Privacy Policy for Voilà

1. Who We Are

Until formal incorporation, Voilà operates as the Data Controller of your personal data under the name Voilà, reachable at:

📧 legal@voila.fun — 🌐 www.voila.fun

Once incorporated in the United States, Voilà Technologies LLC will act as the formal data controller, continuing to abide by GDPR for European customers.

2. What Data We Collect

We collect the following categories of personal data:

A. Information You Provide

• Account details: Name, email, password, and language preferences.
• Profile information: Country, target language, learning level, and subscription tier.
• Audio/video data: Recordings, speech samples, and transcriptions used for learning.
• Tutor interactions: Messages, call logs, and feedback in the app.
• Billing data: Managed by third-party providers (FastSpring for voila.fun subscriptions, Stripe for Connect lesson payments, Google Play, Apple) — Voilà does not store full payment details.
• Messaging channel data: If you connect WhatsApp or Telegram, your phone number or Telegram ID and everything you exchange with the AI tutor there. See "Messaging channels" below.

B. Information Collected Automatically

• Device and usage data: XR headset type, operating system, app version, session logs.
• Analytics: Through Google and Firebase Analytics (only with consent).
• Approximate location: For localization and time zone alignment (not continuous tracking).
• Cookies and similar technologies: Explained in Section 10.

C. Information from Third Parties

• Partner institutions (language schools) if you register through them.
• OAuth providers (Google, Apple) if you sign up via Single Sign-On (SSO).

D. Meeting recordings, participants, and your obligations

When you use features that capture or process audio, video, or transcripts from meetings or calls (including through the Voilà browser extension or bot hosting), that information may include personal data about you and about third parties (for example, students, tutors, or other participants). You are responsible for ensuring that you have a valid lawful basis—and, where required, explicit freely given consent or other permissions—from every affected person before any recording or processing takes place.

Voilà processes such data only as described in this Privacy Policy and in reliance on your agreement with our Terms. We do not monitor whether you have correctly obtained consent in each session. If you use our Services in a manner that violates privacy, wiretap, surveillance, or similar laws, you are solely responsible for that use and for any resulting harm, subject to applicable law.

Voice samples and biometric data

When you record a voice sample, you provide biometric data that uniquely identifies you. We treat this category with extra care under GDPR Article 9 and only process it with your explicit consent.

What we use it for

• Labelling who is speaking in your lesson transcripts (speaker diarisation).
• Generating voice-matched text-to-speech in our learning tools, so synthesised audio sounds similar to you.

Who processes it

The raw audio is stored on AWS in Europe (eu-west-3). We derive a 192-dimensional voice fingerprint (ECAPA-TDNN embedding) from the audio. The fingerprint is shared with Google Cloud Text-to-Speech only when generating voice-matched output. The raw audio is never sent to Google.

How long we keep it

Both the audio file and the voice fingerprint are retained until you delete your voice sample, or until your account is deleted, whichever happens first.

How to withdraw consent

You can withdraw your consent at any time by deleting your voice sample in Settings → Personal → Voice sample, which also deletes the derived fingerprint. Deleting your account removes both as part of the standard erasure flow.

Lawful basis

Explicit consent under Article 9(2)(a) GDPR. We do not rely on any other lawful basis for biometric processing.

3. How We Use Your Data

We process your personal data based on the following legal grounds:

You can withdraw consent at any time via account settings or by emailing legal@voila.fun.

Google Calendar Integration & User Data

When you use our Calendar OAuth Integration, we adhere to strict privacy standards regarding your Google User Data:

• Real-Time Access & Event Storage: We strictly limit data retention. We do not store your external Google Calendar events on our servers; we fetch this data momentarily only when you view your calendar within the Voila platform. We only store the specific meeting details for events created directly within Voila to manage your schedule.
• No Third-Party Sharing: We do not share your Google Calendar data with anyone outside of our company or with any third-party AI models.
• Limited Use: Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Changes & Notifications: We will verify that our usage of your data matches this policy. If we make any changes to how we use or process your Google user data, we will notify you promptly via email or an in-app notification prior to the change taking effect.

4. Who We Share Your Data With

We share limited data with trusted third parties acting as data processors:

Each provider operates under GDPR-compliant Data Processing Agreements (DPAs) and, where applicable, Standard Contractual Clauses (SCCs) or the EU—US Data Privacy Framework for international transfers. There is one exception, and we would rather state it plainly: Telegram offers bot operators no data processing agreement. We therefore treat Telegram as strictly optional — every feature is available on WhatsApp, on the web and in the app without it. Read "Messaging channels" below before choosing it.

Messaging channels (WhatsApp and Telegram)

You can practice with the Voilà AI tutor inside WhatsApp or Telegram instead of the app. This is optional: every feature is available on the web and in the app without connecting a messaging account. When you do connect one, your messages travel through that provider's systems, so this section sets out exactly what that means.

What we share

Your phone number in international format (WhatsApp) or your numeric Telegram ID and username; your first name where a message uses it; the content of everything you exchange with the AI tutor, including text and voice notes; and delivery and read receipts. Voice notes are downloaded from the provider and transcribed by Google Cloud Speech-to-Text. Your transcripts and message history are stored on AWS in Europe — not by the messaging provider.

How we ask, and what we record

Before we send you anything, we ask in the chat itself: you confirm that you want to receive lesson messages and recurring practice reminders, and that you are 13 or older (16 or older in some countries). We record the exact sentence you were shown, in the language you were shown it, alongside the date — so what you agreed to can always be established. We send no messages on any other basis.

Who processes it

WhatsApp is provided by Meta Platforms Ireland Ltd., the EU contracting entity, under WhatsApp's Business Data Processing Terms. Messages are encrypted end-to-end between your device and Meta's Cloud API endpoint, and processing may involve US infrastructure covered by Standard Contractual Clauses and the EU—US Data Privacy Framework. Telegram works differently and you should know before choosing it: Telegram bot conversations are cloud chats rather than end-to-end encrypted, so Telegram can access their content on its own servers, and Telegram offers bot operators no data processing agreement. We hold no Article 28 contract with them. That is precisely why Telegram is optional, and why we say so here rather than in a footnote.

How long it is kept

Meta holds Cloud API messages only transiently in order to deliver them — deleted once delivered, kept up to 30 days if they cannot be — and media links expire within minutes. Telegram publishes no retention commitment for bot messages. Our own copy of your message history follows Section 5 and is removed when you delete your account.

How to stop the messages

Reply STOP in the chat at any time. That stops every message immediately and withdraws your consent to be contacted on that channel. You can also disconnect the channel in Settings, or move between WhatsApp and Telegram, without losing your learning history. Stopping the messages does not affect your account or your use of the web and app.

Lawful basis

Consent under Article 6(1)(a) GDPR, given in the chat before the first message and withdrawable at any time with STOP.

5. Data Retention

We retain data only as long as necessary for the purposes collected.

When data is no longer needed, it is securely deleted or anonymized.

6. Data Security and Breach Notification

We implement encryption, access controls, and network isolation across our infrastructure (AWS).

In the event of a data breach that may impact your rights and freedoms, we will notify you and the appropriate supervisory authority in accordance with GDPR Article 33.

7. International Data Transfers

Your data may be processed outside the European Economic Area (EEA), specifically in the United States.

We rely on:

• Standard Contractual Clauses (SCCs) for data transfers,
• EU—US Data Privacy Framework (where applicable), and
• Secure encrypted channels (TLS) for all cross-border transfers, with primary storage in the EU (AWS eu-west-3 and eu-central-1) and SCCs in place for US-based sub-processors (e.g. FastSpring, Stripe, Recall.ai, and Meta for WhatsApp messaging).

All transfers follow GDPR Articles 44–49 safeguards, with one exception we disclose rather than paper over: if you choose the optional Telegram channel, your messages transit servers outside the EEA for which Telegram offers no Standard Contractual Clauses. That channel is never required, and "Messaging channels" below explains the trade-off so the choice is yours to make.

8. Your GDPR Rights

You have the following rights regarding your personal data:

• Access – Obtain a copy of your data.
• Rectification – Correct inaccurate or incomplete data.
• Erasure – Request deletion ("Right to be Forgotten").
• Restriction – Limit processing of your data.
• Data Portability – Receive data in machine-readable format.
• Objection – Object to processing under legitimate interests.
• Withdraw Consent – At any time, without affecting prior lawful processing.

To exercise any right, contact legal@voila.fun.

You may also lodge a complaint with your local Data Protection Authority (e.g., CNPD – Comissão Nacional de Proteção de Dados, Portugal).

9. Automated Decision-Making and AI

Voilà uses AI to:

• Generate translations and grammar corrections,
• Provide feedback on pronunciation and sentence structure,
• Suggest personalized learning content.

All AI processing is assistive, non-deterministic, and human-reviewed where necessary.

Voilà does not make any automated decisions producing legal or significant effects.

You can disable personalization features in your account settings.

10. Cookies and Tracking Technologies

When using the Voilà web platform, we use cookies and similar technologies.

Cookies are small files placed on your device to improve functionality, analytics, and personalization.

Categories of Cookies:

Your Choices:

Upon first visit, you will see a cookie consent banner allowing you to:

• Accept all cookies;
• Reject non-essential cookies; or
• Manage preferences by category.

No analytics or marketing cookies are set until you grant consent.

You can change or withdraw consent anytime via "Cookie Settings" in the app or website footer.

11. Children's Privacy

Voilà is not directed to children under 13.

If we become aware of data collected from minors without parental consent, we will delete it immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically.

If significant changes occur, we will notify you via in-app message or email.

The latest version will always be available at www.voila.fun/privacy.

13. Contact Us

For questions, concerns, or to exercise your rights, contact:

📧 legal@voila.fun — 🌐 www.voila.fun