Delevoz Privacy Policy

Last updated: 2026-10-06

This policy is deliberately short and written in plain language: it covers what actually happens to your data when you use Delevoz, without boilerplate.

Who operates the Service (data controller): Delevoz is operated by Cristine Manasan, based in Barcelona, Spain. Contact: data@delevoz.com for data protection matters. See the Aviso Legal for who is behind the site.

Contact for data protection inquiries: data@delevoz.com

Delevoz is operated from Spain, so EU data-protection law (GDPR) applies in full to all processing described here — wherever in the world you use the Service from. The Spanish supervisory authority (AEPD) oversees this processing.

1. What data we collect

• Account data: email address, authentication credentials (via Supabase Auth) and, once you choose one on the dashboard, the exam level you are preparing for (A2 or B2) — collected when you create an account or make that choice. Every use of Delevoz requires an account; there is no anonymous mode.
• Practice session content: audio recordings of your spoken responses (at A2: Tareas 1 and 2, and Tarea 3 when it runs turn by turn — see below; at B2: your monologue in each tarea), transcripts of that speech, the prompts/photos shown to you, and the AI-generated feedback on your performance.
• Live conversation with the examiner: at A2, Tarea 3 normally runs as a live voice call with the AI examiner; at B2, every tarea ends with a live conversation that follows your monologue. During the call your voice is streamed in real time to ElevenLabs, which transcribes it and speaks the examiner's replies; the replies themselves are written by Anthropic's Claude, which ElevenLabs calls on our behalf. At B2, the transcript of the monologue you have just given is passed to the examiner so it can ask you about what you said. Neither we nor ElevenLabs keep an audio recording of the call — only its transcript, which is saved to your session. If the live call isn't available at A2, Tarea 3 runs turn by turn instead and is recorded like Tareas 1 and 2.
• B2 fluency timing: at B2 we also measure timing (pauses, speaking rate) from your monologue recording, in your browser, to inform the fluency part of your feedback. These measurements are not an official DELE measure and are deleted with the transcripts described in section 5.
• Session start diagnostics: if a practice session fails to start, we record a short reason code (for example "microphone blocked", "sound check failed", "server busy") and a coarse browser family (for example "Safari on iPhone", "Chrome on Android", "Firefox"). This is stored with that session record and deleted with it. Legal basis: legitimate interest (diagnosing technical failures to improve service reliability).
• Payment data: processed by Stripe. We receive transaction metadata (amount, credit pack, status) — not your full card number.
• Technical/abuse-prevention data: IP address and request metadata, used for rate limiting and a daily AI spend cap (Upstash), and a CAPTCHA response (Cloudflare Turnstile) on signup.

We do not perform voiceprint or speaker-identification analysis on your recordings — audio is used only for transcription and for driving the AI examiner.

2. Why we process it

• To run the practice session itself (examiner dialogue, including the live voice conversations — Tarea 3 at A2, every tarea at B2; speech-to-text; feedback generation).
• To manage your account and session credits.
• To process payment and prevent fraud/abuse.

Legal basis: performance of the contract you enter into by using a paid or free session, and legitimate interest for fraud/abuse prevention. We don't use your data for advertising and we don't sell it.

3. Who we share data with

Note on the last row: in browsers with built-in speech recognition (primarily Chrome), your spoken audio is transcribed via the browser's native engine, which routes it to Google's servers. In browsers without native support (e.g., Firefox, Safari), transcription is done by ElevenLabs Scribe instead. During the live examiner conversations, speech recognition is always done by ElevenLabs, not by your browser.

None of your data is sold.

4. International transfers

Several of the vendors above (Anthropic, ElevenLabs, Stripe, Supabase, Vercel) are US-based and process data outside Spain/the EU. We rely on their own standard safeguards (Standard Contractual Clauses, EU-US Data Privacy Framework, or equivalent) for these transfers — see each vendor's own DPA (e.g., ElevenLabs' at elevenlabs.io/dpa incorporates the SCCs automatically).

5. Data retention

• Session audio: deleted within 3 days of the session. Feedback is generated at the end of each session, so nothing needs the raw recording after that.
• Live examiner conversations at ElevenLabs: no audio recording of the call is kept. ElevenLabs is set to delete its own copy of the call transcript (and, at B2, the monologue text passed to it) within 3 days; our copy is kept with your feedback report as described below.
• B2 fluency timing measurements: deleted within 3 days of the session, together with the audio.
• Session transcripts (the text of what you said, produced by speech-to-text) and feedback quotations (short excerpts of your own words used to show specific corrections): kept as part of your feedback report until you delete your account, so you can read back exactly what you said in each Tarea. Transcripts of sessions that were never graded are deleted within 3 days along with the audio.
• AI-generated session feedback (including which task and prompt you practiced, without which the feedback would be meaningless): kept until you delete your account, so you can revisit past sessions. Each feedback report covers that single session only; we do not build cross-session progress profiles.
• Account data (email, credentials, credit balance, chosen exam level): kept until you delete your account. No automatic dormancy purge exists at this stage.
• Payment/invoice records: the one exception. Spanish commercial law (Código de Comercio, Art. 30) requires invoices and accounting records to be kept for 6 years, so these records are retained for that period even if you delete your account.

6. Your rights

Under GDPR you can request access, correction, deletion, restriction, portability, or object to processing. Contact data@delevoz.com to exercise these. You can also complain to the AEPD (aepd.es) if you believe your rights aren't being respected.

7. Children

Delevoz requires users to be at least 14 years old — Spain's statutory age of digital consent under LOPDGDD Art. 7. Under-14 signups are not permitted, confirmed by your acceptance of the statement shown at sign-up ("By signing up you confirm you're 14 or older and agree to the Terms and Privacy Policy"); the time of that acceptance is recorded with your account.

8. Cookies

Only strictly necessary cookies are used (Supabase Auth session cookie, Cloudflare Turnstile). No analytics or ad cookies.

9. Security

Reasonable technical measures for a service at this scale: row-level security in the database, HTTPS everywhere. No guarantee of absolute security.

10. Changes

We'll update the "Last updated" date above if this policy changes materially.

11. Contact

data@delevoz.com for data protection matters, hello@delevoz.com for everything else. Who operates the site: see the Aviso Legal. Terms governing use of the Service itself: see the Terms of Use.