Privacy Policy

1. Introduction

YKI Swedish Coach ("we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our Service.

We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. If you have any questions about this policy, please contact us at the email address provided at the end of this document.

2. Data Controller

The data controller responsible for your personal data is:

YKI Swedish Coach
Representative: [To be added when available]
Location: European Union

3. Data We Collect

3.1 Account Data

When you register for an account, we collect:

• Email address
• Name (from Google OAuth)
• Google profile ID
• Account creation date

3.2 Usage Data

When you use the Service, we collect:

• Voice recordings (for speaking exercises)
• Written text (for writing exercises)
• Exercise history (attempts, scores, AI-generated feedback)
• Progress tracking data

3.3 Billing Data

For paid subscriptions, we collect:

• Subscription status (active, cancelled, past_due)
• Stripe customer ID
• Note: Payment card details are processed and stored exclusively by Stripe. We do not have access to your full payment card information.

3.4 Analytics Data (with your consent)

If you consent to analytics cookies, we collect via PostHog:

• Page views, clicks, and navigation patterns
• Session recordings (production environment only)
• Device and browser information
• Anonymized usage statistics

3.5 Error Logs (with your consent)

If you consent to error monitoring cookies, we collect via Sentry:

• Error messages and stack traces
• Session replays when errors occur
• Technical diagnostics for debugging

4. How We Use Your Data

4.1 Service Delivery

We use your data to provide the core functionality of the Service:

• AI Grading: Your voice recordings and written text are processed by OpenAI (Whisper, GPT-4o, TTS) and Google (Gemini) to provide automated feedback and grading.
• Progress Tracking: Your exercise history and scores are stored in our database to track your learning progress over time.
• Account Management: Your email and profile data are used for authentication and account management via Better Auth.

4.2 Payment Processing

• Stripe: Handles all payment processing and subscription management. We receive only your subscription status (active/cancelled/past_due) and do not store payment card details.

4.3 Analytics (Optional, with Consent)

• PostHog: Analyzes how you use the Service to improve features and user experience. Session recording helps us identify usability issues.

4.4 Error Monitoring (Optional, with Consent)

• Sentry: Detects and logs errors to help us fix bugs and improve Service stability. Session replays help us reproduce and debug errors.

4.5 Email Communications

• Transactional Emails: We send account verification emails and password reset emails via Resend. These are necessary for the Service to function.
• Marketing Emails (Future): We plan to introduce optional marketing emails in the future. You will be able to opt-in to receive product updates, tips, and promotional content. Marketing emails will always include an unsubscribe link.

5. Legal Basis for Processing (GDPR)

We process your data based on the following legal grounds:

• Contract Performance: Processing is necessary to provide the Service you signed up for (AI grading, progress tracking, account management).
• Consent: You explicitly consent to analytics, error monitoring, and future marketing communications.
• Legitimate Interest: We have a legitimate interest in preventing fraud, ensuring Service security, and maintaining Service stability.

6. Data Sharing & Third Parties

We share your data with the following third-party service providers to deliver the Service:

6.1 AI Processing

OpenAI

• Services: Whisper (speech-to-text), GPT-4o (grading), TTS (pronunciation examples)
• Data Sent: Voice recordings, written text, exercise context
• Processing: Temporary processing only. Data is deleted immediately after grading is complete.
• Training Opt-Out:We have configured our OpenAI API to opt out of using your data for model training. Your data will not be used to improve OpenAI's models.
• Location: USA (Standard Contractual Clauses apply for GDPR compliance)

Google Gemini

• Service: Gemini 3.1 Flash Lite Preview (voice grading)
• Data Sent: Voice recordings, transcriptions, exercise context
• Processing: Temporary processing only. Data is deleted immediately after grading is complete.
• Location: USA/Global (Google Cloud infrastructure)

6.2 Payment Processing

Stripe

• Purpose: Payment processing and subscription management
• Data Shared: Email address, payment methods
• Data Stored by Stripe: Full payment card details (we do not have access)
• Location: USA (GDPR compliant)

6.3 Analytics (With Consent)

PostHog

• Purpose: Usage analytics and session recording
• Data Shared: Page views, clicks, anonymized user behavior
• Location: USA

6.4 Error Monitoring (With Consent)

Sentry

• Purpose: Error tracking and session replay
• Data Shared: Error logs, stack traces, session context
• Location: USA

6.5 Email Delivery

Resend

• Purpose: Transactional email delivery (verification, password reset)
• Data Shared: Email address, email content
• Location: USA

7. Data Retention

• Active Accounts: Your data is stored indefinitely while your account is active.
• Deleted Accounts: If you request account deletion, we will manually delete your data. Please contact our support team to request deletion.
• AI Processing: Voice recordings and written text sent to OpenAI and Google are deleted immediately after grading is complete. These providers do not retain your data.
• Backups: Deleted data may persist in system backups for up to 30 days after deletion.
• Legal Obligations: We may retain certain data longer if required by law (e.g., billing records for tax purposes).

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your account and all associated data. Contact support to exercise this right.
• Right to Data Portability: Request a download of your data in JSON format.
• Right to Withdraw Consent: Change your cookie preferences at any time (see Section 9).
• Right to Object: Object to processing based on legitimate interest.
• Right to Lodge a Complaint: File a complaint with your local EU data protection authority if you believe we have violated your rights.

To exercise any of these rights, please contact us at the email address provided at the end of this document. We will respond to your request within 30 days as required by GDPR.

9. Cookies & Tracking

We use the following types of cookies:

9.1 Essential Cookies (Always Active)

These cookies are required for the Service to function:

• Authentication Session: Better Auth session cookie to keep you logged in.
• Cookie Consent Preferences: Stores your cookie consent choices.

9.2 Optional Cookies (Require Consent)

These cookies require your explicit consent:

• PostHog: Analytics and session recording cookies.
• Sentry: Error monitoring and session replay cookies.

9.3 Manage Your Cookie Preferences

You can change your cookie preferences at any time by clearing your browser's local storage for this site. This will cause the cookie consent banner to reappear on your next visit.

10. International Data Transfers

YKI Swedish Coach operates from the European Union. However, some of our third-party service providers (OpenAI, Google, Stripe, PostHog, Sentry, Resend) are based in the United States.

When we transfer your data outside the EU, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs): GDPR Article 46 approved clauses for data transfers to non-EU countries.
• Service Provider Compliance: All third-party providers are GDPR compliant and have appropriate data protection measures in place.

11. Data Security

We take the security of your data seriously and implement industry-standard security measures:

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
• Encryption at Rest: Your data is encrypted when stored in our database.
• Secure Authentication: We use Better Auth and Google OAuth for secure account access.
• Regular Updates: We keep our software and dependencies up to date with security patches.

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security against all possible threats.

12. Children's Privacy

Our Service is intended for users aged 16 and above. If you are under 16 years old and reside in the European Union, you must have parental or guardian consent to use the Service.

We do not knowingly collect personal data from children under 16 without parental consent. If you believe a child has provided personal data without consent, please contact us immediately and we will delete the data.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for legal, operational, or regulatory reasons.

When we make material changes, we will notify you via email or through an in-app notification. Continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

The "Last Updated" date at the top of this page indicates when the policy was last revised.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

YKI Swedish Coach
Email: [Contact email to be added]

We will respond to all data protection inquiries within 30 days as required by GDPR.