This Privacy Policy explains how we collect, use, share, and protect your personal data when you use CiaoTutor, and the rights you have over that data.

CiaoTutor ("CiaoTutor", "we", "us", or "our") is operated by MNCN Labs. We are the data controller responsible for your personal data.

CiaoTutor is a voice-first Italian language learning service. Using it necessarily involves processing your voice and the content of your conversations, so we have tried to describe that clearly below. If anything is unclear, contact us at support@ciaotutor.com.

1. Information we collect

Account information

When you create an account, we collect your email address and, if you sign in with a third-party provider, your name and profile identifier. Authentication is handled by our provider Clerk. We store your email and an account identifier; we do not store your password.

Billing information

If you subscribe to a paid plan or buy a session pack, payments are processed by Stripe. Stripe collects and stores your payment card details directly. We do not receive or store full card numbers. We keep a Stripe customer identifier and records of your plan, billing status, and purchases.

Voice and conversation data

When you practice with Elena, we process your microphone audio and the text of your conversation. This is described in detail in Section 2.

Learning data

To provide feedback and track your progress, we generate and store data derived from your sessions, including transcripts, detected mistakes, vocabulary you encounter, proficiency scores across the four CEFR skills, generated exercises, and your attempts at them.

Usage and device data

Like most websites, we and our analytics provider automatically collect technical information such as your IP address, browser type, device type, pages viewed, and interactions with the service. See Section 7.

Communications

If you email us or contact support, we keep those messages and any information you choose to include.

Partner programme applications

If you apply to our affiliate programme, we store the name, email address, channel or profile link, audience description, note, and preferred payout method you enter, together with your browser's user-agent string and the time of the application, so we can review it and reply to you. If you become a partner, we also keep the referrals attributed to you and the commission owed. You can ask us to delete an application at any time (see Section 10).

Referral information

If you arrive from a partner's link, your browser stores that partner's identifier for up to 60 days so the referral can be credited if you subscribe. It is attached to your purchase record and is not used to build a profile of you. You can remove it by clearing your browser's site data.

Reminder emails you request

Spoken practice sessions require a desktop or laptop computer. If you are on a phone and ask us to email you a link for later, we store the email address you enter, the page you entered it on, your browser's user-agent string, and the time of the request, so we can send that one message and avoid sending it twice. You can ask us to delete this at any time (see Section 10).

2. Voice and conversation data

What we do keep is the derived text and analysis of your sessions: the transcript, the mistakes detected, vocabulary, your scores, and the exercises generated from your errors. We keep this so you can review past sessions, see your progress over time, and receive personalized practice. Your recent sessions are also used to give Elena context in future sessions so she can adapt to you.

Please avoid sharing sensitive personal information (such as health, financial, or government identifiers) during your conversations, as transcripts are stored as part of your learning history.

3. How we use your information

• To provide, operate, and maintain the service, including running live voice sessions and generating feedback and exercises.
• To personalize your tutoring, adapt difficulty to your level, and track your progress.
• To process payments, manage subscriptions, and prevent billing abuse.
• To communicate with you about your account, security, updates, and support requests.
• To monitor, secure, debug, and improve the service.
• To comply with legal obligations and enforce our Terms of Use.

We do not sell your personal data, and we do not use your conversation content to serve you third-party advertising.

4. Legal bases for processing

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Performance of a contract: to provide the service you sign up for, including processing your voice and generating feedback.
• Legitimate interests: to secure, maintain, and improve the service, and to prevent fraud and abuse, balanced against your rights.
• Consent: for non-essential analytics cookies and, where required, microphone access. You can withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, and other legal requirements.

Where Brazil's Lei Geral de Proteção de Dados (LGPD) applies, we process your data on the corresponding legal bases under Article 7, principally execution of a contract, our legitimate interests, and your consent.

5. AI providers and other subprocessors

To deliver the service, we share the data necessary with a small number of processors who act on our behalf under contractual and confidentiality obligations:

• Google (Gemini API): real-time speech understanding, spoken replies, and language analysis.
• Anthropic and OpenRouter: text analysis of your sessions and generation of feedback and exercises. Which providers are used depends on our configuration.
• Clerk: account authentication and identity.
• Stripe: payment processing and subscription management.
• Google Analytics: website usage measurement.
• PostHog: product analytics and session replay, hosted in the European Union, used to understand how the website and app are used and where people get stuck.
• Resend: delivery of transactional email, such as replies to your messages, the desktop link you ask us for, and partner-programme correspondence.
• PromoteKit: affiliate referral tracking, used only if you arrive from a partner's link, to credit the correct partner for a subscription.
• Our hosting and infrastructure providers.

We use the business and API tiers of our AI providers. Under their applicable terms for these tiers, content we submit through the API is processed to provide the service to us and is not used to train their foundation models. We encourage you to review the privacy terms of these providers for details.

6. How we share information

Beyond the processors listed above, we may disclose information: to comply with law, legal process, or lawful government requests; to protect the rights, property, or safety of CiaoTutor, our users, or the public; and in connection with a merger, acquisition, or sale of assets, in which case we will notify you of any change in control or use of your personal data.

7. Cookies and analytics

We use cookies and similar technologies that are strictly necessary to keep you signed in and to operate the service. With your consent where required, we also use Google Analytics and PostHog to understand how visitors use our website. If you arrive from a partner's referral link, a cookie and a browser storage entry record that partner's identifier for up to 60 days, so the referral can be credited. You can control cookies through your browser settings; blocking essential cookies may prevent parts of the service from working.

PostHog additionally records anonymised replays of app sessions — the pages and interactions of a visit, so we can see where the product is confusing. Text you type into form fields is masked before it leaves your browser and is never recorded, and we do not record the audio of your practice sessions for this purpose. PostHog data is stored on servers in the European Union. You can opt out at any time by enabling your browser's "Do Not Track" setting or by contacting us.

8. International data transfers

We are based in Brazil, and our providers may process data in the United States, the European Union, and other countries. When we transfer personal data across borders, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms, and on the international-transfer provisions of the LGPD.

9. Data retention

We keep your account and learning data for as long as your account is active, so your progress history remains available to you. If you delete your account or ask us to erase your data, we will delete or anonymize it within a reasonable period, except where we must retain certain records (for example, billing and tax records) to comply with legal obligations. As noted above, session audio is not retained at all.

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access: obtain a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Restriction and objection: limit or object to certain processing.
• Portability: receive your data in a portable format.
• Withdraw consent: where processing is based on consent.

If you are in the European Economic Area or the UK, these rights arise under the GDPR. If you are in Brazil, equivalent rights arise under the LGPD, and you may contact our data protection point of contact at support@ciaotutor.com. If you are a California resident, you have rights under the CCPA and CPRA, including the right to know, delete, and correct your personal information, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law, and we will not discriminate against you for exercising your rights.

To exercise any of these rights, email us at support@ciaotutor.com. We may need to verify your identity before acting on your request. You also have the right to lodge a complaint with your local data protection authority, or in Brazil with the Autoridade Nacional de Proteção de Dados (ANPD).

11. Security

We use technical and organizational measures to protect your data, including encryption in transit, access controls, and reliance on reputable infrastructure and processors. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond promptly to any incident.

12. Children

CiaoTutor is not directed to children. You must be at least 16 years old to use the service. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you. Your continued use of the service after changes take effect means you accept the updated policy.

14. Contact us