Privacy Policy

This policy applies to visitors, learners, account holders, support users, community nominators, nominees, reviewers and invited native voice contributors who use Speak Bisaya.

For information processed to operate Speak Bisaya, the operator identified on Business & Operator Details acts as the data controller, business or personal information controller as those concepts are defined under applicable law. Service providers may process information on our behalf.

Privacy requests can be made through the in-app Support page or the published privacy/contact details. Account deletion can be requested at Account deletion.

• Account information: email address, display name, role, sign-in and verification records, account settings and security events.
• Learning information: learner language, goals, level, placement results, lesson progress, answers, mistakes, review schedule, achievements, saved phrases, preferences and learning activity.
• Subscription information: plan, billing currency, subscription status, trial dates, discount eligibility, Stripe customer/subscription references and transaction status. Speak Bisaya does not store full card numbers or card security codes.
• Support and feedback: messages, issue reports, attachments and other information you choose to send.
• Technical and security information: device/browser information, approximate session timing, pages or features used, app events, diagnostics, error information, security signals and IP-related information that may be available to hosting or security providers.
• Audio and speech information: learner microphone input where a speech feature is intentionally used, and recordings submitted by native voice contributors.
• Community nomination information: nominator name/email, relationship, nominee name, general location, contact information, story, requested support, consent status, verification notes and any approved public summary.
• Public-content contributions: profile photographs, biographies, recordings or other material intentionally supplied for publication by authorised contributors.

We collect information directly from you, automatically through the app and its essential infrastructure, from payment and authentication providers, and from authorised contributors or nominators. We do not knowingly buy consumer data for advertising profiles and we do not sell personal information.

We process personal information only for identified purposes. Depending on the law that applies, our legal basis may be performance of a contract, steps requested before entering a contract, legitimate interests, consent, compliance with a legal obligation, protection of users and the service, or another lawful basis recognised locally.

• To create and secure accounts, authenticate users and prevent fraud or abuse.
• To provide, personalise and save lessons, review schedules, pronunciation tools and progress.
• To operate trials, subscriptions, discounts, billing support and payment reconciliation.
• To provide support and investigate technical, safety, quality or security problems.
• With consent where required, to measure whether features work and improve the learning experience using privacy-limited optional product analytics.
• To review, prepare, quality-control and publish authorised native-speaker recordings and public educational content.
• To review community nominations, obtain consent, prevent fraud and administer approved support.
• To comply with tax, accounting, consumer, privacy, security, court or regulatory obligations.

Some learner speech tools can work locally in the browser or device. Where audio remains local, Speak Bisaya does not receive or retain the recording. Browser or operating-system speech recognition may still be subject to the device or browser provider's own privacy practices.

If a cloud or server-based speech feature uploads learner audio, the interface must disclose that fact before use. Unless a user separately agrees to retention, learner speech sent solely for an assessment is intended to be processed for the requested result and deleted or allowed to expire according to the configured provider and service retention period.

Automated or AI-assisted tools may process prompts, curriculum text or learner inputs to provide feedback, translations, suggested responses or support. We seek to minimise personal information sent to such systems. Automated learning scores and suggestions are educational aids and are not used to make legal, employment, credit, insurance or similarly significant decisions about learners.

Recordings submitted by invited native contributors may be retained for review, publication, version history, quality control and course continuity under the applicable contributor arrangement. Technical processing can include trimming, noise reduction, normalisation, format conversion and quality analysis.

We disclose personal information only as reasonably necessary to operate, secure and support Speak Bisaya, to comply with law, or with your direction or consent. Providers can include Base44 for application hosting and data services, Stripe for payments and billing, authentication providers, email infrastructure, analytics/error tooling, and approved speech or AI services used by enabled features.

We may disclose information to professional advisers, regulators, courts, law enforcement or other parties where required by law or reasonably necessary to establish, exercise or defend legal rights, prevent fraud, respond to security threats or protect people.

We do not sell personal information or share it for cross-context behavioural advertising. We do not use third-party advertising cookies.

Speak Bisaya is available internationally and service providers may process information in countries different from your own. Where UK GDPR or EU/EEA GDPR rules apply, we use an available lawful transfer mechanism where required, such as an adequacy decision, approved standard contractual clauses, the UK International Data Transfer Addendum/Agreement or another legally recognised safeguard.

For Philippine personal data transferred abroad, we remain responsible for using reasonable and appropriate contractual, organisational and security safeguards consistent with the Data Privacy Act and applicable National Privacy Commission requirements.

We keep personal information only for as long as reasonably necessary for the purpose collected, including providing an active account, resolving disputes, preventing fraud, meeting tax/accounting requirements and maintaining lawful records.

Following a verified deletion request, account and learner-owned learning data is processed for deletion without undue delay and within any period required by applicable law, unless retention is legally required or necessary for a legitimate unresolved matter. Where service-provider backups contain residual copies, those copies may remain isolated until they expire under the provider's ordinary backup-retention cycle and are not restored for ordinary product use. Transaction, tax, fraud, security and legal-claim records may be kept longer where required or reasonably necessary.

Approved public curriculum content is not normally learner personal data. Native recordings and approved contributor material may remain published after the contributor account closes where permitted by the contributor arrangement and applicable law.

If UK GDPR or EU/EEA GDPR applies, you may have rights to be informed, access personal data, correct inaccurate data, request erasure, restrict processing, object to certain processing, receive portable data, withdraw consent at any time where consent is the basis, and not be subject to certain solely automated decisions with legal or similarly significant effects.

You also have the right to complain to your local supervisory authority. In the UK this is the Information Commissioner's Office. In the EU/EEA, you may contact the supervisory authority in the member state where you live, work or believe an infringement occurred.

US privacy rights vary by state. Where an applicable state privacy law grants you rights, these may include access/confirmation, correction, deletion, portability, opting out of sale or certain sharing/targeted advertising, and appealing a denied request. Because Speak Bisaya does not sell personal information or use cross-context behavioural advertising, those opt-out categories may not apply to our present practices.

We do not discriminate against users for exercising applicable privacy rights. Where legally required, an authorised agent may submit a request subject to verification.

Where the Philippine Data Privacy Act applies, data subjects may have rights including to be informed, object, access, correct, erase or block data in appropriate circumstances, obtain data portability where applicable, lodge a complaint with the National Privacy Commission and seek damages where provided by law.

We seek to follow the principles of transparency, legitimate purpose and proportionality and to use reasonable organisational, physical and technical safeguards for personal data.

Speak Bisaya is educational and may be used by families. We do not knowingly sell children's personal information or use it for behavioural advertising. Children under 13 must not create an account or submit personal information. Public, no-account educational material may be used by younger children with appropriate adult supervision.

Users aged 13–15 must have parent or legal-guardian authorisation for an account. Where local law requires an older age for independent digital consent, guardian authorisation is required until that age. For UK users, we aim to apply the Age Appropriate Design Code principles where relevant. For EU/EEA users, the locally applicable age of digital consent applies. Our under-13 account restriction is intended to avoid knowingly operating an account service for children under 13 without the verifiable parental-consent controls required by US COPPA.

If you believe a child has created an account or provided personal information contrary to these rules, contact Support so we can investigate and delete or restrict it where appropriate.

Speak Bisaya uses essential cookies and browser storage for sign-in, security, preferences and core app operation. Optional product analytics are off unless you allow them. We do not currently use advertising cookies or cross-site behavioural tracking. More detail is available in the Cookie and Local Storage Notice, and you can withdraw or change analytics consent at any time on Privacy Choices.

We use measures such as encrypted transport, role-based access controls, restricted administrative functions, server-side subscription checks, authentication protections, review gates and provider security controls. No online service can guarantee absolute security. Suspected unauthorised access or security incidents should be reported promptly through Support.

Where a personal-data breach creates a legal notification obligation, we will assess it and notify the appropriate regulator and affected individuals within the time required by applicable law, including UK/EU GDPR and Philippine data-protection rules where relevant.

You can change many preferences in Settings, change optional analytics consent through Privacy Choices, cancel Premium through Billing and request deletion through the account-deletion page. Where processing is based on consent, withdrawing consent is available without affecting the lawfulness of processing before withdrawal. For other privacy rights, contact Support and identify the request. We may need to verify identity before providing, changing or deleting information.

We aim to respond within the period required by the law that applies to your request. Some requests may be refused or limited where a recognised legal exception applies, in which case we will explain that where legally required.

We may update this policy as the product, providers or legal requirements change. The page will show the latest revision date. We will provide additional notice or obtain fresh consent where required by law.