Privacy Policy

Effective date: June 13, 2026

This Privacy Policy explains how Diego (“we”, “our”, or “us”) collects, uses, and protects your personal information when you use our Service. We are committed to protecting your privacy and handling your data in an open and transparent manner.

1. Who We Are

Diego operates an AI-powered Spanish voice conversation tutor. Diego is operated by a company based in the United States, and we store and process your data in the United States. For questions about this policy, contact us at [email protected].

2. Data We Collect

2.1 Information you provide

Account data: email address, password (stored as a hashed credential via Supabase Auth), and optional display name.
Profile data: your chosen Spanish level, learning goals, interests, location (optional), and preferred speech pace.
Invitation code: the code used when you signed up (to verify eligibility).

2.2 Data generated during use

Conversation content: the spoken and/or typed exchanges between you and Diego during practice sessions.
Learning data: vocabulary items, error patterns, grammar areas requiring practice, session history, and spaced-repetition review records — used to personalise Diego's tutoring.
Usage data: minutes of practice consumed, session durations, and service usage for billing and capacity planning.

2.3 Technical data

Log data: server-side structured logs including session identifiers, timestamps, and error codes (no full conversation content in logs).
Cookies: a session cookie set by Supabase Auth to keep you logged in, a cookie-consent preference cookie, and (with your consent) a PostHog analytics cookie used to understand how the Service is used in aggregate. We do not use advertising cookies.
Product analytics: with your consent, we use PostHog to collect pseudonymous usage events (e.g. pages visited, features used, session duration). PostHog data is not linked to your name; it is used only to improve the Service.
Payment data: billing and transaction records managed by Stripe. We do not store your card details; Stripe does.

3. How We Use Your Data

To provide the Service: authenticate you, stream voice sessions, generate AI responses, and store your learning progress.
To personalise tutoring: feed your error patterns, vocabulary, and profile into Diego's AI system prompt so sessions adapt to your needs.
To manage your subscription: track credit consumption, enforce usage limits, and process payments.
To operate and improve the Service: monitor performance, diagnose errors, and develop new features. We process aggregate usage metrics; we do not use individual conversation content to train AI models without your explicit consent.
To communicate with you: send transactional emails (email verification, billing receipts, important service notices). We do not send marketing emails without your consent.
To comply with legal obligations: retain records as required by applicable law.

4. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), gives you specific rights regarding your personal information:

Right to know: request the categories and specific pieces of personal information we have collected about you, and how we use and disclose it.
Right to delete: request deletion of the personal information we have collected from you, subject to certain exceptions.
Right to correct: request correction of inaccurate personal information we maintain about you.
Right to opt out: opt out of the “sale” or “sharing” of personal information. We do not sell your personal information and we do not share it for cross-context behavioral advertising.
Right to non-discrimination: we will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, contact us at [email protected]. We will verify your request using the email address registered on your account before acting on it.

5. Data Sharing

We share your data only as necessary to operate the Service:

Supabase (authentication and database hosting — US region)
Anthropic (AI language model — your anonymised conversation context is sent to generate responses)
Deepgram (speech-to-text — your audio is streamed for real-time transcription)
Cartesia (text-to-speech — Diego's spoken replies, and the read-aloud audio for news briefs and stories, are generated from their text)
Stripe (payment processing — billing data only)
PostHog (product analytics — pseudonymous usage events, with your consent only)
DigitalOcean (cloud hosting infrastructure)

Each sub-processor is bound by contractual data-protection obligations and may use your data only to provide services to us. We do not sell your personal data to any third party.

6. Data Retention

Account data is retained for as long as your account is active or until you request deletion.
Conversation and learning data is retained for as long as your account is active to support your ongoing learning journey, then deleted within 30 days of account closure.
Server logs are retained for up to 90 days.

7. Your Rights

Regardless of where you live, we offer all users the following rights regarding your personal data:

Access: request a copy of the personal data we hold about you.
Rectification: correct inaccurate or incomplete data.
Erasure: request deletion of your data (“right to be forgotten”), subject to legal retention obligations. To request deletion, email [email protected] from the email address registered on your account, stating what you would like deleted (e.g. all account data, conversation history only). Requests sent from a different address cannot be actioned for security reasons.
Restriction: request that we limit how we process your data.
Portability: receive your data in a structured, machine-readable format.
Objection: object to certain processing of your data.
Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Cookies

We use a minimal set of cookies:

Authentication cookie (essential): set by Supabase Auth to keep you logged in. Required for the Service to function.
Cookie-consent preference (functional): remembers your cookie consent choice.
PostHog analytics cookie (analytics, consent-gated): set only if you accept analytics cookies. Collects pseudonymous usage events to help us understand how the Service is used and where to improve it. You can withdraw consent at any time via the cookie banner or by contacting us.

We do not use advertising cookies or cookies that identify you individually for marketing purposes.

9. Data Security

We implement technical and organisational measures to protect your data, including:

All data in transit encrypted with TLS 1.2+.
Passwords hashed by Supabase Auth (bcrypt); we never store plaintext passwords.
Row-Level Security (RLS) on all database tables so each user can only access their own data.
Provider API keys (Anthropic, Deepgram, Cartesia) held only on the server and never exposed to the browser.
Regular security reviews and monitoring.

No method of transmission over the internet or electronic storage is 100% secure. If we become aware of a data breach that affects your rights, we will notify you and the relevant authorities as required by applicable law.

10. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us so we can delete it.

11. International Transfers

Diego is based in the United States, and we store and process your personal data in the United States. If you access the Service from outside the United States, you understand that your data will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer and processing.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised policy here with a new effective date and notify you by email or in-app notice where required. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

Contact

For any privacy-related enquiries or to exercise your rights, contact us at [email protected].