Privacy Policy

1. Who we are

¡Vamos! ("we", "us") is a small independent Spanish-learning service operated from Norway and available at vamosespanol.com. For the purposes of the EU/EEA General Data Protection Regulation (GDPR), the operator of ¡Vamos! is the data controller. You can reach the controller at support@vamosespanol.com.

2. What data we collect

• Account data: your email address and authentication credentials (handled by our authentication provider; we never see your password).
• Learning data: exercise answers, errors, skill scores, mastery estimates, spaced-repetition state, placement results, writing submissions and XP. This is the core of the adaptive tutor.
• Audio recordings: short voice clips you record for pronunciation and speaking assessment. They are sent to Microsoft Azure AI Speech to be transcribed and scored, and the result (transcript and scores) is what we keep. We do not store your audio files on our servers, and recordings are never used to train AI models.
• Usage data: pages visited, feature usage, approximate session length, and technical logs (browser type, device, IP address in server logs).
• Waitlist data: if you join the public waitlist without an account, we store your email address and (optionally) how you heard about us.
• Communications: emails you send us, and your email preferences (including unsubscribe state).

3. Why we process it (legal bases)

• Contract (Art. 6(1)(b)): to provide the tutor you signed up for — lessons, spaced review, progress tracking, feedback.
• Legitimate interests (Art. 6(1)(f)): to keep the service secure, prevent abuse, fix bugs, and understand aggregate usage so we can improve the teaching.
• Consent (Art. 6(1)(a)): for optional emails beyond service-critical messages, and for voice recordings used in speaking exercises. You can withdraw consent at any time.

4. AI processing

Some features (writing corrections, tutor chat, dictionary look-ups, speaking feedback) send the text or audio you submit to external AI services to generate a response. We send only what the feature needs — your submission and minimal learning context — never your password, email content or payment details. These providers act as processors on our behalf, do not use your submissions to train their models, and where they process data outside the EU/EEA the transfer relies on an adequacy decision or Standard Contractual Clauses.

4b. AI transparency (EU AI Act)

The tutor, chat, corrections and feedback are AI-generated, and most spoken audio is a synthetic AI voice rather than a human recording. AI output can be wrong and is not an official assessment. We do not use emotion recognition, biometric identification or automated decision-making with legal effects. Full details are in our AI Transparency Notice.

5. Who we share data with (processors)

These are the services that process data for us, and what each one receives:

• Hosting, database and sign-in (Supabase infrastructure provided through Lovable Cloud, EU region): your account, learning data and server logs.
• Text AI — Google AI Studio (Gemini models): the text you submit for corrections, chat, dictionary look-ups, exercise generation and grading.
• Speech AI — Microsoft Azure AI Speech: the voice clips you record, for transcription and pronunciation scoring.
• Spoken audio — ElevenLabs text-to-speech: the Spanish sentences to be read aloud. No personal data is sent. When that service is unavailable your device's own built-in voice is used instead, which stays on your device.
• Email delivery: your email address, to send sign-in links and service emails.

We do not sell your data, do not show advertising, and do not share your learning data with advertisers or data brokers. If we change a provider materially, we update this list.

6. How long we keep it

Account and learning data are kept while your account is active. If you delete your account or ask us to delete your data, we remove personal data within 30 days, except where we must keep limited records for legal or security reasons. Waitlist emails are kept until you unsubscribe or ask us to remove them. Voice clips are processed to produce a score and are not stored by us afterwards.

We also keep a record that you accepted these documents (the date and the document version), because we need it to show that consent was given. It is deleted with your account.

6b. Where your data is stored

Your account and learning data are stored in the EU. AI requests are handled by the providers listed in section 5, which may process the submitted content outside the EU/EEA under an adequacy decision or Standard Contractual Clauses.

7. Your rights

Under the GDPR you have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability (receive your data in a machine-readable format).
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your supervisory authority — in Norway that is Datatilsynet (datatilsynet.no), or your local EU/EEA authority.

You can act on the most important ones yourself, without contacting us:

• Delete your account and all your data — open your profile page and use “Delete my account”. This erases your sign-in account, learning history and email address immediately and permanently.
• Withdraw an interest-list sign-up — if you left your email to maybe join, remove it at Withdraw your sign-up.

For anything else, email support@vamosespanol.com. We respond within 30 days.

8. Cookies and local storage

We use strictly necessary storage only: an authentication session cookie and local storage entries that keep you signed in and cache your progress. We do not use advertising or third-party tracking cookies, so no cookie-consent banner is required.

9. Security

Data is encrypted in transit (TLS) and at rest. Access is limited to the operator. Row level security ensures users can only read their own learning data.

10. Children

¡Vamos! is not directed at children under 16. We do not knowingly collect data from children under 16; if you believe a child has an account, contact us and we will delete it.

11. Changes

If we change this policy materially, we will update the date above and, for account holders, notify you by email or in-app before the change takes effect.