VieSpeak Privacy Policy

1. What types of information do we collect?

We collect the following types of information about users of the Services:

• Name
• Contact information, including email, username, and login credentials, if you create an account with us
• You may choose to use an account with a third-party platform (such as Google or Apple) to sign in to the Services. If you do, we may receive your name, email, avatar, and a unique authentication identifier. Note that if you use this feature, the third-party platform providing the authentication service may access your data, including your name, email, avatar, and unique authentication identifier.
• IP address (we may also infer your approximate location from your IP address)
• Sensitive personal information, including:
  • Voice recordings
  • Text transcripts of conversations
  • Memory — summaries of what you share during conversations (interests, goals, personal details) so the AI can personalize your future sessions
• Usage data, including:
  • Related performance data (for example, crash data)
  • Clickstream data, records of actions taken on the Services, and related performance data
  • Device details about the computer or mobile device you use to access the Services, such as device model, operating system, language, and internet service provider
  • Records of our communications with you, for example when we receive and respond to your questions or feedback about the product
  • Conversation session data, including scores, CEFR level estimates, communication goals achieved, and session history

We collect these types of information when you use the Services, for example when you download and use the VieSpeak app. We may also receive aggregate information about traffic and usage from analytics service providers.

2. How do we use your information?

We collect and use your information for a variety of business purposes:

To provide the Services to you and fulfill your requests

• Such as maintaining, operating, responding to questions, and fulfilling your requests; diagnosing, fixing, and monitoring service and quality issues; authenticating users of the Services; and sending administrative information, such as changes to terms, conditions, and policies. This processing is based on the performance of a contract with you. If you do not provide certain data, the quality and features of the Services may be affected.
• Such as installing and configuring changes and updates to the Services. This processing is based on protecting the vital interests of you or others.

To provide you with a personalized experience

• Such as understanding your preferences and interests in order to personalize your interactions. This processing is based on our legitimate interests.
• Such as providing content and recommending scenarios suited to your learning goals and level. This processing is based on your consent.

For internal business purposes

• Such as improving the current Services and designing new services; assessing usage and performance of the Services; analyzing usage trends; and creating anonymized or aggregated data that we may use and disclose for any purpose. This processing is based on our legitimate interests.

For legal, safety, or security reasons

• Such as complying with legal requirements. This processing is based on compliance with a legal obligation.
• Such as protecting the safety, property, or rights of Twenty Labs, our customers, or others; and preventing and detecting fraud or abuse of the Services. This processing is based on protecting the vital interests of you or others.

For sending notifications

• Such as sending email notifications about your account, policy updates, and other important information, consistent with your choices.

Where processing is based on your consent, you have the right to withdraw your consent at any time. Withdrawing consent will not affect the lawfulness of processing based on your consent before its withdrawal.

Where processing is based on our legitimate interests, the interests we pursue are to enable and allow us to carry out our internal business purposes, to improve, tailor, and bring our products and services to market, and to enhance the user experience.

3. Who do we share your information with?

We may share your information when necessary or appropriate, in particular where we have a legal obligation or legitimate interest to do so:

• With third-party service providers working on our behalf, to support the services they provide to us. These include service providers such as website hosting, data analytics, fraud prevention, information technology, customer service, AI model providers, voice-processing service providers, and other services.
• With government authorities, law enforcement, or other third parties for legal, safety, or security reasons, such as to comply with legal requirements; to enforce our terms of service and other agreements; and to protect the rights, property, or safety of us, our users, or third parties.
• With third parties in connection with a sale of business or assets, in the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or part of our business, assets, or shares.

Sharing with third-party AI services when you converse

When you converse with VieSpeak, we send your voice recordings and what you say (transcripts) to third-party AI service providers for real-time processing and to generate responses in the conversation. This provider is OpenAI. These providers process your data only to operate the conversation on our behalf, under contracts requiring them to protect your data at a level equal to or higher than the level described in this Policy, and they may not use it for their own purposes. As noted above, we do NOT use your voice recordings to train VieSpeak’s own AI models. In the app, we ask for your explicit consent to this sharing before you start your first conversation. You can withdraw consent at any time under Settings → Data & privacy; after withdrawing, you will not be able to start a new conversation until you consent again. In addition, deleting your account withdraws consent and erases all related data.

4. Your choices

We offer you a number of choices relating to the processing of your information:

• To stop receiving notification emails from us, please click the “Unsubscribe” link at the bottom of each email. Opting out of notification emails will not affect our ability to send administrative or transactional messages.
• To exercise rights relating to personal information under applicable law, please contact us as described in the “Contact” section below. Under Vietnam’s Decree 13/2023/NĐ-CP on personal data protection, you may have the following rights with respect to personal information processed by VieSpeak. Note that these rights are not absolute and may, in some cases, be balanced against other considerations, including the privacy of others. You may submit the following requests, and we will respond in accordance with applicable law:
  • Access, correct, or delete your personal information;
  • Obtain a copy of your personal information for the purpose of transferring it to another company;
  • Restrict, object to, or refuse certain processing of personal information, including the right to withdraw consent previously given for the use of personal information;
  • And/or lodge a complaint with a data protection authority or consumer privacy regulator.

To exercise the rights above, you may send your request to the email listed in the Contact section below. If you are not satisfied with how we handle your personal information, please let us know and we will investigate your concern.

5. Cookies and tracking technologies

VieSpeak is a mobile application and uses similar technologies to collect information, such as device identifiers, local storage on your device, and usage events. Some persist only for a single session, and some persist continuously across multiple sessions. We use these technologies to remember user preferences, maximize the performance of the Services, and personalize content.

VieSpeak does not run advertising and does not use advertising identifiers (such as IDFA on iOS or GAID on Android) for personalized advertising purposes.

6. Analytics

Our Services use third-party analytics tools that use similar technologies to collect and analyze information about the use of the Services and to report on activities and trends. These analytics tools may also collect information about the use of other websites, apps, and online resources.

7. Retention period

We retain Personal Information for as long as necessary or permitted in the context of the purpose for which it was collected and consistent with applicable law.

The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you have an account or continue to use the Services);
• Whether there is a legal obligation we are subject to (for example, certain laws require us to keep transaction records for a specified period before we may delete them);
• Whether retention is advisable in light of our legal position (such as in relation to applicable statutes of limitations, litigation, or regulatory investigations).

Voice recordings and memory are retained until you delete your account or make a specific deletion request.

8. Use of the Services by minors

The Services are not directed to individuals under 16 years of age, and we do not knowingly collect personal information from individuals under 16.

9. Third-party services

This Privacy Policy does not address, and we are not responsible for, the privacy, information, or other practices of any third parties.

In addition, we are not responsible for the information collection, use, disclosure, or security policies or practices of other organizations, such as Apple, Google, Microsoft, or any other app developer, app provider, social media platform provider, operating system provider, or wireless service provider.

10. Security

We seek to use reasonable organizational and technical measures to protect personal information within our organization. However, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your account or your interactions with us are no longer secure, please contact us immediately as described in the “Contact” section below.

11. Cross-border data transfers

Your personal information may be stored and processed in any country where we have facilities or where we engage service providers, and by using the Services you understand that your information will be transferred to countries outside your country of residence, which may have data protection rules that differ from those in your country. In some cases, courts, law enforcement agencies, regulatory authorities, or security authorities in other countries may be able to access your personal information.

12. Changes to this Privacy Policy

From time to time, we may update this Privacy Policy by updating this page and displaying the effective date of the last update at the top of the page. We encourage you to check this page periodically to learn about the information we collect, use, and share.