limits, protect our systems, and — in Sonia — respond to signs that you may be at risk.
• To fix and improve the Services: diagnose errors, find lessons that don’t work, and — with your consent — understand how people use the product.
• To communicate with you: send account, security, purchase and service messages, answer questions and complaints, and — only if you opted in — tell you about new features or other Settlebuddy Technologies products.
• To advertise Language Lab: to show posts from people who claimed an Earn Lessons reward in our marketing, as the programme terms describe, and — only with your consent — to measure whether our ads work.
• To comply with the law and protect rights: keep required records, respond to lawful requests, handle privacy requests and complaints, and establish or defend legal claims.

4.2 Legal bases (EU, UK, Swiss and similar laws)

No decisions with legal effect. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The vocabulary level Sonia speaks at and our practice recommendations are automated personalisation; they do not affect your rights, price or access.

4.3 Personalisation and automated estimates

These features analyse your learning activity to adapt Language Lab to you. None of them decides your price, access, eligibility or anything else with a legal or similarly significant effect, and you can change or reset their results.

These include the placement quiz, spaced repetition for flashcards and pronunciation, pronunciation scores, the vocabulary level Sonia speaks at, “what to do next” suggestions and the short notes Sonia keeps. Most run on your own device; Sonia’s notes are produced by our AI provider. You can reset Sonia’s notes or delete a conversation at any time.

4.4 Our legitimate interests

Where we rely on legitimate interests — keeping the Services secure, fixing faults, filling in your SettleBuddy move profile, and defending legal claims — we use only what those purposes need, keep it briefly, and never use it for advertising. You can object at any time by emailing us, and we stop unless we have compelling reasons that outweigh your interests or need it for legal claims.

5. Sonia, voice and AI features

You are talking to an AI, not a person. Sonia is an artificial intelligence system. We tell you this before your first conversation. Sonia can make mistakes — double-check anything important.

5.1 What is sent, to whom, and why

• Text conversations. Your message, recent conversation history, your level and Sonia’s learning notes are sent from our servers, through our AI gateway on Google Cloud in the EU (Belgium), to Google Cloud so that Sonia can reply. Google processes this data on our behalf as our service provider.
• Voice conversations. When you talk to Sonia, recordings of your spoken turns — and, while live transcription is on, the audio stream from your microphone — are sent through our own service on Google Cloud in the EU (Belgium) to Google. They are sent with your account ID so we can apply time limits, and are used to transcribe what you said, let Sonia hear your pronunciation and generate her reply. If Google’s transcription is unavailable, the recording is transcribed on our own speech-recognition server instead. As a last resort your browser’s built-in speech recognition may be used; your browser provider (for example Google for Chrome or Apple for Safari) then processes that audio under its own terms.
• Sonia’s voice. The text of Sonia’s replies is sent to Google to produce her voice. Other lesson audio is produced by Google or by our own text-to-speech server, or taken from our prepared audio library. Only the text to be spoken is sent.
• Pronunciation Coach. Your recording, the phrase you practised, the language and the language you speak are sent to our own pronunciation-scoring server in the EU. Pronunciation recordings are not sent to Google or any other AI company.
• Photo practice. The photo you take is sent with your message through our AI gateway to Google so Sonia can talk about it. We don’t store it.
• Grammar and dictionary help. Words from your messages and from Sonia’s corrections, and the first 300 characters of a grammar question you ask, are looked up in our own grammar reference database, which runs on our AI gateway on Google Cloud in the EU (Belgium). Nothing that identifies you is sent with them. Word definitions and recordings are served from our own systems.
• Translations of learning content, and of words you tap to look up, are produced on our own translation server in the EU. To avoid translating the same text twice, translations are stored for up to 180 days without any link to you.
• Lessons are prepared by our systems from the language, level and topic you choose; no personal information is used to create them.

5.2 What we and our AI provider do not do

• We do not use your conversations, transcripts or recordings to train or fine-tune AI models, and Google’s terms prohibit it from using them to train its models.
• We do not create voiceprints and do not use your voice to identify you, verify your identity or distinguish you from other speakers. Recordings are used only to understand what you said and to give you feedback. We do not use your voice or accent to infer characteristics such as ethnicity, health or emotions.
• We do not use your conversations to build advertising profiles, and we do not sell them.

5.3 How long AI data is kept

• Conversation text and transcripts are saved to your account so you can reopen past conversations on any device. They stay until you delete the conversation or your account.
• Sonia’s learning notes stay until you reset them or delete your account.
• Voice and pronunciation recordings are processed in memory and are not stored by us after your turn has been transcribed or scored.
• Google may keep inputs in temporary memory for up to 24 hours to speed up responses, and — only if its automated safety systems flag possible abuse — may keep the flagged prompts for up to 90 days solely to investigate misuse.

5.4 Please don’t share sensitive information

You don’t need to share health, financial, government ID, political, religious or sexual-life information to learn a language, and we ask you not to. If you do, we process it only to reply to you and it is stored with the rest of that conversation until you delete it.

5.5 Safety

If you tell Sonia that you are thinking about harming yourself or someone else, Sonia pauses the lesson and shows you contact details for crisis services. We keep a count of how often safety messages are shown (without the content of your conversation) where the law requires us to report it. Sonia is not a therapist, doctor or emergency service. If you are in danger, contact your local emergency number.

6. How we share information

We share personal information only in the limited situations below.

6.1 Service providers that work for us

These companies process information on our behalf under contracts that require them to protect it and use it only to provide their services to us.

6.2 Companies that decide how to use data themselves

• Dodo Payments is the merchant of record for paid plans. It processes your payment and billing details as an independent controller under its own privacy policy.
• Meta Platforms — only if you allow marketing. For the data collected by the Meta Pixel on our site, we and Meta are joint controllers; Meta then uses that data under its own privacy policy.
• Google (Google Ads), TikTok and LinkedIn — only if you allow marketing. For the data their advertising tags collect on our site, we and each of them are joint controllers; each then uses that data under its own privacy policy.
• Google, when you choose Google sign-in, under Google’s privacy policy.
• Content you load: when you play a video, your browser connects to YouTube, which receives your IP address and browser information.
• WhatsApp (Meta), if we contact you on WhatsApp or you message us there.

6.3 Other situations

• Legal requirements. We may disclose information if we believe in good faith it is required by law, court order or a valid request from a public authority. We check whether requests are lawful and disclose only what is necessary.
• Protection. To protect the safety, rights or property of you, other people, the public or us — for example in an emergency involving risk of death or serious harm.
• Business transfers. If our business or its assets are sold, merged or reorganised, personal information may be transferred to the new owner, who must continue to protect it in line with this policy. We will tell you before that happens where the law requires it.
• With your consent or at your direction — for example when you use a share button.
• Aggregated or de-identified information that can no longer reasonably identify you.

We do not sell your personal information for money. Under some US state laws, allowing advertising and analytics partners to collect information through cookies can count as “selling” or “sharing”; see section 11.4 for how to opt out.

7. Information that becomes public

Posts you publish on social media for the Earn Lessons programme are public on those platforms. When you claim a reward for a post, you also give us a permanent right to use it in our own marketing — on our website and app, our social channels and in advertising — as Annex B of our Terms explains. That permission is a condition of the programme and you can’t take it back afterwards; the reward is what you receive for it. Screenshots you upload as proof are stored privately and viewed by our team to check your claim. We do not publish your profile, progress or conversations.

8. International transfers

We are based in India and our providers operate in the European Union, the United States and other countries, so your information may be processed outside the country where you live. Where the law requires, we protect transfers with appropriate safeguards. These include the European Commission’s standard contractual clauses (with the UK and Swiss addenda), the EU–US Data Privacy Framework and its UK and Swiss extensions for certified US companies, the standard contractual clauses approved by Brazil’s ANPD, or other lawful mechanisms. You can ask us for more information about these safeguards and about the data-protection laws of the countries involved. Some countries — for example Türkiye, Vietnam, Jordan and Egypt — add their own transfer conditions, and a few require certain data to stay in the country. We follow the rules that apply to you.

9. How long we keep information

The table below is the summary; Annex A is the full schedule, including what we keep after an account closes and why.

We keep information only as long as we need it for the purposes above, then delete or anonymise it. Most periods below are enforced automatically by a daily clean-up job.

10. Security

No online service is 100% secure, but we work hard to protect your information against unauthorised access, use, alteration or loss. Our measures include encryption in transit (HTTPS), encryption at rest by our hosting providers, database rules that let an account read only its own data, signed and expiring session tokens, limits on sensitive endpoints, restricted administrative access and secret management. If a personal data breach occurs, we will notify the relevant authorities (for example the EU or UK supervisory authority, the Indian Computer Emergency Response Team and the Data Protection Board of India) and affected people as and when the law requires. The measures described in this section are our reasonable security practices and procedures for personal information handled in India. If a breach affects your information, we tell you and the authorities within the time limits the law sets.

11. Your choices and rights

11.1 Choices you can make at any time

• Cookies and tracking: accept or reject optional categories in the banner, and change your mind with “Cookie settings” in the footer. We honour the Global Privacy Control (GPC) signal as an opt-out of advertising.
• Microphone: you can type instead of speaking, and you can revoke microphone permission in your browser.
• Conversations: delete any conversation in Sonia.
• Sonia’s notes and your account: reset Sonia’s notes or delete your account in the app, or email us.
• Marketing: unsubscribe using the link in any marketing message or by contacting us. You can stop WhatsApp messages at any time by telling us or leaving the chat. We will still send essential account and service messages.
• Limit what you provide: optional profile fields are optional; some features won’t work without the information they need (for example Sonia can’t hear you without microphone access).

11.2 Rights everyone has with us

Wherever you live, you can ask us to: tell you what personal information we hold about you and give you a copy (including in a portable format); correct it; delete it; stop or restrict certain uses; and withdraw consent. Withdrawing consent doesn’t affect processing that already happened. We don’t charge for requests and we won’t treat you differently for making one.

How to make a request: email [email protected] from the email address on your account, or use the options in the app. To protect you, we may need to verify your identity before acting. You can authorise someone else to make a request for you in writing; we may still verify with you directly. We respond within the time the law that applies to you requires — generally within one month (45 days in US states), and we tell you if we need longer. If we refuse a request, we explain why and how to appeal: reply to our decision within 60 days; we review the request again and tell you the outcome and our reasons within 45 days. If we still refuse and you live in a US state that gives you this right, you can contact your state attorney general.

We answer within the time the law where you live sets, and in any case within one month. If a request is complex we tell you before that month is out, with how much longer we need.

Verifying requests. If you ask from the email address on your account or while signed in, that is usually enough. For requests about someone else, or to delete or copy sensitive information, we may ask you to confirm from your account email. An authorised agent must show your signed permission, and we may still confirm with you directly.

11.3 European Economic Area, United Kingdom and Switzerland

You have the rights of access, rectification, erasure, restriction, data portability and objection under the GDPR, UK GDPR or Swiss FADP. You may object at any time to processing based on our legitimate interests, and to direct marketing. You can complain to your local data-protection authority — in the EEA, listed by the European Data Protection Board; in the UK, the Information Commissioner’s Office; in Switzerland, the FDPIC. If you are in the UK, you can also complain to us first: we acknowledge complaints within 30 days, look into them without undue delay, keep you informed and tell you the outcome.

11.4 United States

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia, Texas, Oregon, New Jersey and others), you may have rights over your personal information. They can include the right to know, access, correct and delete it, to receive it in a portable format, to opt out of targeted advertising, “sale” or “sharing”, and to appeal our decision on your request. This section is also our notice at collection for California residents. Even where these laws do not yet apply to us because of their size thresholds, we offer these rights to all US residents.

Sources: you, your device, Google sign-in, Dodo Payments, social platforms and SettleBuddy. Purposes: those in section 4. Retention: as in section 9. We use sensitive personal information only to provide the Services and keep them secure, not to infer characteristics about you, so the right to limit its use does not apply. We do not knowingly sell or share the personal information of anyone under 16, and advertising and analytics are switched off for accounts of people under 18.

Opt out of sale/sharing and targeted advertising: use Cookie settings to turn off Marketing and Analytics, or enable the Global Privacy Control in your browser. Because the choice is stored in your browser, repeat it on each browser and device. If we deny your request you can appeal as described in 11.2, and if you disagree with the result you may contact your state attorney general. California residents may also ask whether we disclose personal information to third parties for their direct marketing purposes — we don’t.

11.5 India

Under the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023 as its provisions come into force, you have rights over your personal data. You can access and correct it, ask for it to be erased, withdraw consent, nominate another person to exercise your rights if you die or become incapacitated, and have your grievances redressed. Once the DPDP Rules’ consent provisions apply, we will show a separate, itemised consent notice at sign-up.

Grievance Officer
Prateek Singh, Grievance Officer, Settlebuddy Technologies
Email: [email protected] (subject line “Grievance”)
Address: Building No. 3871, Mauli Jagran Complex, Chandigarh 160102, India
We acknowledge grievances within 48 hours, give you a reference number and resolve them within one month. If you are not satisfied, you may approach the Data Protection Board of India once it accepts complaints.

11.6 Other countries

• Brazil (LGPD): confirmation, access, correction, anonymisation, blocking or deletion, portability, deletion of data processed with consent, information about who we share data with, information about your option not to consent and its consequences, and withdrawal of consent (LGPD art. 18); complaints to the ANPD. Contact for data-protection matters: [email protected].
• Canada (PIPEDA and Quebec Law 25): access, correction and withdrawal of consent; complaints to the Office of the Privacy Commissioner of Canada or Quebec’s Commission d’accès à l’information. Person in charge of the protection of personal information: Prateek Singh, Grievance Officer, [email protected].
• Australia: access and correction under the Australian Privacy Principles; complaints to the OAIC. Personal information may be disclosed to recipients in the countries listed in section 8.
• Japan (APPI): business operator: Settlebuddy Technologies, Building No. 3871, Mauli Jagran Complex, Chandigarh 160102, India. You can request disclosure (including electronically), correction, cessation of use, deletion and records of third-party provision; our security measures are summarised in section 10; complaints to us or to the Personal Information Protection Commission.
• South Korea, South Africa, Switzerland, Türkiye, Vietnam and elsewhere: you can exercise the rights your local law gives you by contacting us, and complain to your national data-protection authority.
• Everywhere else: you can exercise whatever rights your national law gives you by emailing us, and complain to your national regulator. We keep a country-by-country record of those rights and deadlines and answer within the time your law sets.

12. Children and teenagers

Language Lab is not directed at children. You must be at least 16 to create an account, and older where your country requires it. Sonia’s “Bestie” mode, the Earn Lessons programme and our community channels are 18+. We do not knowingly collect personal information from anyone under 16. For accounts under 18, advertising, analytics, session replay and profiling are off whatever was chosen in the cookie banner. If we learn that someone is below the minimum age, we close the account, delete its personal information within 30 days and refund any plan in full. Parents and guardians can email us with the subject “Minor account”. Annex E explains how we check age and which features are 18+.

13. Advertising and analytics provided by others

If you consent, Meta, Google, TikTok and LinkedIn place their own technologies on our site to measure advertising and usage. These companies may recognise your browser across other websites and services and use that information under their own policies. You can control this through our Cookie settings, the GPC signal, your browser settings and the tools those companies provide.

14. Third-party software and services

When you use a third-party service through Language Lab — Google sign-in, the Dodo Payments checkout, YouTube videos, social networks or share buttons — that service may collect information about you under its own policies. We don’t control those services and encourage you to read their policies.

14.1 Our social media pages and WhatsApp community

We have pages on Instagram, Facebook, LinkedIn, TikTok and X, and a WhatsApp community. When you visit or interact with them, the platform processes your information under its own privacy policy. For the anonymous statistics Meta (Facebook, Instagram) and LinkedIn give us about visits to our pages (“Page Insights”), we and that platform are joint controllers. The platform has taken on responsibility for informing you and handling your rights requests under its Page Insights controller addendum, and we will pass any request you send us to the platform. If you join our WhatsApp community, the community admins — and, in groups where members can see each other, other members — can see your phone number, profile name and messages. Don’t share sensitive information there, and you can leave at any time.

15. Changes to this policy

We may update this policy, for example when we add features or when laws change. We will update the date at the top. If a change is significant, we will tell you in the app or by email before it takes effect and, where the law requires, ask for your consent again.

16. Translation

This policy is written in English. If you would rather read it in another language, use any translation tool you like — where a translation and the English text differ, the English text applies.

17. How to reach us

Questions, requests or complaints about privacy: [email protected].
Postal address: Settlebuddy Technologies, Building No. 3871, Mauli Jagran Complex, Chandigarh 160102, India.
This policy has five annexes: A — retention schedule, B — companies that process data for us, C — voice & audio, D — US state privacy notice and E — age requirements.
See also our Terms of Service, Cookie Policy, Subscriptions, Renewals & Refunds, AI & Sonia Notice and Legal Notice.

Adapted from Automattic’s Legalmattic privacy policy (CC BY-SA 4.0). This document is licensed under CC BY-SA 4.0.

Annex A — Data retention schedule

A.1 How we decide how long to keep information

• We keep personal information only as long as we need it for the purpose we collected it for, or as long as a law requires.
• When that time ends we delete it or anonymise it so it can no longer identify you.
• If you delete something yourself — a conversation, your learning notes or your account — we delete our copy on the timeline below, not at the end of the normal period.

A.2 Schedule

A.3 When we keep information longer

• Legal duties: for example tax and accounting records, and the 180-day log period required by India’s CERT-In Directions.
• Disputes and investigations: information needed for a legal claim, a regulator’s inquiry, a security incident or a law-enforcement request we are required to answer, until the matter is closed.
• Your instructions: if you ask us to keep something — for example during a complaint — we keep it until the matter is resolved.

A.4 How we delete

• Records are deleted from live databases; files are removed from storage.
• Backup copies are overwritten on our providers’ normal cycle and are never restored just to use deleted data.
• Where we anonymise instead of delete, we remove identifiers and combine records so they can’t reasonably be linked back to you.

A.5 Your choices

You can delete Sonia conversations in the app, reset Sonia’s learning notes, change cookie choices at any time and delete your account in Settings. You can also ask us to delete specific information by emailing [email protected].

Annex B — Companies that process data for us

These are the companies that process personal information on our behalf to run Language Lab. They may use it only to provide their services to us, under written agreements that require confidentiality and security. For what we collect and why, see our Privacy Policy.

B.1 Service providers (processors)

B.2 Companies that use data for their own purposes

These are not our subprocessors: they decide themselves how to use the information, under their own privacy policies.

B.3 Changes to this list

• We update this page before a new subprocessor starts processing personal information, and at least 30 days before for providers that handle account data or conversations — except where we must switch providers urgently to keep the Services secure or available, in which case we update it as soon as possible.
• The date at the top shows when the list last changed.
• You can ask for a copy of the data-protection terms we have with any provider, or object to a change, by emailing [email protected] with the subject “Subprocessors”. If you object and we can’t address it, you can close your account and we refund the unused part of a paid plan.

Annex C — Voice & audio notice

The short version

• We use your microphone only when you tap a microphone button in a speaking feature, and only after your browser or phone has asked your permission.
• Your voice is used to understand what you said and to give you feedback on your pronunciation — nothing else.
• We don’t create voiceprints, don’t identify or verify you by your voice, and don’t use your voice to guess things like your age, gender, ethnicity, health or emotions.
• We don’t keep your recordings after they have been processed, and nobody uses them to train AI.
• You can always type instead of speaking.

C.1 When the microphone is used

Only when you tap a microphone button in a speaking feature: talking to Sonia (and live transcription while you speak), the Pronunciation Coach, speaking steps in lessons and exercises, and saying a line in Street Smart. Sonia’s audio goes through our AI gateway to Google; pronunciation recordings go only to our own scoring server in the EU (see section 5.1).

Recordings travel encrypted (HTTPS). We record only while you are using a speaking feature — the microphone indicator in your browser shows when it is on.

C.2 What we don’t do with your voice

• We don’t create a voiceprint, speaker model or any template of your voice, and we don’t match your voice against other recordings.
• We don’t use your voice to identify you, to verify your identity, to tell you apart from other speakers or to sign you in.
• We don’t analyse your voice or accent to infer age, gender, ethnicity, nationality, health, emotions or any other personal characteristic. Pronunciation feedback compares sounds with the target language only.
• We don’t sell, rent, lease or trade recordings or anything derived from them, and we don’t disclose them to anyone except the providers named in section C.1 who process them for us.
• We don’t use recordings, transcripts or scores to train or fine-tune AI models, and Google’s Cloud terms don’t allow Google to use them to train its models.

C.3 Your agreement, and how to change your mind

• Browser permission: your browser also asks whether Language Lab may use the microphone. You can block or reset that permission at any time in your browser settings.
• Withdrawing: block microphone access in your browser or phone settings. You can keep using Sonia by typing; the Pronunciation Coach and speaking steps then won’t be available.
• Other people: don’t record other people. If someone else is speaking near you, pause the microphone.

C.4 What Google does with Sonia’s voice turns

Google Cloud processes Sonia’s voice turns for us as our service provider. Under its terms, Google doesn’t use them to train its models. Google may hold inputs in memory for up to 24 hours to answer faster, and — only if its automated systems flag possible abuse — keep flagged inputs for up to 90 days to investigate misuse.

C.5 Retention and destruction policy

This section is our public written policy for voice data.

• Recordings: processed in memory and deleted as soon as the turn has been transcribed or scored. They are not written to our databases, file storage or logs.
• Transcripts: the text of what you said to Sonia is kept with that conversation until you delete the conversation or your account (see our Privacy Policy).
• Pronunciation scores: the scores (not the audio) are kept with your learning progress until you delete your account.
• Recordings you send us yourself (for example to report a bug): deleted within 30 days after we close your request.
• Biometric identifiers: we don’t collect them. If a feature ever needed one, we would first update this notice, get your written consent, and destroy the identifier when its purpose is met and in any case within one year of your last interaction with that feature.
• Security incidents: if voice data is ever involved in a security incident, we handle it under our incident-response plan and notify authorities and affected people as the law requires.

C.6 Age

Voice features are available from 16, like the rest of Language Lab, and are subject to any higher age or parental-permission rule where you live. Sonia’s “Bestie” mode, which can be used by voice, is 18+.

C.7 Questions

Email [email protected] with the subject “Voice data”. Settlebuddy Technologies, Building No. 3871, Mauli Jagran Complex, Chandigarh 160102, India.

Annex D — US state privacy notice

This notice is for people who live in the United States. It adds the details that US state privacy laws ask for to our Privacy Policy. If the two differ for a US resident, this notice applies.

D.1 Which laws this covers

Twenty US states have comprehensive consumer privacy laws in 2026: California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Most apply only to businesses above a size threshold — often 35,000 or 100,000 residents of the state — while Texas and Nebraska apply to most businesses that are not small businesses, and since 1 July 2026 Connecticut applies to any business that sells personal data or processes sensitive data, whatever its size.

We give every US resident the rights in this notice, whether or not a particular state’s law applies to us yet.

D.2 Notice at collection

When you use Language Lab we collect the categories of personal information in section D.3, for the purposes in section 4 of our Privacy Policy, and keep each category for the periods in section 9 of our Privacy Policy. We do not sell personal information for money. If you allow Analytics or Marketing cookies, some online identifiers and activity are disclosed to Google and Meta in a way that US laws may treat as a “sale” or “sharing” for targeted advertising — you can opt out at any time (section D.5). We don’t collect sensitive personal information to infer characteristics about you.

D.3 Personal information we collected in the last 12 months

We don’t collect Social Security, driver’s licence or passport numbers, financial account numbers, precise geolocation, biometric identifiers, health information, genetic data, or information about racial or ethnic origin, religion, union membership, sex life or sexual orientation. Please don’t share such information in conversations with Sonia (see section D.5.4 of our Privacy Policy).

D.4 Sensitive personal information

The only sensitive personal information we collect under California law is your account log-in, which we use only to let you sign in and keep your account secure. We don’t use or disclose sensitive personal information for any other purpose, so the California right to limit its use doesn’t apply. We do not create voiceprints or use your voice to identify you (see our Voice & Audio Data Notice). If we ever need to process sensitive data under a state law that requires consent, we will ask for your consent first.

D.5 “Sale”, “sharing”, targeted advertising and profiling

• What may count as a sale or sharing: if you turn on Marketing in Cookie settings, the advertising tags of Meta, Google Ads, TikTok and LinkedIn send your browser identifier and site events (page views, sign-ups, trial starts and purchases) to those companies to measure and target our advertising; if you turn on Analytics, Google Analytics receives your browser identifier and activity. Some state laws treat this as a “sale”, “sharing” or targeted advertising.
• Third parties that may receive it: Meta Platforms, Inc., Google LLC, TikTok and LinkedIn Corporation. Where your state gives you the right to a list of the specific third parties we have sold personal data to, this is that list.
• How to opt out: turn off Marketing and Analytics in Cookie settings, or turn on the Global Privacy Control in your browser. A “Your Privacy Choices” link in the footer is planned. When we detect the Global Privacy Control, advertising and measurement pixels stay off and the cookie settings panel shows that your signal was honoured. Because the choice is stored in your browser, repeat it on each browser and device.
• Profiling: we don’t use profiling to make decisions that produce legal or similarly significant effects about you (for example about jobs, housing, credit, insurance, education admission or healthcare). Level estimates and practice suggestions only personalise your learning.
• Minors: the minimum age for Language Lab is 16, and some features are 18+. We don’t knowingly sell or share the personal information of anyone under 18 or use it for targeted advertising, and Analytics and Marketing stay off for any account marked as under 18, whatever was chosen in the cookie banner.
• AI training: we don’t collect, use or sell personal data to train large language models or other AI models.

D.6 Your rights

D.7 How to make a request

• Where: email [email protected] with the subject “US privacy request”, or use the privacy options in the app.
• Verification: we verify requests by matching them to the email address on your account and, for access to specific pieces of information or deletion, by asking you to confirm through a link sent to that address. We ask only for information we need to verify you and use it only for that purpose.
• Authorised agents: an agent can make a request for you with your signed written permission (or a power of attorney). We may ask you to verify your identity directly and confirm that you gave the agent permission.
• Timing: we confirm receipt within 10 business days and respond within 45 days. If we need up to 45 more days, we tell you why within the first 45.
• Appeals: if we refuse all or part of your request, reply to our decision within 60 days. We respond within 45 days, explain our reasons in writing and tell you how to contact your state attorney general if you disagree.
• Cost: free, unless requests are manifestly unfounded or excessive, in which case we explain why before charging or refusing.

D.8 De-identified information

When we de-identify information, we keep it in de-identified form, don’t try to re-identify it except to test our de-identification methods where the law allows, and require anyone we share it with to do the same.

D.9 Notice of financial incentive — Earn Lessons

Earn Lessons programme
What you get: free lessons (for example 2 lessons for a post with 5 comments, 4 for 10 comments, 10 for 25 comments) or, for posts with at least 10,000 views and 30 comments, a surprise reward such as free lessons, free Sonia time or a free plan period.
Personal information involved: your social media handle, the platforms you follow us on, links to your posts, screenshots you upload as proof, and your account details.
How to join: the Earn Lessons page; taking part is optional and you opt in by submitting a claim.
How to leave: stop taking part at any time and ask us to delete your claims and screenshots by emailing [email protected]. Rewards you have already received stay valid.
Value of your data: we estimate the value of the personal information we collect for a claim as between US$0 and US$216.00, calculated by the value of the reward to us — the price of the lesson time we give, up to one year of the Pro plan (12 × US$18.00). The reward is reasonably related to that value.

D.10 More for California residents

• Shine the Light (Civil Code §1798.83): we don’t disclose personal information to third parties for their own direct marketing purposes.
• Do Not Track: browsers’ “Do Not Track” setting has no agreed standard, so we don’t respond to it; we do honour the Global Privacy Control as described in section D.5.
• Minors under 16: we don’t sell or share their personal information.
• Accessibility: this notice is available in a format that works with screen readers; contact us for another format.

D.11 Nevada and consumer health data laws

• Nevada: we don’t sell covered information as defined in Nevada law. You can still ask us not to by emailing [email protected].
• Consumer health data (for example Washington’s My Health My Data Act, Nevada SB 370 and Connecticut’s consumer health data rules): Language Lab doesn’t collect consumer health data. Pronunciation scores measure how closely your speech matches the target sounds and aren’t health assessments.

D.12 Changes and contact

We update this notice when the way we handle voice data changes, and change the date at the top. Questions or requests: [email protected] · Settlebuddy Technologies, Building No. 3871, Mauli Jagran Complex, Chandigarh 160102, India.

Annex E — Age requirements

The short version

• You can use Language Lab from 16. Where your country sets a higher age, or asks for a parent’s permission first, that applies instead.
• Sonia’s “Bestie” mode is 18+. It is off until you switch it on and confirm you are an adult.
• Under 18, advertising, analytics and profiling are off for your account, whatever the cookie banner says.
• Under 16, we don’t want an account at all. If we find one, we close it and delete what we hold.
• Parents can email us with the subject “Minor account”.

E.1 Minimum age

You must be at least 16 to create an account or use the Services. Where the law where you live sets a higher age for online services, for entering a contract, or for the data processing behind a feature, that higher age applies to you — and where it asks for a parent’s or guardian’s permission first, you need that permission before you use Language Lab. We don’t offer accounts that a parent creates and manages for a younger child.

E.2 Features that are adults only

• Sonia’s “Bestie” mode (18+). It uses strong language and teasing humour about your mistakes. It is off by default. The first time you turn it on, you tap once to confirm that you are 18 or older; we keep that confirmation on your account with its date and time, so you are asked only once. You can switch it off again at any time, and it switches itself off for the rest of a session if Sonia’s safety checks see signs that you may be at risk.
• The Earn Lessons programme (18+), because taking part means giving us rights over what you post and receiving something of value for it.
• Our WhatsApp community and social channels (18+).

Everything else — lessons, exercises, workbooks, Street Smart, the Pronunciation Coach, graded news and Sonia in her normal style — is open from 16.

E.3 How we check age

• At sign-up (email or Google) you enter your date of birth. We use it only to check that you meet the minimum age and to know whether you are under 18, and we keep just those two results — not the date itself.
• For Bestie mode you confirm separately that you are 18 or older before it turns on. An account we know to be under 18 can’t switch it on at all.
• Stronger checks where required. Where a law or regulator requires more than a self-declared age, or where there are clear signs that an account belongs to someone younger than they said, we may ask for age assurance using a method that confirms only whether you meet the age.
• Marketing. We don’t market Language Lab to children, advertise on services directed at children, or work with child-oriented influencers.

E.4 If we learn that someone is under the minimum age

• We close the account and delete its personal information within 30 days, keeping only what the law requires, and refund any plan in full.
• If someone under 18 turned on an adults-only feature by giving a false age, we switch that feature off as soon as we know, and keep the account under the protections below.

E.5 Parents and guardians

If you think your child has an account, or has given us personal information, email [email protected] with the subject “Minor account”. Tell us the email address used and your relationship to the child. We check the request without asking for more personal information than necessary, act as quickly as we can, and confirm what we deleted. You can also ask what information we held, and ask us to switch off any adults-only feature.

E.6 Protections for accounts under 18

• No advertising pixels, no analytics, no session replay and no profiling for advertising, whatever choices were made in the cookie banner, and never any sale or sharing of personal information.
• No Bestie mode. Sonia’s safety protocol applies to every conversation, and reminds you more often that she is an AI and that it’s time for a break.
• No Earn Lessons programme and no invitation to our WhatsApp community.
• Marketing emails and messages are off.

E.7 Contact

Settlebuddy Technologies, Building No. 3871, Mauli Jagran Complex, Chandigarh 160102, India · [email protected]