Privacy Policy

1. Who is responsible for your data

The data controller for HearSay is HearSay Learn B.V., Nieuwe Achtergracht 184, 1018WV Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 98853244.

For privacy questions, write to team@hearsaylearn.com. For messages sent over WhatsApp, Meta Platforms Ireland Ltd. acts as an independent controller of the messaging layer under its own terms.

If you use HearSay through a course offered by a language school or another partner, HearSay remains the data controller for your account and learning data. We share only aggregate figures with partners (for example how many learners started a course), never your messages, voice notes, call recordings, or individual results.

2. What data we collect and why

We collect only what we need to run the Service:

Identity data

Your WhatsApp phone number and display name, your name, and (if you have an account on our web app) your email address. We use this to deliver lessons to the right person and to contact you about your subscription. Your phone number is how we recognise you in WhatsApp, so it is attached to your message history and learning data for as long as your account exists. Lawful basis: performance of contract.

Onboarding answers

If you start a course from our website, the answers you give in the get-started questionnaire (target language, level, why you are learning, where you plan to travel or move, your occupation, your family situation, exams you are preparing for, interests, and how you heard about us) stay in your browser while you fill it in. When you continue to checkout or start a course, we send them to our servers and store them together with a random one-time connect code, of which we keep only a hash. When you connect on WhatsApp, that code attaches your answers to your account so the lessons can use them. We do not ask for your age or any sensitive information in the questionnaire; please do not add health, religious, or similar details in free-text answers. Unused codes expire after 90 days; if you never connect, we then delete your answers and the code. Lawful basis: performance of contract.

Learning data

Your target language, level, goals, the topics you choose to practise, your message history with the HearSay agent (every text message you send and every message we send you), lesson progress, streaks, transcripts of your role-play calls, and the AI's feedback on them. We use this to personalise your lessons and to show you your progress. Lawful basis: performance of contract; legitimate interest in improving the lessons you receive next.

Voice notes

When you send the tutor a WhatsApp voice note, we download the audio, convert it to text with a speech-to-text provider (see Section 4), and then discard the audio. Only the transcript is kept, as part of your message history. Lawful basis: performance of contract.

What the tutor remembers

So the conversation feels continuous, the tutor keeps a short working memory: recent topics, questions you have asked, feedback you have given, and a small number of facts you mention about yourself (for example that you are moving to Lisbon or that you cook a lot). This memory is generated from what you write, is used only to shape your next lessons and replies, and is deleted automatically 90 days after your last activity. If you want something removed sooner, contact us (Section 13). Lawful basis: performance of contract.

Product analytics and quality review

We record how you use HearSay (lessons delivered, messages sent, voice notes, calls, streaks, subscription events) in our analytics tool, PostHog, hosted in the EU. This usage record is linked to your account, not anonymised. To improve the tutor we also review conversations, including the prompts sent to and replies received from our AI providers, and we sometimes use an AI model to summarise patterns across many conversations. Access to conversation content is limited to the HearSay team members who need it for this purpose. We do not use your data to train AI models. Lawful basis: legitimate interest in understanding and improving the service. You can object at any time — see Section 8.

Payment data

When you subscribe, our payment processor (Stripe) handles the card details — we never see or store your full card number. We do keep a record of the transaction (amount, date, plan, billing address) for accounting and tax purposes. Lawful basis: legal obligation (Dutch tax and accounting law).

Technical data

When you interact with our web pages we log basic technical information such as IP address, device type, and browser type. We use this to keep the service secure, prevent fraud, and debug problems. Lawful basis: legitimate interest.

Website analytics (cookie-free)

We measure how our website is used — which pages are visited and roughly where visitors come from — using PostHog, hosted in the EU. Until you accept analytics cookies, this measurement is cookie-free and anonymous: we do not build a profile of you, we do not record your session, and your IP address is discarded after being used to derive an approximate (city-level) location.

So that we can tell which pages belong to the same visit, we keep a random identifier in your browser's session storage. It says nothing about who you are, it is never sent to another website, and your browser deletes it when you close the tab — so we cannot recognise you on a later visit, or anywhere else. If you arrived from an ad or a link carrying campaign tags, we keep those the same way, so we can tell which campaigns bring people to the site.

If you accept analytics cookies, PostHog additionally uses a first-party cookie, which lets us recognise a returning visitor across separate visits (see Section 7). Lawful basis: legitimate interest in understanding and improving our website (consent for the cookie-based part). We honour the Do Not Track and Global Privacy Control browser signals: when either is enabled, we collect no analytics and store nothing on your device. You can also object at any time using the contact details in Section 13.

3. Voice calls and audio

When you end a lesson with a role-play call on WhatsApp, your voice is streamed in real time through our voice infrastructure (LiveKit, hosted in the EU) and converted to text by a speech-to-text provider so the AI can understand what you said and reply. The AI's spoken reply is synthesised by a text-to-speech provider and streamed back to you.

We keep a recording of your side of the call. Each phrase you say is stored as a short audio clip, together with the text transcript (including word timings and confidence scores) and the AI's pronunciation and feedback assessment. We keep these so you can listen back to yourself on your results page, so the assessment can be re-checked, and so we can improve how the assessment is made. The clips are stored in Cloudflare R2 storage that is restricted to the EU, are never made public, and can only be played back by you (through your results link) and by HearSay team members reviewing assessment quality. The tutor's side of the call is generated audio and is not personal data about you.

Clips, transcripts and assessments are kept until you ask us to delete them or your account is deleted (see Section 6). If you would rather we kept only the transcript and not the audio, tell us and we will delete the clips while keeping your results.

Lawful basis: performance of contract for delivering the call and showing you your results; legitimate interest for keeping clips and transcripts so your future lessons build on what you've already practised and so we can improve the assessment. You can object to the retention of clips or transcripts at any time — see Section 8.

4. Who we share data with

To run HearSay we use the following service providers ("sub-processors"). Each one only processes data on our instructions, under a data processing agreement.

We do not sell your data. When you accept marketing cookies, Meta receives website events for ad measurement and targeting — see Section 7.

5. International data transfers

Some of the providers above are based outside the European Economic Area, mainly in the United States. In particular, our main database (Neon) is hosted in the United States, so your account, message history, and learning data are stored there. When we transfer your data to a US-based provider, we rely on the EU–US Data Privacy Framework where that provider is certified, or on Standard Contractual Clauses approved by the European Commission. Together these mechanisms are designed to give your data essentially the same level of protection it has in the EU. Role-play call clips are the exception: they are stored only in EU-jurisdiction storage and are sent outside the EU only for transcription.

6. How long we keep data

• Account and learning data: for as long as your account is active. When you ask us to delete it (see Section 8), we remove it from our production systems within 30 days.
• Voice notes you send the tutor: the audio is discarded as soon as it has been transcribed; the transcript is kept with your message history.
• Role-play call clips, transcripts and feedback: retained until you ask us to delete them, or until your account is deleted. You can ask for the clips alone to be deleted.
• The tutor's working memory: deleted automatically 90 days after your last activity.
• Unused onboarding codes and questionnaire answers: deleted once the code expires, 90 days after it was created, if you never connect on WhatsApp.
• Usage analytics: kept in PostHog for as long as your account is active and deleted with it.
• Financial records (invoices, payment metadata): retained for seven years, as required by Dutch tax law (Belastingdienst).
• Server and application logs: retained for up to 90 days for security, debugging, and fraud prevention, then deleted automatically.

7. Cookies

Our marketing website uses a small number of cookies:

• Essential cookies — needed for the site to work. These include PARAGLIDE_LOCALE (remembers the language you chose) and hearsay-cookie-consent (remembers your cookie preferences).
• Analytics cookies — placed by PostHog only when you agree, so we can recognise a returning visitor across separate visits. Sent to PostHog's EU instance. If you don't agree — or if you reject — we still count page views, but cookie-free and anonymously, keeping a random identifier in your browser's session storage so we can tell which pages belong to one visit. Your browser deletes it when you close the tab (see Section 2, "Website analytics").
• Marketing cookies — placed by the Meta Pixel when you agree, used to measure the effectiveness of our ads on Facebook and Instagram and to target ads to you on those platforms. Data is sent to Meta Platforms Ireland Ltd.

You can change your cookie choices at any time through the cookie banner. Rejecting removes any analytics cookies already set and returns you to cookie-free anonymous counting; enabling Do Not Track or Global Privacy Control in your browser turns analytics off entirely.

8. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct data that is wrong or out of date.
• Erase your data ("right to be forgotten").
• Restrict or object to certain types of processing — including objecting to the legitimate-interest processing described in this policy.
• Portability — receive your data in a structured, commonly used format.
• Withdraw consent at any time, where we rely on consent.

To use any of these rights, email team@hearsaylearn.com. Because we identify you in WhatsApp by your phone number, please write to us from the number you use with HearSay or include enough information for us to confirm who you are. We respond within one month, as required by the GDPR; if a request is complex we may extend that by up to two further months and will tell you why.

When you ask us to erase your data we delete your account, phone number, message history, questionnaire answers, the tutor's memory, your role-play clips, transcripts and results, and your usage analytics from our production systems within 30 days. Financial records are kept for the period the law requires (Section 6), and copies in backups and logs expire on their own schedule (up to 90 days).

You also have the right to lodge a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.

9. Automated personalisation

HearSay uses AI to personalise your lessons based on your level, goals, the topics you have chosen, and your recent practice. After a role-play call, an AI model compares what you said with the phrases you were asked to say and gives you a pronunciation and completeness score. None of this produces legal or similarly significant effects for you — it only changes the lessons you receive next and the feedback you see. You can change your goals, topics, and level at any time inside the WhatsApp conversation.

10. Data breaches

If something goes wrong and a breach of your personal data is likely to result in a risk to your rights, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it, as required by the GDPR, and we will tell you directly if the risk to you is high.

11. Age requirements and children's data

You must be at least 16 years old to use HearSay. We do not knowingly collect personal data from anyone younger than 16. If you believe someone under 16 is using HearSay, please contact us and we will remove their data.

If you are 16 or 17: in plain terms, here is what using HearSay means for you. We know your phone number and what you write to the tutor. We keep your messages, your call recordings and your results so you can see your progress. Some of the companies that help us run the service are in the United States. We never sell your data or use it to train AI. You, or a parent, can ask us to show you or delete everything at any time by writing to team@hearsaylearn.com.

12. Changes to this policy

We update this policy when our practices change. The "Last updated" date at the top tells you when the current version was published. When changes are material — for example, a new sub-processor or a change to how voice data is handled — we will let you know by email or on WhatsApp before the change takes effect.

13. Contact

For any privacy question or to exercise the rights above, email team@hearsaylearn.com.

HearSay Learn B.V. · Nieuwe Achtergracht 184, 1018WV Amsterdam, the Netherlands · KvK 98853244 · VAT NL868671654B01