Privacy Policy

Last updated: 4 July 2026

This Privacy Policy explains how Vocaco (“Vocaco”, “we”, “us”, “our”) collects, uses, and protects your personal data when you use vocaco.ai and related services (the “Service”). Vocaco is currently operated as a sole proprietorship by Daniel Zoltan Kanyik, based in the Netherlands. Once Vocaco is incorporated as a Dutch private limited company (B.V.), this policy will be updated to name that company as the data controller. For any privacy question or request, contact us at support@vocaco.ai.

1. Data we collect

• Account data — your email address and a securely hashed password.
• Verification data — six-digit codes we send to confirm sign-up, log-in, and password resets (stored hashed, and expiring after a short time).
• Content you create — the topics you describe, the bilingual practice sentences generated for you, playlists, and related settings (language pair, level, tense, voice choices).
• Audio files — spoken recordings generated from your practice sentences.
• Plan & usage data — your plan, study-credit usage, and counts needed to enforce limits.
• Waitlist data — if you join a waitlist, your email address and the plan/interest you expressed.
• Technical data — basic information your browser sends (such as IP address and request logs) used for security and to operate the Service.

We do not knowingly collect special-category data, and we ask that you not enter sensitive personal information into practice topics.

2. How we use your data

• To provide the Service — create your account, generate practice sentences and audio, and build playlists.
• To send transactional emails (verification and password-reset codes).
• To enforce plan limits and prevent abuse.
• To secure, maintain, and improve the Service.
• To contact you about a waitlist you joined, if you asked us to.

3. Legal bases (GDPR)

Where the EU/UK GDPR applies, we rely on: performance of a contract (to provide the Service you request); legitimate interests (to secure and improve the Service); consent (for waitlist and any optional communications, which you may withdraw at any time); and legal obligation where applicable.

4. Service providers we share data with

To run the Service, limited data is processed by the following providers (“sub-processors”). We share only what is needed for each function:

• Amazon Web Services (Amazon Bedrock) — the topic text you submit is sent to generate bilingual practice sentences.
• ElevenLabs — practice sentence text is sent to generate spoken audio.
• Postmark — your email address is used to deliver verification and account emails.
• Our hosting provider — hosts the application and database on our behalf.

These providers act as our processors under their own terms and security commitments. We do not sell your personal data. We currently do not process payments; if paid plans launch, a payment provider will be added here.

5. International transfers

Some providers above may process data outside your country, including in the United States. Where required, such transfers are covered by appropriate safeguards (for example, Standard Contractual Clauses).

6. Data retention & deletion

We keep your data for as long as your account is active. Note that when you “remove” a collection, practice set, playlist, or sentence within the app, it is hidden from your workspace but may be retained in our database and backups for a period. To request full deletion of your account and associated personal data, contact us at support@vocaco.ai; we will delete or anonymise it within a reasonable time, subject to any legal retention obligations.

7. Your rights

Depending on your location, you may have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. To exercise any right, email support@vocaco.ai. You also have the right to complain to your local data-protection authority.

8. Cookies

We use only strictly necessary cookies required to keep you signed in and to protect forms against cross-site request forgery. We do not currently use advertising or third-party analytics cookies. If this changes, we will update this policy and, where required, ask for your consent.

9. Security

We take reasonable technical and organisational measures to protect your data, including hashed passwords, encrypted connections (HTTPS), and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Service is not directed to children under 16 (or the minimum age required in your country). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here and change the “Last updated” date. Material changes may be communicated by email.

12. Contact

Questions or requests: support@vocaco.ai.