Privacy Policy for Voilà

1. Who We Are

Voila Language Learning LLC, a Delaware limited liability company, is the data controller of your personal data. Our registered office is 131 Continental Drive, Suite 305, Newark, Delaware 19713, United States. Process may be served on our registered agent, United States Corporation Agents, Inc., at that address. You can reach us at:

📧 legal@voila.fun — 🌐 www.voila.fun

We comply with the GDPR for users in the European Economic Area and the United Kingdom, and with other privacy laws where our users live.

2. What Data We Collect

We collect the following categories of personal data:

A. Information You Provide

• Account details: Name, email, password, and language preferences.
• Profile information: Country, target language, learning level, and subscription tier.
• Audio/video data: Recordings, speech samples, and transcriptions used for learning.
• Tutor interactions: Messages, call logs, and feedback in the app.
• Billing data: Managed by third-party providers (FastSpring for voila.fun subscriptions, Stripe for Connect lesson payments, Google Play, Apple) — Voilà does not store full payment details.
• Messaging channel data: If you connect WhatsApp or Telegram, your phone number or Telegram ID and everything you exchange with your Voilà Learning Partner there. See "Messaging channels" below.

B. Information Collected Automatically

• Device and usage data: XR headset type, operating system, app version, session logs.
• Analytics: Through Google and Firebase Analytics (only with consent).
• Approximate location: For localization and time zone alignment (not continuous tracking).
• Cookies and similar technologies: Explained in Section 10.

C. Information from Third Parties

• Partner institutions (language schools) if you register through them.
• OAuth providers (Google, Apple) if you sign up via Single Sign-On (SSO).

D. Meeting recordings, participants, and your obligations

In Voilà Classroom, Voilà records the microphone audio of the lesson. We use that audio to produce the transcript, the lesson summary, and follow-up practice. The lesson cannot be held in Voilà Classroom without that recording. Our lawful basis is performance of the contract (GDPR Article 6(1)(b)). Where the tutor or any participant is in the EEA or the United Kingdom, or we do not have a billing country for the tutor or for the person joining, each person must accept this notice before they can join. We store that acceptance, including the version of the wording and the language it was shown in. If the wording changes, we ask again. Refusing means you do not join. There is no unrecorded Voilà Classroom lesson.

When you record a lesson on Google Meet, Zoom, or Microsoft Teams, or through the Voilà browser extension, that recording may include personal data about you and about other participants. You are responsible for ensuring that you have a valid lawful basis—and, where required, explicit freely given consent or other permissions—from every affected person before any recording or processing takes place. Voilà does not monitor whether you have correctly obtained that consent. If you use those features in a manner that violates privacy, wiretap, surveillance, or similar laws, you are solely responsible for that use and for any resulting harm, subject to applicable law.

Classroom audio is stored on Amazon Web Services in the EU. Transcription uses Google Cloud Speech-to-Text. The video room is provided by the providers named in section 4. We keep lesson recordings for the period set out in section 5.

Voice samples and biometric data

When you record a voice sample, you provide biometric data that uniquely identifies you. We treat this category with extra care under GDPR Article 9 and only process it with your explicit consent.

What we use it for

• Labelling who is speaking in your lesson transcripts (speaker diarisation).
• Generating voice-matched text-to-speech in our learning tools, so synthesised audio sounds similar to you.
• When a tutor separately consents, creating a synthetic copy of their voice so their students hear it in WhatsApp and Telegram practice.

Who processes it

The raw audio of a voice sample is stored on AWS in Europe (eu-west-3). We derive a 192-dimensional voice fingerprint (ECAPA-TDNN embedding) from the audio. The fingerprint is shared with Google Cloud Text-to-Speech only when generating voice-matched output. That raw audio is not sent to Google.

A tutor can separately consent to a custom voice for their students. Only then do we send two recordings to Google's Gemini API: the primary voice sample, and a second recording of Google's required consent sentence. Google uses them to create a short-lived synthetic voice for WhatsApp and Telegram practice notes. We do not send those recordings without that separate consent.

How long we keep it

Both the audio file and the voice fingerprint are retained until you delete your voice sample, or until your account is deleted, whichever happens first.

How to withdraw consent

You can withdraw your consent at any time by deleting your voice sample in Settings → Personal → Voice sample, which also deletes the derived fingerprint. A tutor who has allowed a custom voice can withdraw that consent on the same page without deleting the voice sample. Deleting the voice sample withdraws the custom voice as well. Deleting your account removes both as part of the standard erasure flow.

Lawful basis

Explicit consent under Article 9(2)(a) GDPR. We do not rely on any other lawful basis for biometric processing.

3. How We Use Your Data

We process your personal data based on the following legal grounds:

You can withdraw consent at any time via account settings or by emailing legal@voila.fun.

Google Calendar Integration & User Data

When you use our Calendar OAuth Integration, we adhere to strict privacy standards regarding your Google User Data:

• Real-Time Access & Event Storage: We strictly limit data retention. We do not store your external Google Calendar events on our servers; we fetch this data momentarily only when you view your calendar within the Voila platform. We only store the specific meeting details for events created directly within Voila to manage your schedule.
• No Third-Party Sharing: We do not share your Google Calendar data with anyone outside of our company or with any third-party AI models.
• Limited Use: Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Changes & Notifications: We will verify that our usage of your data matches this policy. If we make any changes to how we use or process your Google user data, we will notify you promptly via email or an in-app notification prior to the change taking effect.

4. Who We Share Your Data With

We share limited data with trusted third parties acting as data processors:

Each provider operates under GDPR-compliant Data Processing Agreements (DPAs) and, where applicable, Standard Contractual Clauses (SCCs) or the EU—US Data Privacy Framework for international transfers. There is one exception, and we would rather state it plainly: Telegram offers bot operators no data processing agreement. We therefore treat Telegram as strictly optional — every feature is available on WhatsApp, on the web and in the app without it. Read "Messaging channels" below before choosing it.

Messaging channels (WhatsApp and Telegram)

You can practice with your Voilà Learning Partner inside WhatsApp or Telegram instead of the app. This is optional: every feature is available on the web and in the app without connecting a messaging account. When you do connect one, your messages travel through that provider's systems, so this section sets out exactly what that means.

What we share

Your phone number in international format (WhatsApp) or your numeric Telegram ID and username; your first name where a message uses it; the content of everything you exchange with your Voilà Learning Partner, including text and voice notes; and delivery and read receipts. Voice notes are downloaded from the provider and transcribed by Google Cloud Speech-to-Text. Your transcripts and message history are stored on AWS in Europe — not by the messaging provider.

How we ask, and what we record

Before we send you anything, we ask in the chat itself: you confirm that you want to receive lesson messages and recurring practice reminders, and that you are 16 or older (WhatsApp, Telegram and the Voilà mobile app all ask you to confirm this). We record the exact sentence you were shown, in the language you were shown it, alongside the date — so what you agreed to can always be established. We send no messages on any other basis.

Who processes it

WhatsApp is provided by Meta Platforms Ireland Ltd., the EU contracting entity, under WhatsApp's Business Data Processing Terms. Messages are encrypted end-to-end between your device and Meta's Cloud API endpoint, and processing may involve US infrastructure covered by Standard Contractual Clauses and the EU—US Data Privacy Framework. Telegram works differently and you should know before choosing it: Telegram bot conversations are cloud chats rather than end-to-end encrypted, so Telegram can access their content on its own servers, and Telegram offers bot operators no data processing agreement. We hold no Article 28 contract with them. That is precisely why Telegram is optional, and why we say so here rather than in a footnote.

How long it is kept

Meta holds Cloud API messages only transiently in order to deliver them — deleted once delivered, kept up to 30 days if they cannot be — and media links expire within minutes. Telegram publishes no retention commitment for bot messages. Our own copy of your message history follows Section 5 and is removed when you delete your account. We keep the voice notes you send and your Voilà Learning Partner's voice replies for 90 days, then delete them automatically; their transcripts stay with your message history. Photos you send are processed when they arrive, and we do not keep a copy.

How to stop the messages

Reply STOP in the chat at any time. That stops every message immediately and withdraws your consent to be contacted on that channel. You can also disconnect the channel in Settings, or move between WhatsApp and Telegram, without losing your learning history. Stopping the messages does not affect your account or your use of the web and app.

Quality review

We programmatically review the text of messages you exchange with your Voilà Learning Partner in order to check the quality of the service and improve the agent. A member of staff may read a conversation when that review needs a person. We do not use this review for advertising, and we do not send these chats to a provider for the purpose of training that provider's models.

Lawful basis

Sending you messages on WhatsApp or Telegram relies on consent under Article 6(1)(a) GDPR, given in the chat before the first message and withdrawable at any time with STOP. Reviewing the text of those conversations to maintain quality and improve the agent relies on our legitimate interests under Article 6(1)(f). You can object to that review at any time by emailing legal@voila.fun. Objecting does not withdraw your consent to be contacted on the channel; reply STOP to do that.

Practice calls

You can practise speaking with your Voilà Learning Partner in a voice call, by calling our WhatsApp number or from the Voilà mobile app. The person you talk to on the call is your Voilà Learning Partner, not a human tutor.

What we record

We record the audio of the whole call: your voice and your Voilà Learning Partner's voice, each on its own channel. We use the recording to produce a transcript of the call and a feedback report, which we send to you in the chat and by email. The call is also transcribed live while it happens, and that transcript is stored with the call.

How we tell you

Before every call we tell you that it is recorded and transcribed so that we can send you feedback. A practice call is always recorded; if you do not want that, do not start the call. You can keep practising by text and voice notes instead.

Who processes it

During the call your voice is streamed to Google (Gemini), which provides your Voilà Learning Partner and the live transcript. The recording is stored on Amazon Web Services in Europe (eu-west-3) and transcribed by Google Cloud Speech-to-Text. Both providers are listed in section 4.

Kid mode

If kid mode is on, a child may be the one talking. The call is recorded in the same way and the feedback is written for a child, but nothing said on the call is added to the account holder's review lists.

How long it is kept

Call recordings, transcripts and feedback reports follow Section 5 for audio recordings. They are deleted with your account, within 30 days of your deletion request.

Lawful basis

Recording and transcribing a practice call is part of the service you start when you place the call, so our lawful basis is performance of the contract (Article 6(1)(b) GDPR).

Debate practice

Debate transcripts are used only to give you feedback on your language. We don't use the side you argue on sensitive topics to personalise anything.

Shared flashcard decks

In the Voilà app you can share a flashcard deck you made in the chat by sending a link. Anyone who has the link can see the deck's name, its language, how many cards it has and its first few cards, without signing in, and a signed-in Voilà user can add their own copy of the cards. The link does not show your name, your email address, your progress or when your lessons were. Your saved words are never shared this way.

Only share a link with people you want to see the deck: anyone it is passed on to can open it too. You can stop sharing from the deck at any time, and the link stops working straight away. Copies other people have already added stay in their accounts, and are theirs to keep or delete. A copy holds only the cards, never anything about you.

5. Data Retention

We retain data only as long as necessary for the purposes collected.

When data is no longer needed, it is securely deleted or anonymized.

6. Data Security and Breach Notification

We implement encryption, access controls, and network isolation across our infrastructure (AWS).

In the event of a data breach that may impact your rights and freedoms, we will notify you and the appropriate supervisory authority in accordance with GDPR Article 33.

7. International Data Transfers

Your data may be processed outside the European Economic Area (EEA), specifically in the United States.

We rely on:

• Standard Contractual Clauses (SCCs) for data transfers,
• EU—US Data Privacy Framework (where applicable), and
• Secure encrypted channels (TLS) for all cross-border transfers, with primary storage in the EU (AWS eu-west-3 and eu-central-1) and SCCs in place for US-based sub-processors (e.g. FastSpring, Stripe, Recall.ai, and Meta for WhatsApp messaging).

All transfers follow GDPR Articles 44–49 safeguards, with one exception we disclose rather than paper over: if you choose the optional Telegram channel, your messages transit servers outside the EEA for which Telegram offers no Standard Contractual Clauses. That channel is never required, and "Messaging channels" below explains the trade-off so the choice is yours to make.

8. Your GDPR Rights

You have the following rights regarding your personal data:

• Access – Obtain a copy of your data.
• Rectification – Correct inaccurate or incomplete data.
• Erasure – Request deletion ("Right to be Forgotten").
• Restriction – Limit processing of your data.
• Data Portability – Receive data in machine-readable format.
• Objection – Object to processing under legitimate interests.
• Withdraw Consent – At any time, without affecting prior lawful processing.

To exercise any right, contact legal@voila.fun.

To delete your account, you don't need to sign in: use our account deletion page.

You may also lodge a complaint with your local Data Protection Authority (e.g., CNPD – Comissão Nacional de Proteção de Dados, Portugal).

9. Automated Decision-Making and AI

Voilà uses AI to:

• Generate translations and grammar corrections,
• Provide feedback on pronunciation and sentence structure,
• Suggest personalized learning content.

All AI processing is assistive, non-deterministic, and human-reviewed where necessary.

Voilà does not make any automated decisions producing legal or significant effects.

You can disable personalization features in your account settings.

We may review the text of Voilà Learning Partner conversations for quality, as described in the messaging channels section above.

10. Cookies and Tracking Technologies

When using the Voilà web platform, we use cookies and similar technologies.

Cookies are small files placed on your device to improve functionality, analytics, and personalization.

Categories of Cookies:

Your Choices:

Upon first visit, you will see a cookie consent banner allowing you to:

• Accept all cookies;
• Reject non-essential cookies; or
• Manage preferences by category.

No analytics or marketing cookies are set until you grant consent.

You can change or withdraw consent anytime via "Cookie Settings" in the app or website footer.

11. Children's Privacy

Voilà is not directed to children under 13.

If we become aware of data collected from minors without parental consent, we will delete it immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically.

If significant changes occur, we will notify you via in-app message or email.

The latest version will always be available at www.voila.fun/privacy.

13. Contact Us

For questions, concerns, or to exercise your rights, contact Voila Language Learning LLC at its registered office, 131 Continental Drive, Suite 305, Newark, Delaware 19713, United States, or at:

📧 legal@voila.fun — 🌐 www.voila.fun