Privacy Policy

SpanishPal is operated by Windvale LLC, a company registered in the United States.

For most consumer accounts, Windvale LLC is the controller, business, or organization responsible for determining why and how personal information is processed. Where SpanishPal is provided through a school, employer, university, or another organization, that organization and Windvale LLC may have different privacy roles as described in the applicable agreement and any notice provided by the organization.

Questions about this policy or our privacy practices may be sent to [email protected].

SpanishPal is designed to give you meaningful control over your learning information. Depending on the features available in your account, you can:

• delete selected learning and conversation records;
• clear all learning and conversation data in one action;
• delete and close your account through your account settings;
• request access to, correction of, or a copy of your personal information;
• withdraw optional permissions and marketing consent; and
• contact us about a privacy concern or request.

We do not sell private voice recordings, conversation content, transcripts, learning records, or account credentials for monetary consideration or cross-context behavioral advertising.

The information we collect depends on how you interact with SpanishPal and which features you use.

We collect personal information:

• directly from you when you register, communicate, practice, make a purchase, or select account settings;
• automatically when you use our website, learning tools, or related services;
• from payment, authentication, hosting, AI, speech, analytics, email, security, and customer-support providers;
• from a school, employer, university, or another organization that creates or manages your access;
• from integrations you choose to connect; and
• through cookies and similar technologies, subject to applicable consent requirements.

We may use personal information to:

• create, authenticate, secure, and administer accounts;
• provide voice and text conversation practice;
• transcribe speech, generate AI responses, and produce audio playback;
• provide pronunciation guidance, grammar corrections, alternative phrases, and learning feedback;
• personalize exercises, scenarios, tutors, recommendations, and the learning experience;
• save learning history, measure progress, and support CEFR-aligned assessments and certificates;
• process subscriptions, purchases, refunds, invoices, and billing support;
• provide customer support and respond to privacy requests;
• send account, transaction, service, security, and policy notices;
• diagnose errors, maintain availability, and improve service reliability and effectiveness;
• prevent fraud, abuse, unauthorized access, and violations of our terms;
• maintain records required for accounting, taxation, disputes, and compliance;
• establish, exercise, or defend legal claims; and
• comply with applicable law and valid legal requests.

We will not use personal information for a materially different purpose without providing additional notice and obtaining consent where required by law.

Where the EU General Data Protection Regulation, UK GDPR, or comparable law applies, we rely on one or more of the following legal bases:

Performance of a contract

We process information needed to create your account, provide requested learning features, maintain your subscription, respond to support requests, and deliver the Services.

Legitimate interests

We may process information to secure and improve SpanishPal, prevent fraud, understand service performance, provide customer support, and protect users and our business, provided those interests are not overridden by your rights and freedoms.

Consent

We rely on consent where required for non-essential cookies, marketing communications, optional device permissions, or other optional processing. You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal.

Legal obligations

We may process and retain information to meet tax, accounting, consumer-protection, regulatory, security, and other legal obligations.

Some information is necessary to provide the Services and cannot be treated as optional. Where required, we will explain the consequences of not providing necessary information.

SpanishPal uses artificial intelligence, speech recognition, text-to-speech, and language-processing technologies to provide conversations, pronunciation support, and learning feedback.

To provide these features, relevant portions of your text, audio, transcript, selected language, and conversation context may be sent to contracted AI, speech, hosting, or infrastructure providers. We expect service providers to process information only for authorized service purposes and to apply appropriate confidentiality and security protections.

SpanishPal does not use your identifiable private conversation content or voice recordings to train publicly available general-purpose AI models unless we provide clear additional notice and obtain any consent required by law.

We may use aggregated or appropriately de-identified information to evaluate and improve SpanishPal. We do not attempt to re-identify information that has been properly de-identified.

SpanishPal may automatically generate corrections, estimated proficiency levels, progress indicators, or certificates. These outputs are intended to support language learning. They are not used by SpanishPal to make decisions producing legal or similarly significant effects concerning employment, credit, housing, insurance, immigration, or access to essential services.

Purchases may be processed by one or more independent payment processors or merchants of record identified during checkout, on your invoice, or on the payment confirmation page.

The payment provider may independently collect your name, billing details, payment card or payment account information, billing country, tax information, fraud-prevention information, transaction details, and other information required by payment, financial, tax, or anti-fraud laws.

The payment provider’s collection, use, and retention of payment information is governed by its own privacy notice and legal obligations.

Deleting your SpanishPal account does not require an independent payment provider to delete transaction records it must retain under payment, taxation, accounting, anti-fraud, or other laws.

SpanishPal may use cookies, local storage, software development kits, pixels, and similar technologies.

Strictly necessary technologies

These support login, security, session management, interface language, payment flow, fraud prevention, and saved privacy preferences.

Functional technologies

These remember interface choices and learning preferences.

Analytics technologies

These help us understand traffic, feature performance, errors, and general usage patterns.

Advertising or measurement technologies

These are used only where implemented, disclosed, and permitted by applicable law.

Where consent is required, non-essential technologies should not be activated until you make a choice. You may accept, reject, or customize non-essential technologies and later change your selection through any cookie or privacy settings we make available.

Where required by applicable U.S. privacy law, we recognize legally valid browser-based opt-out preference signals, such as Global Privacy Control, for activities legally treated as a sale, sharing, or targeted advertising.

10.1 Service Providers

We may use contracted providers for cloud hosting, data storage, AI processing, speech recognition, audio generation, authentication, email delivery, customer support, security, fraud prevention, application monitoring, error reporting, analytics, subscriptions, and account administration.

10.2 Payment Providers

We disclose or receive information necessary to process payments, manage subscriptions, provide invoices, handle refunds, prevent fraud, and resolve payment disputes.

10.3 Schools, Employers, and Other Organizations

Where an organization provides your access, relevant administrators may receive enrollment status, account activity, learning progress, usage statistics, and certificate information, subject to the applicable agreement and notice. We do not provide organization administrators with private conversation content unless such access is necessary for the organizational service, authorized by the applicable arrangement, and appropriately disclosed.

10.4 Legal and Safety Disclosures

We may disclose information where we reasonably believe it is necessary to comply with law or valid legal process, protect users or the public, investigate fraud or security incidents, enforce agreements, or establish, exercise, or defend legal claims.

10.5 Business Transactions

If Windvale LLC is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, personal information may be reviewed or transferred as part of that transaction, subject to appropriate confidentiality and legal protections.

10.6 At Your Direction

We disclose information when you ask us to do so, such as when you share a certificate, export information, connect an integration, or otherwise authorize access.

Your account, learning history, voice recordings, transcripts, and private conversations are not public by default.

Some features may allow you to create a shareable certificate, verification page, link, or other result. Information becomes available to recipients when you choose to share it or configure it as public.

Anyone who receives a shared link may be able to copy or redistribute the information. Where an available control permits it, disable or delete a shared item when you no longer want it to be accessible.

Windvale LLC is based in the United States. Personal information may therefore be processed in the United States and in other countries where our service providers operate. Those countries may have privacy laws that differ from the laws in your country.

When required for transfers from the European Economic Area or United Kingdom, we use recognized safeguards that may include:

• an applicable adequacy decision;
• European Commission Standard Contractual Clauses;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission Standard Contractual Clauses; or
• another transfer mechanism permitted by applicable law.

The EEA includes the EU member states together with Iceland, Liechtenstein, and Norway. This means the EEA framework covers major Nordic markets including Denmark, Finland, Sweden, Iceland, and Norway.

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. The criteria we consider include:

• whether your account remains active;
• whether the information is needed to provide a feature you use;
• your deletion choices and learning-history settings;
• the sensitivity and volume of the information;
• security, fraud-prevention, dispute, and chargeback requirements;
• contractual obligations and applicable limitation periods; and
• tax, accounting, payment, consumer-protection, and other legal requirements.

In general:

• account and profile information is retained while your account is active and as needed afterward for legitimate or legal purposes;
• learning and conversation information is retained until you delete it, clear your learning data, delete your account, or it is otherwise no longer needed;
• audio and transcripts associated with a deleted learning record are removed from active systems, subject to limited backup, security, fraud-prevention, and legal exceptions;
• support correspondence may be retained for service quality, dispute resolution, and security purposes;
• transaction, tax, refund, and accounting records may be retained for the period required by applicable law;
• security and fraud-prevention logs may be retained for a reasonable protective period; and
• de-identified or aggregated information may be retained where it can no longer reasonably identify you.

When information is deleted from active systems, residual copies may remain temporarily in secure backups until those backups are overwritten according to the normal backup cycle. Backup information is not used for ordinary business purposes and is restored only where necessary for disaster recovery, security, legal compliance, or service continuity.

14.1 Delete Individual Learning Records

You may delete selected conversations, exercises, messages, recordings, or other learning records through the applicable history or account interface. Deleting a record removes the associated learning content from your active account, subject to limited backup, security, fraud-prevention, and legal exceptions.

14.2 Clear All Learning Data

SpanishPal provides a control that allows you to clear all learning data in one action. Depending on the information stored in your account, this may include:

• conversation history, text responses, and voice recordings;
• transcripts, corrections, feedback, and pronunciation records;
• practice activity, progress information, and personalized learning context; and
• other learning records linked to your account.

Clearing learning data does not necessarily delete your login account, subscription status, transaction records, support correspondence, or information that must be retained for legal, payment, accounting, fraud-prevention, or security purposes.

14.3 Delete Your Account

You may delete and close your SpanishPal account through your account settings. Account deletion removes or de-identifies personal information associated with your account, except information we must or are permitted to retain for payment and tax records, fraud prevention, account security, legal compliance, dispute or chargeback handling, enforcement of agreements, legal claims, and secure backup cycles.

Account deletion is generally irreversible. Before confirming deletion, download any available learning records or certificates you wish to retain.

Depending on your location and applicable law, you may have the right to:

• know whether we process your personal information;
• access personal information we hold about you;
• receive information about how it is used and disclosed;
• receive a portable copy in a structured, commonly used format;
• correct inaccurate or incomplete information;
• delete personal information;
• restrict certain processing;
• object to processing based on legitimate interests;
• withdraw consent;
• opt out of sale, sharing, targeted advertising, or certain profiling where applicable;
• limit certain uses of sensitive personal information where applicable;
• request information about automated processing;
• use an authorized agent where permitted;
• appeal the denial of a privacy request where provided by law;
• complain to a privacy regulator; and
• exercise your rights without unlawful discrimination or retaliation.

Privacy rights are not absolute. For example, we may retain information needed to complete a transaction, comply with law, prevent fraud, protect security, or establish or defend legal claims.

We may need to verify your identity before completing a request and will request only information reasonably necessary for verification. We respond within the period required by applicable law, which is often within 30 days or one calendar month, subject to permitted extensions.

To exercise a right, email [email protected] with the subject line Privacy Request. Where an appeal right applies, you may reply with the subject line Privacy Appeal.

U.S. categories of personal information

Depending on how you use SpanishPal, the categories we may collect include identifiers; customer and commercial information; internet or electronic network activity; approximate location inferred from an IP address; audio and electronic information; educational or professional information supplied through an organization; inferences about language level, learning preferences, or progress; and sensitive personal information such as account login credentials or sensitive content you voluntarily submit.

We use and disclose these categories for the purposes and to the recipient categories described in this policy. SpanishPal does not sell personal information for monetary consideration. We do not sell or share private voice recordings, conversation content, transcripts, learning records, or account credentials for cross-context behavioral advertising.

If we introduce an activity that applicable U.S. law treats as a sale, sharing, targeted advertising, or qualifying profiling, we will provide any required notice and opt-out method before or at the time the activity begins.

SpanishPal consumer accounts are not directed to children under 13 years of age. A child under 13 must not create an independent consumer account or submit personal information unless SpanishPal has implemented an authorized parent, guardian, or school process that complies with applicable law.

Schools or organizations wishing to provide SpanishPal to younger students must contact us and enter into an appropriate written arrangement before such use.

In the EEA and United Kingdom, the age at which a child may independently consent to certain online processing may vary under applicable law. Where consent is the legal basis and the user is below the applicable age, authorization from a parent or guardian may be required.

If we learn that personal information was collected from a child in violation of applicable law, we will take reasonable steps to delete the information and close or restrict the account. We do not knowingly sell or share the personal information of users under 16 for cross-context behavioral advertising.

We use reasonable administrative, organizational, and technical safeguards designed to protect personal information against unauthorized access, use, disclosure, loss, theft, alteration, destruction, account takeover, and misuse.

Safeguards may include access controls, authentication controls, encryption where appropriate, secure transmission, logging, monitoring, backups, incident-response procedures, staff controls, and contractual protections for service providers.

No online service or storage system can guarantee absolute security. You are responsible for protecting your account credentials and notifying us promptly if you believe your account has been compromised.

Where required by law, we will notify affected users and appropriate authorities of a qualifying personal data breach.

We may send transactional or service-related communications concerning account registration, authentication, security, purchases, subscriptions, privacy requests, support, feature changes, service interruptions, and policy updates. These communications are necessary to administer the Services and may not include an unsubscribe option.

We send promotional or marketing communications only where permitted by law. You may unsubscribe using the link in the message or by contacting [email protected].

Unsubscribing from marketing does not stop account, security, billing, legal, or service communications.

SpanishPal may contain links to third-party websites, integrations, app stores, social platforms, payment pages, or services.

Independent third parties operate under their own privacy notices. This policy does not control how a third party collects or uses information after you leave SpanishPal or interact directly with that provider.

Review the relevant third-party privacy notice before providing personal information.

We may update this Privacy Policy to reflect changes to the Services, technologies, service providers, legal requirements, security practices, or our privacy practices.

The revised policy will display an updated “Last Updated” date. Where a change materially affects your rights or how we use personal information, we will provide additional notice through the website, account interface, or email where appropriate.

We will request consent before applying a materially new use where consent is required by law.

For privacy questions, requests, or complaints, contact:

Privacy Team
Windvale LLC
United States
Email: [email protected]

Please use one of the following email subject lines where applicable: Privacy Request, Privacy Complaint, Privacy Appeal, or Account Deletion Request.

We will review and respond to privacy requests or complaints within the time required by applicable law. You may also complain to the privacy or data protection authority responsible for your location.