Privacy Policy

Who We Are and Our Role

Spoken Edge acts as a data processor on behalf of the educational institutions ("schools") that subscribe to our platform. Each school is the data controller for its students', teachers', and administrators' personal data. We process that data only as instructed by the school and as necessary to deliver the service.

For data we collect about our own business relationships (e.g. billing contacts), we act as an independent data controller.

Information We Collect

Account & profile information

• Full name, email address, phone number (optional)
• Role: admin, teacher, or student
• Grade level and preferred language (students only)
• School name and institution identifier

Usage and session data

• Session start/end times and duration
• Text messages exchanged within a session
• Translation requests and output (via Google Cloud Translation API)
• Text-to-speech requests and audio output (via Google Cloud TTS API)

Technical & analytics data

• Log data: IP addresses, browser type, pages visited, timestamps
• Usage metrics: minutes used, characters translated, TTS characters consumed
• Audit log events: administrative actions for security and compliance

Billing information

Collected and processed exclusively by Stripe. We never see or store full card numbers, CVV codes, or bank account details. We retain only Stripe-issued customer and subscription identifiers.

How We Use Your Information

• Provide, operate, and improve the SpokenEdge platform
• Authenticate users and maintain account security
• Enable real-time multilingual communication between teachers and families
• Process translation and text-to-speech via Google Cloud APIs
• Generate usage reports for school administrators
• Process subscription payments through Stripe
• Send essential service communications (account setup, security alerts, billing receipts)
• Investigate and resolve support requests
• Comply with legal obligations

Third-Party Services and Data Processors

We share data with the following processors solely to deliver our service:

We do not sell, rent, or trade personal information to any third party for their own commercial purposes.

FERPA Compliance (US Educational Records)

For US schools, student data processed through SpokenEdge constitutes "education records" under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. We act as a "school official" with a legitimate educational interest:

• We use student education records only to provide the contracted educational service
• We do not disclose education records to outside parties without consent, except as required by law
• We return or securely destroy student records upon request or subscription termination
• We will notify the school of any confirmed data breach affecting student records
• School administrators may review, correct, and request deletion of their students' records

COPPA Compliance (Children Under 13)

The Children's Online Privacy Protection Act (COPPA) applies to services directed at children under 13. Students are registered by school administrators — not by the children themselves. Under COPPA's school-consent exception, schools provide consent on behalf of parents for educational purposes.

• We collect only the minimum information necessary to provide the service
• We do not direct advertising to children or build behavioural profiles
• Parents may request access, correction, or deletion via their school administrator
• School administrators may delete student accounts at any time from their dashboard

GDPR and UK GDPR Rights (EU and UK Users)

If you are in the EU or UK, you have the following rights under the GDPR / UK GDPR:

To exercise any of these rights, email info@spokenedge.com. We respond within 30 days. You may also lodge a complaint with your national data protection authority.

Data Retention

School admins can request immediate deletion by emailing info@spokenedge.com.

Data Security

We implement the following technical and organisational security measures:

• TLS 1.2+ encryption in transit
• bcrypt password hashing (never plaintext)
• SHA-256 one-way reset token hashes
• Short-lived JWT sessions with auto-expiry
• Multi-tenant data isolation per school
• Tamper-evident audit logs
• Rate limiting on all authentication endpoints
• Production access restricted to authorised staff

Cookies and Tracking

We use only essential session cookies required for authentication. We do not use:

• Third-party advertising or tracking cookies
• Analytics cookies (e.g. Google Analytics) that track users across sites
• Fingerprinting or other cross-site tracking technologies

Authentication tokens are stored in your browser's localStorage solely to maintain your login session.

Data Transfers

Our infrastructure is primarily hosted in the United States. If you access from the EU, UK, or another jurisdiction with data-transfer restrictions, your data may be transferred to and processed in the US. We rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) for such transfers where required.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify school administrators of material changes by email at least 30 days before the changes take effect. The "Effective date" at the top always reflects the current version. Continued use constitutes acceptance of the updated policy.

Contact Us

For privacy-related questions, data access requests, or to report a security concern — we aim to respond within 5 business days and resolve enquiries within 30 days.