Privacy Policy

Locuto.PRO ("us", "we", or "our") operates the Locuto.PRO website and platform (the "Service").

This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use our Service and the choices you have associated with that data.

We use your data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this policy. Where you use the Service through a school or organization, please also read Section 9 (Children and Student Data) and Section 16 (Schools as Data Controllers).

1. Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

Types of Data Collected

Personal Data

While using our Service, we may ask you to provide, or you may choose to provide, certain personally identifiable information that can be used to contact or identify you ("Personal Data"). Depending on how you use the Service, this may include:

• Email address;
• First name and last name;
• Profile picture / avatar (including the profile picture URL when signing in via Google);
• Date of birth (used, among other things, to apply protections for minors);
• Country, time zone, and native language;
• Phone number (optional);
• Gender and a short biography (optional);
• Languages spoken and, for teachers, professional profile details (such as teaching languages, experience, certifications, and rate);
• Learning and engagement data (such as progress, streaks, points, and activity);
• Cookies and Usage Data.

Some of these fields are optional and you control whether they are shown publicly through your profile settings.

Data Collected via Google Sign-In

When you choose to sign in using your Google account, we receive your email address, display name, and profile picture URL from Google. This data is provided by Google based on the permissions you grant during the sign-in process.

We do not access your Google password. Authentication is handled securely through Google's OAuth 2.0 protocol.

Content and Learning Data

To deliver the Service, we store the content you and your school create and use, such as lessons and materials, uploaded media (images, audio, documents, and video), vocabulary and exercise data, homework and student submissions (including text and audio responses), assessments and feedback, attendance and session records, and messages exchanged through the platform.

Lesson Recordings

Where the recording feature is enabled by a school or teacher, live lessons may be recorded (typically a teacher screen-share together with mixed lesson audio). Recordings are produced by our self-hosted live-video system and stored in object storage operated by our hosting provider, and are accessible to the school and authorized members within the relevant organization. Recordings are kept only for a limited retention period and are then automatically deleted (see Section 14).

Usage Data

We may also collect information identifying how the Service is accessed and used ("Usage Data").

This Usage Data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

2. Use of Data

Locuto.PRO uses the collected data for various purposes:

• To provide and maintain the Service;
• To authenticate your identity, including when you sign in using Google;
• To deliver learning features, lessons, recordings, and assessments;
• To notify you about changes to our Service and to send service-related communications;
• To allow you to participate in interactive features of our Service when you choose to do so;
• To provide customer care and support;
• To provide analysis or valuable information so that we can improve the Service;
• To monitor the usage of the Service;
• To detect, prevent and address technical issues, fraud, and abuse.

3. AI Processing

The Service includes features powered by artificial intelligence ("AI"), such as lesson generation, translation, summaries, pronunciation and writing assessment, and AI chat. To provide these features, relevant content — which may include lesson text and student responses (including transcribed audio) — is sent to and processed by third-party AI providers acting on our behalf.

These providers are listed on our Sub-processor list. AI output may be inaccurate and is intended to support, not replace, human teaching and review.

4. Service Providers and Sub-processors

We employ third-party companies ("Sub-processors") to help us provide the Service — for example to host data, process payments, deliver live video and recordings, power AI features, store files, send email, and monitor reliability. These third parties have access to your Personal Data only to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose.

A current, named list of our sub-processors — and the data each one receives — is published on our Sub-processor list page.

5. Analytics and Error Monitoring

To keep the Service reliable and to understand how it is used, we use the following tools:

• Error monitoring (Sentry) — collects diagnostic information when errors occur, which may include your account identifier and email together with technical context, and may include a limited session replay to help us reproduce and fix problems.
• Product analytics (PostHog) — collects usage events and coarse properties such as role, interface language, and country, using a pseudonymous account identifier rather than your email or name. Analytics are only enabled if you accept analytics cookies, and session replay is never enabled for users identified as minors.
• Google Analytics — used only if you choose "Accept All" in our cookie banner (see Section 13).
• Meta Pixel (Facebook) — used only if you choose "Accept All" in our cookie banner (see Section 13). It records page views on the primary Locuto host so we can measure advertising. It is not loaded on school (white-label) domains, and it does not receive your name, email, or other profile fields.

6. Transfer of Data

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction. Some of our sub-processors are located outside the European Economic Area (EEA); where this is the case, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

7. Disclosure of Data

Locuto.PRO may disclose your Personal Data in the good faith belief that such action is necessary to:

• To comply with a legal obligation;
• To protect and defend the rights or property of Locuto.PRO;
• To prevent or investigate possible wrongdoing in connection with the Service;
• To protect the personal safety of users of the Service or the public;
• To protect against legal liability.

8. Security of Data

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure.

While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

9. Children and Student Data

The Service is designed to be used by schools and teachers, whose students may include minors. Where the Service is used by an educational institution, the institution acts as the data controller for its students' data and is responsible for providing any required notices and for obtaining any consent required by law — including parental or guardian consent where the student is below the age of digital consent in their country (which in Poland is 16, and ranges between 13 and 16 across the EEA).

We process student data only as needed to provide the Service to the institution and in accordance with our Data Processing Agreement. We apply additional protections to accounts identified as belonging to minors — for example, we do not enable session-replay analytics for them. We are committed to protecting educational data in accordance with applicable laws (such as the GDPR in Europe and, where relevant, FERPA in the United States), and we do not sell student data.

10. Third-Party Authentication (Google Sign-In)

What We Access

When you use "Sign in with Google," we request access to your basic profile information: your email address, display name, and profile photo. We do not request access to your Google Drive, Gmail, Calendar, or any other Google services beyond basic authentication.

How We Use It

Your Google profile data is used solely to create and maintain your Locuto.PRO account, display your name and profile picture within the application, and communicate with you about your account.

How We Store It

Your email, name, and profile picture URL are stored in our database alongside your Locuto.PRO account record. This data is protected with the same security measures described in Section 8 (Security of Data).

Sharing

We do not sell, rent, or share your Google user data with any third parties for advertising, data brokering, or any purpose unrelated to the operation of this Service.

Revocation

You may revoke Locuto.PRO's access to your Google account at any time by visiting your Google Account permissions page. Revoking access will not delete your Locuto.PRO account, but you will no longer be able to sign in using Google.

11. Google Calendar Synchronization (Optional)

A teacher may connect their own Google Calendar from their profile. This is opt-in per individual teacher — connecting is never done on a school's behalf, and a teacher who teaches at more than one school connects separately for each one. Pressing "Connect" requests Google's calendar-events permission, in addition to the basic sign-in scopes described in Section 10.

What Is Written to Google

When a teacher enables export, each Locuto lesson is written as an event on the calendar they chose, containing the student's display name, the lesson's start and end time, and a link back to the lesson in Locuto. No lesson content, materials, or the student's email address is ever included.

The student is not added to the event as a guest and receives nothing from Google as a result — every event we write to Google explicitly disables guest notifications, as a second, redundant safeguard in case a guest were ever added by mistake.

What Is Read Back from Google

When a teacher enables import, we read back only the busy and free time ranges of the calendar they chose, so that a personal appointment can block a bookable slot. We request this data from Google with a field mask that excludes event titles, descriptions, guests, and locations — Google does not transmit that information to us at all, regardless of how our code behaves. Our own database has no columns capable of storing a title, description, guest list, or location for this data, so nothing of the kind can be retained even by mistake.

One Connection, One School

A calendar connection belongs to one teacher and one school. A school never sees another school's connection, calendar account, or imported busy time; it sees only whether its own teacher is connected and when their calendar last synced.

Disconnecting and Revoking

A teacher can disconnect their calendar at any time from the connection section of their profile. Disconnecting immediately deletes any busy time we imported from that calendar. Lesson events already written to the teacher's personal Google calendar are not deleted automatically, since removing entries from a teacher's own calendar without being asked would be surprising; the disconnect confirmation offers an explicit option to remove them as well.

A teacher can also revoke Locuto's access directly from their Google Account permissions page. The stored token is kept only for as long as the connection stays active; disconnecting — from Locuto or from Google — revokes it and it is not reused.

The provider handling this data ("Google Calendar") is listed separately from Google Sign-In on our Sub-processor list, since the two are independent data flows with different scopes and different data.

12. Google API Services User Data Policy

Locuto.PRO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Limited Use Disclosure

We only use data obtained from Google APIs for the purposes described in this privacy policy (authentication, account management, and optional teacher calendar synchronization). Specifically:

• We do not use Google user data for serving advertisements.
• We do not allow humans to read Google user data unless we have your affirmative agreement, it is necessary for security purposes, to comply with applicable law, or our use is limited to internal operations and the data has been aggregated and anonymized.
• We do not transfer Google user data to third parties unless it is necessary to provide or improve user-facing features that are prominent in the requesting application's user interface, you provide affirmative consent, it is necessary for security or legal purposes, or the data has been aggregated and anonymized.

13. Cookies and Tracking Technologies

Essential Cookies

These cookies are required for the Service to function and cannot be disabled:

• sessionid — maintains your authenticated session after you log in.
• csrftoken — protects against cross-site request forgery attacks.
• cookie_consent — stores your cookie consent preference.

Analytics Cookies

If you consent via our cookie banner, we use analytics tools (see Section 5) to understand how the Service is used. Analytics cookies are only set after you choose "Accept All" in the cookie consent dialog. You may change your preference at any time by clearing your cookies and revisiting the site.

Advertising Cookies

If you choose "Accept All", we also load the Meta (Facebook) Pixel on the primary Locuto host to measure ads and understand which public pages led to use of the Service. Advertising cookies are not set on school domains. You may change your preference at any time by clearing your cookies and revisiting the site.

14. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. If you request deletion of your account, your personal data — including any data obtained from Google Sign-In — will be removed from our systems within 30 days.

Lesson recordings and certain media are kept only for the retention period applicable to your plan or settings and are automatically deleted after that period unless retention is extended. Where a school controls the data, retention is also subject to the school's instructions.

Usage and analytics data may be retained in aggregated, anonymized form for service improvement purposes.

15. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have certain data protection rights under the General Data Protection Regulation (GDPR). Locuto.PRO is based in Warsaw, Poland, and we are committed to respecting these rights.

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of any inaccurate or incomplete personal data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restrict processing — request that we limit how we use your data.
• Data portability — receive your personal data in a structured, machine-readable format.
• Object — object to the processing of your personal data for certain purposes.
• Withdraw consent — withdraw your consent at any time where we rely on consent as the legal basis for processing.

If your data is managed through a school or organization, please direct requests to that institution; we will assist them as their processor. Otherwise, to exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

You also have the right to lodge a complaint with a supervisory authority. For users in Poland, the relevant authority is the UODO (Urząd Ochrony Danych Osobowych) at uodo.gov.pl.

16. Schools as Data Controllers

When you use the Service through a school or organization, that institution is the data controller for the personal data it manages (including its teachers' and students' data), and Locuto.PRO acts as its processor, processing data on documented instructions in accordance with our Data Processing Agreement. The institution's own privacy notice may apply in addition to this policy.

17. Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site.

We strongly advise you to review the Privacy Policy of every site you visit.

18. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective.

19. Contact Us

If you have any questions about this Privacy Policy, please contact us at [email protected].