How SpeakToScore handles your information

Lear Labs Private Limited is the operator of SpeakToScore and the controller of the personal information described in this Policy, except where a provider acts as an independent controller under its own terms. In this Policy, "we," "us," and "our" refer to Lear Labs Private Limited.

This Policy applies when you visit the website, create or use an account, complete onboarding, record a speaking response, submit written or selected answers, join a Live AI or Coach Mode session, view reports, use Scout, buy a plan, or contact support.

• Account data: name, email address, authentication identifiers, password-reset activity, and account status. Passwords are handled by our authentication provider and are not visible to us in plain text.
• Profile and goals: selected exam, target score, test date, target universities, country or region, study preferences, and onboarding answers.
• Practice content: microphone audio, recordings, transcripts, written answers, selected answers, prompts, Scout messages, and support attachments you submit.
• Performance data: practice scores, criterion scores, fluency and pace measures, pronunciation observations, corrections, report evidence, progress, drills, blockers, readiness estimates, and study recommendations.
• Transaction data: plan, price, currency, payment status, Stripe customer and transaction identifiers, renewal status, billing country, discounts, and limited card details such as brand and last four digits when Stripe makes them available. We do not store full card numbers.
• Device and log data: IP address, browser and device type, operating system, timestamps, requested pages, referring URL, error logs, security events, and approximate region derived from network information.
• Analytics and referral data: page views, clicks, scrolling, navigation paths, campaign parameters, referral source, registration, mock-start and checkout events, advertising cookie identifiers, and session interaction data when optional analytics are enabled.
• Communications: support requests, refund requests, feedback, and other messages you send us.

We collect information:

• directly from you when you register, practice, pay, or contact us;
• automatically from your browser or device when you use the service;
• from Stripe about payments and subscription status;
• from authentication, voice, AI, storage, analytics, and referral providers that process activity for us;
• from a referral partner when you follow a tracked partner link.

The legal basis depends on the information, purpose, and law that applies to you. For users in the EEA and UK, we generally rely on the following bases:

Speaking features require microphone access. Depending on the mode, audio may pass through LiveKit for real-time communication, Deepgram for speech recognition or synthesized examiner speech, Supabase for private recording storage, and Google Gemini for analysis. Writing answers and relevant account context may also be sent to Gemini to generate feedback and Scout responses.

We process voice to transcribe and assess language performance, not to identify or authenticate you by a voiceprint. We do not intentionally create facial-recognition or voice-identification templates. Audio and linguistic observations may still be treated as sensitive information in some jurisdictions.

AI providers process the inputs needed to return an output under their service terms and our configuration. Do not submit confidential information about another person or content you are not authorized to share. AI practice feedback can be wrong and does not have the status of an official exam score.

Our principal provider categories and current providers include:

Supabase

Authentication, database, private file storage, server functions, and account data infrastructure.

Google Gemini

AI analysis of speaking and writing inputs, generated reports, explanations, and Scout responses.

LiveKit

Real-time voice rooms, audio transport, agent sessions, and associated service logs.

Deepgram

Speech-to-text and text-to-speech within real-time voice sessions.

Stripe

Checkout, payment processing, subscription management, billing portal, fraud controls, and refunds.

Google Analytics

Optional website and product measurement.

Microsoft Clarity

Optional heatmaps, interaction analytics, diagnostics, and reconstructed session playback.

PromoteKit

Optional referral attribution and partner conversion measurement.

Meta

Optional advertising conversion measurement through Meta Pixel and Conversions API. Email addresses sent for conversion matching are normalized and SHA-256 hashed by our server before transmission to Meta.

Hosting and delivery providers

Application hosting, content delivery, images, monitoring, and network security.

Providers may change as the service evolves. We require providers to handle information for authorized purposes and subject to applicable contractual and legal protections.

We may disclose relevant information:

• to the providers listed above so they can perform services for us;
• to professional advisers, auditors, insurers, and contractors under confidentiality obligations;
• to courts, regulators, law enforcement, or other parties when reasonably necessary to comply with law or protect rights and safety;
• in connection with a financing, merger, acquisition, reorganization, or sale of all or part of the business, subject to appropriate protections;
• at your direction or with your consent.

We do not sell personal information for money. Optional Meta conversion measurement may be treated as sharing, a sale, or targeted advertising under some US state laws. You can opt out using "Privacy choices" in the footer. We do not disclose your recordings or answers publicly unless you direct us to do so. Provider processing is a disclosure of data and is not the same as making it public.

Essential cookies and browser storage support authentication, security, theme and exam preferences, checkout continuity, consent records, and other features you request. Blocking essential storage can prevent parts of the service from working.

Optional analytics include Google Analytics for page and conversion measurement, Microsoft Clarity for clicks, scrolling, heatmaps, diagnostics, DOM-based session playback, Meta Pixel and Meta Conversions API for registration, mock-start, checkout, purchase, and advertising campaign measurement, and PromoteKit for referral attribution. Meta may set or read identifiers such as _fbp and _fbc. For supported conversion events, browser and server events use the same event identifier so Meta can deduplicate them. Clarity session playback is a reconstruction of page content and interactions rather than a camera recording. Input fields are masked by Clarity, and we configure optional tools to avoid intentionally collecting practice audio or payment-card details.

In the EEA, UK, Switzerland, and other regions where consent is required, these optional tools remain off until you choose "Allow analytics." You can reject them or change your choice at any time using "Privacy choices" in the footer. Withdrawal does not affect processing that occurred lawfully before withdrawal. Your browser can also block or delete cookies.

We use the following retention periods or criteria:

• Account, profile, attempts, reports, transcripts, and recordings: generally while your account is active so you can access history and progress, then deleted or de-identified after account deletion, subject to the exceptions below.
• Incomplete session and processing data: until analysis, troubleshooting, fraud review, or recovery is complete and the data is no longer reasonably needed.
• Billing and transaction records: for the period required by tax, accounting, payment-dispute, anti-fraud, and other applicable laws.
• Support and legal records: for as long as needed to resolve the request, document the response, enforce agreements, or establish legal claims.
• Analytics and referral data: according to our provider configuration, your consent choice, and the provider's applicable retention controls.
• Backups and security logs: until overwritten on ordinary backup cycles or no longer needed for security, continuity, or legal obligations.

We may retain de-identified or aggregated information that can no longer reasonably be linked to you. We periodically review retention needs and aim not to keep identifiable information longer than necessary for the stated purpose.

We use technical and organizational safeguards designed to protect information, including encrypted network connections, access controls, private storage permissions, credential management, service monitoring, and restricted administrative access. Payment-card details are collected by Stripe rather than stored on our application servers.

No online service can guarantee absolute security. You are responsible for protecting your account credentials and should contact us if you believe your account or data has been compromised.

SpeakToScore serves users internationally. Lear Labs Private Limited and our providers may process information in India, the United States, the European Economic Area, and other countries where they operate. Those countries may have different privacy laws.

Where required, transfers are supported by an adequacy decision, contractual protections such as standard contractual clauses, or another lawful transfer mechanism made available by the relevant provider. You may contact us for more information about safeguards applicable to your information.

Depending on your location and the processing involved, you may have the right to:

• access or obtain a copy of personal information we hold about you;
• correct inaccurate or incomplete information;
• delete information, subject to lawful exceptions;
• restrict or object to certain processing;
• receive certain information in a portable format;
• withdraw consent at any time where processing relies on consent;
• appeal a refusal where local law provides an appeal right;
• complain to your local data-protection or consumer authority.

Submit a request through account Settings where available or email us. We may need to verify your identity and authority before completing a request. Authorized agents may submit requests where local law permits. We will not discriminate against you for exercising a privacy right.

In the preceding 12 months, the categories described in Section 2 may have been collected and disclosed for the business purposes described in Sections 4 through 7. These include identifiers, customer records, commercial information, internet or electronic activity, approximate geolocation, audio information, education-related practice information, and inferences such as estimated skill level and study needs.

If a US state privacy law applies to us and to your information, you may have rights to know, access, correct, delete, or obtain a portable copy, and to limit or opt out of certain uses of sensitive information, sale, sharing, targeted advertising, or qualifying profiling. We do not sell personal information for money. Our optional Meta conversion measurement may fall within sale, sharing, or targeted-advertising definitions in some states. Use "Privacy choices" in the footer to opt out. We honor legally required browser-based opt-out signals where applicable to the processing they cover.

SpeakToScore automatically analyzes answers and builds practice profiles, including score estimates, repeated mistakes, readiness indicators, blockers, and recommended exercises. This processing personalizes an educational service you request. It does not make decisions that produce legal effects or similarly significant effects such as admission, employment, credit, insurance, or immigration eligibility.

SpeakToScore is not directed to children under 13, and children under 13 may not create an account or submit personal information. If we learn that we collected personal information from a child under 13 without legally required authorization, we will take steps to delete it.

Users below the age of legal majority must use the service with permission and supervision from a parent or legal guardian. Where local law requires parental consent for a teenager's data processing, the parent or guardian must provide that consent.

You can request account deletion in Settings or by email. Deleting an account removes access and starts deletion of active account records, reports, and stored recordings. Deletion may not immediately remove data from backups, provider systems, transaction records, fraud-prevention records, or information we must retain by law. Those copies remain restricted and are deleted or de-identified when the applicable reason or cycle ends.

Cancel any recurring subscription before deleting the account. Account deletion alone may not cancel a subscription already managed through Stripe if the cancellation step has not completed.

We may update this Policy when our practices, providers, products, or legal obligations change. We will revise the effective date and provide additional notice for material changes where required. If we plan to use information for a materially different purpose, we will provide notice and seek consent where the law requires it.

To ask a privacy question, exercise a right, report a concern, or contact our grievance point, email Lear Labs Private Limited at speaktoscore@gmail.com. Put "Privacy Request" in the subject line and include the email address associated with your account.

If you are in the EEA or UK, you may also complain to the data-protection authority in the country where you live or work, or where you believe an infringement occurred. If you are in India, you may use the grievance and complaint channels available under applicable digital personal-data law after first giving us an opportunity to respond.