Privacy Policy

SHELBY TECHNOLOGIES SRL ("SoundNativ," "we," "us," or "our") provides SoundNativ, an English pronunciation training service. This Privacy Policy describes how we process personal information that we collect through our website at soundnativ.com, our iOS and Android apps, our free accent test, our API for connected apps, our emails and our marketing activities (collectively, the "Service").

We are based in the European Union, so the EU General Data Protection Regulation ("GDPR") applies to everything we do with your personal information, wherever you live. Residents of the United Kingdom and of certain U.S. states have additional rights described in the Your rights and U.S. state privacy rights notice sections below.

Quick summary. We use your voice recordings only to score your pronunciation and to train and improve our own speech models, and we delete them within 180 days at most (30 days for the free accent test). We do not sell your personal information for money. We use analytics and advertising tools to understand how people find and use SoundNativ, and you can opt out of them as described in our Cookie Policy. You can ask us to access, export or delete your data at any time by emailing [email protected].

SHELBY TECHNOLOGIES SRL is the controller of your personal information for the purposes of the GDPR, the UK GDPR and Romanian data protection law. Our contact details are:

SHELBY TECHNOLOGIES SRL
Strada Nerva Traian nr. 27-33, Sector 3, București, Romania
CUI: 49587901 · Reg. com.: J2024003096404
[email protected]

We have not appointed a data protection officer because the law does not currently require one for our activities. You can reach the person responsible for privacy at SoundNativ at [email protected].

Information you provide to us

• Account and contact data, such as your email address, your name if you provide it, and your password (stored only as a one-way hash).
• Profile and learning data, such as your native language, your answers to our onboarding quiz and accent assessment (for example the situations you want to practise in), your daily practice goal, timezone and app language.
• Voice recordings: short audio clips you record through your device's microphone while doing pronunciation exercises, the accent test or conversation practice. See section 3 for exactly how we handle them.
• Practice and progress data generated by the Service from your activity, such as transcripts of what you said, pronunciation and word scores, sounds you have mastered, lessons completed, streaks and conversation practice history.
• Communications data, such as the emails you send us and our replies.
• Transactional data, such as the plan you bought, trial and renewal dates, amounts, currency, country, and refund or cancellation history.
• Payment data. Card details are entered directly into forms provided by Stripe, Apple or Google and are processed by them. We never see or store your full card number.
• Marketing data, such as your preferences for receiving our emails and whether you have unsubscribed.

Information from third-party sources

• Sign-in providers. If you sign in with Apple, Google or Facebook, we receive your email address (or an Apple private relay address), a unique account identifier and, where you allow it, your name. We do not receive your password for those services.
• App stores and subscription services. If you subscribe through the Apple App Store or Google Play, we receive purchase, renewal and refund events for your subscription through RevenueCat. We do not receive your payment card details.
• Advertising partners. If you reach us through an ad, we may receive information about the campaign, such as UTM parameters or a click identifier, so we can tell which ads work.
• Business transaction partners. We may receive personal information in connection with an actual or prospective merger, acquisition, financing or similar transaction.

Information we collect automatically

• Device data, such as operating system and version, device model, browser type, language settings, IP address, approximate location derived from the IP address (country or city), and identifiers such as installation IDs and, where you allow it, mobile advertising identifiers.
• Online activity data, such as the pages and screens you view, how long you spend on them, the site that referred you, features you use, in-app events, and the date and time of your visits.
• Diagnostic data, such as crash reports, error logs, and performance timings.
• Session replay data: recordings of how you interact with our website (through Microsoft Clarity) and our Apps (through Amplitude Session Replay), such as taps, clicks, scrolling and the screens you move between.
• Push notification tokens, if you allow notifications, so we can send practice reminders to your device.

Some of this collection is done with cookies, pixels, SDKs and similar technologies. Our Cookie Policy explains which ones we use and how to control them.

For the free accent test we store only a salted, one-way hash of your IP address, never the IP address itself, and we use Cloudflare Turnstile to check that you are a person rather than a bot.

How we process recordings. We analyse your recordings to produce a transcript, pronunciation scores and feedback, which are saved to your practice history.

We do not use your voice to identify you. We do not create voiceprints or use your recordings for biometric identification.

Training and improving our models. We may use your recordings, together with their transcripts and scores, to train, test and improve our own speech and pronunciation models. This can include members of our team listening to recordings and labeling them, for example marking which syllable was stressed. Trained models do not contain your recordings and are not used to identify you.

How long we keep recordings.

• Lessons and conversation practice: recordings are kept for up to 180 days so we can measure and improve the accuracy of our scoring, including training our scoring models, then deleted automatically.
• Free accent test: if you leave the "help improve" box unchecked, your audio is deleted as soon as it has been scored. If you tick it, we keep the audio for up to 30 days to improve our scoring, then delete it. Your result is the same either way.

Conversation practice. Conversation practice characters are powered by AI, not real people. To generate their replies, the text of the conversation (not your voice recording) is processed by AI service providers. We do not send your name or email with it. AI-generated replies and feedback may be kept in a form that is not linked to your account.

We do not provide your recordings to third parties to train their own AI models.

Service delivery and operations

• provide the Service, including your accent profile, scores, feedback, progress tracking and personalized training plan;
• create and maintain your account and sign you in;
• process payments, trials, renewals, refunds and cancellations;
• send you service messages, such as receipts, trial reminders, security alerts, password resets and progress summaries;
• share data with connected apps you have approved (see section 7); and
• respond to your requests, questions and feedback.

Personalization

We use your native language, quiz answers and practice history to choose which sounds and lessons to show you, and to remember your preferences.

Service improvement and analytics

We analyse how the Service is used, which pages and features are used most and least, where errors happen and how people move through the app, so we can fix problems and build a better product. We use tools such as Amplitude (including session replay in our Apps), Google Analytics, Microsoft Clarity and Sentry for this.

Marketing and advertising

• Direct marketing. We may send you emails about SoundNativ features, offers and tips. You can unsubscribe at any time using the link in the email.
• Ad measurement and interest-based advertising. We work with Meta and Google to measure which ads lead to sign-ups and purchases, and to show SoundNativ ads to you or to people similar to our users on other platforms. You can opt out as described in our Cookie Policy.

Compliance, security and protection

• comply with applicable laws, tax and accounting rules, lawful requests and legal process;
• protect our, your and others' rights, privacy, safety and property, including by making and defending legal claims;
• enforce our Terms of Service; and
• prevent, detect and investigate fraud, abuse, bots, trial abuse, chargeback fraud, cyberattacks and other harmful or illegal activity.

Aggregated and de-identified data

We may create aggregated, de-identified or anonymized data from personal information by removing anything that identifies you, and we will not attempt to re-identify it. We may use and share that data for lawful business purposes, such as analysing and improving the Service and publishing statistics about pronunciation learning.

Further uses

If we want to use your personal information for a new purpose that is not compatible with the purpose for which we collected it, we will ask for your consent first.

The GDPR requires us to have a legal basis for each use of your personal information. We rely on:

• Contractual necessity: where we need to process your data to provide the Service you signed up for, or to take steps you ask for before signing up.
• Legitimate interests: where the processing is necessary for our legitimate interests and those interests are not overridden by your interests and fundamental rights.
• Compliance with law: where we must process data to meet a legal obligation, such as keeping invoices.
• Consent: where you have given us specific consent, which you can withdraw at any time.

We do not sell your personal information for money. We share it only with the parties below, or as otherwise described when we collect it.

Service providers (processors)

These companies process data on our behalf, under written agreements and only on our instructions:

• Hetzner Online: hosting of our servers and database
• Cloudflare: storage of audio recordings (R2), content delivery, network security and bot protection (Turnstile)
• AI service providers (such as OpenRouter): powering conversation practice
• Stripe: payment processing for purchases on our website (email, billing details, payment metadata)
• RevenueCat: subscription management across web, iOS and Android (user ID, device IDs, purchase history)
• Amplitude: product analytics and in-app session replay (in-app events, device IDs, session data, user ID, screen interactions)
• Sentry: error monitoring and crash reporting (diagnostic data, device and OS information, user ID)
• Microsoft Clarity: session replay and heatmaps on our website
• Expo: delivering push notifications to your device (push token, notification content)
• Email delivery providers: sending transactional and marketing emails

Advertising and analytics partners

• Google: Google Analytics for website analytics and Google advertising services for conversion measurement (IP address, device and advertising identifiers, event data)
• Meta (Facebook): ad measurement and optimization (hashed email, device identifiers, IP address, event data)

Meta and Google may act as independent controllers or joint controllers for some of this data and use it under their own privacy policies. See our Cookie Policy for how to opt out.

Other recipients

• App stores and sign-in providers. Apple and Google process your purchase when you subscribe in their stores. If you sign in with Apple, Google or Facebook, that provider knows you used it to sign in to SoundNativ, under its own privacy policy.
• Connected apps you approve, as described in section 7.
• Professional advisors, such as lawyers, accountants, auditors, bankers and insurers, in the course of the services they provide to us.
• Authorities and others: law enforcement, tax authorities, courts, regulators and private parties, where we believe in good faith that it is required by law or necessary for the compliance and protection purposes described above.
• Business transferees: parties to an actual or prospective merger, acquisition, financing, sale of assets or similar transaction, or in an insolvency, including an acquirer, successor or assignee of SoundNativ.

You can choose to connect SoundNativ to a third-party app, such as an AI assistant, so it can read some of your SoundNativ data. We only share data with a connected app after you sign in to SoundNativ and approve the request on our consent screen, which shows the app's name and exactly what it will be able to see. We never share data with a connected app you have not approved.

Depending on the permissions you approve, a connected app can read:

• Profile: your name, native language, daily practice goal, timezone, and whether you are on a free or paid plan
• Progress: your practice streak, progress toward your daily goal, sound mastery, and pronunciation score history

Connected apps cannot see your email address, payment details, or audio recordings, and cannot make changes to your account. Access is read-only.

You can disconnect an app at any time from the "Connected apps" section of your dashboard, which stops its access immediately. Deleting your SoundNativ account also ends access for every connected app. We keep a record of which apps you have connected, when you connected them, and when they last accessed your data, so we can show it to you and secure your account.

Once a connected app has received your data, its use of that data is governed by that app's own privacy policy and terms, not by this policy. Please review them before connecting.

We keep personal information only for as long as we need it for the purposes it was collected for, including to meet legal, accounting and reporting requirements, to establish or defend legal claims, and to prevent fraud. To decide how long that is, we consider the amount, nature and sensitivity of the data, the risk of harm from unauthorized use, whether we can achieve the purpose another way, and our legal obligations. Specifically:

• Audio recordings from lessons and conversation practice are deleted within 180 days at most. Accent test recordings are deleted within 30 days, or immediately after scoring if you did not consent to retention (see section 3).
• Account, learning and practice data (email, profile, quiz answers, transcripts, scores, progress, subscription state) are kept for as long as your account is active, and deleted when you ask us to delete your account.
• Device identifiers and analytics events are kept according to each analytics provider's retention settings, typically 14 to 26 months.
• Payment and billing records are kept for as long as tax and accounting laws require, which in Romania is generally up to 10 years.
• Support emails are kept for as long as needed to resolve your request and for a reasonable period afterwards in case you contact us again.

When we no longer need personal information we delete or anonymize it. If that is not immediately possible, for example because it is held in backups, we store it securely and isolate it from further processing until it can be deleted. Anonymized data that can no longer be linked to you may be kept indefinitely.

Under the GDPR and UK GDPR you have the right to ask us to:

• Access: tell you how we process your personal information and give you a copy of it.
• Correct: update or correct inaccurate information.
• Delete: delete your personal information where there is no good reason for us to keep it, including where you have objected to processing.
• Port: give you, or a third party you choose, a machine-readable copy of the information you provided to us.
• Restrict: restrict processing, for example while we check the accuracy of your data or the reason for processing it.
• Object: stop processing that relies on our legitimate interests. You can always object to direct marketing, and we will stop.
• Withdraw consent: where we rely on your consent, withdraw it at any time. This does not affect processing that happened before you withdrew it.

How to exercise your rights. Email [email protected] from the email address on your account, or write to us at Strada Nerva Traian nr. 27-33, Sector 3, București, Romania. We may ask for information to confirm your identity before acting on a request. We will respond within one month, which we may extend by two further months for complex requests, in which case we will tell you why. If we decline a request in whole or in part, we will explain why, subject to any legal restrictions.

Deleting your account. You can delete your account in the app under Profile, Manage account, Delete account, which closes it immediately. You can also email [email protected] from the email address associated with your account with the subject line "Delete my account." Within 30 days of either request we will: (1) delete your account, email, quiz responses and pronunciation history from our database; (2) delete any audio recordings still in storage; (3) disconnect any connected apps; and (4) ask our service providers (including Sentry, Amplitude, RevenueCat, Google and Meta) to delete personal data associated with your account, except records we are legally required to keep, such as invoices. Deleting your account does not cancel an App Store or Google Play subscription; cancel that in your store account settings. See also our Data Deletion page.

Your right to complain. If you are not satisfied with our response, or with how we process your personal information, you can complain to a data protection authority. Our lead supervisory authority is the Romanian National Supervisory Authority for Personal Data Processing (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal, ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania, dataprotection.ro. You can also complain to the authority where you live or work. Contact details for EEA authorities are available from the European Data Protection Board. In the UK, you can contact the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, tel. +44 303 123 1113, ico.org.uk. We would appreciate the chance to address your concern first, so please contact us before going to a regulator.

• Access or update your information. You can review and update some account information by signing in to the app or your dashboard.
• Marketing emails. Use the unsubscribe link at the bottom of any marketing email, or contact us. You will still receive service emails such as receipts and security notices.
• Cookies, pixels and advertising. See the "Your choices" section of our Cookie Policy.
• Device permissions. You can turn off microphone access, notifications and ad tracking permission (for example "Allow Apps to Request to Track" on iOS) in your device settings. Without microphone access, the recording features will not work.
• Accent test retention. Leave the "help improve" box unchecked and your test audio is deleted right after scoring.
• Connected apps. Disconnect any connected app from your dashboard at any time.
• Linked sign-in providers. You can limit what Apple, Google or Facebook share with us in your settings for that service. Revoking access does not affect information we already received.
• Do Not Track. Some browsers send "Do Not Track" signals. There is no common standard for responding to them, and we do not currently respond to them.
• Declining to provide information. We need some personal information to provide the Service. If you do not provide information marked as required, we may not be able to provide those features.

We are based in Romania. Some of our service providers and partners, including Stripe, RevenueCat, Amplitude, Sentry, Google, Meta, Microsoft, Cloudflare and OpenRouter, are based in, or process data in, the United States or other countries outside the European Economic Area and the UK.

When we transfer personal information outside Europe, we rely on:

• Adequacy decisions of the European Commission or UK Government, including for U.S. companies certified under the EU-U.S. Data Privacy Framework and its UK Extension; or
• Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum), together with any supplementary measures needed; or
• in limited cases, a derogation permitted by law, such as where the transfer is necessary to perform our contract with you.

You can contact us for more information about the mechanism used for a particular transfer, or for a copy of the relevant safeguards.

We use technical, organizational and physical safeguards designed to protect your personal information, including encryption in transit, hashed passwords, access controls, and short retention for audio recordings. However, no internet service is completely secure and we cannot guarantee the security of your information. If a breach affects your personal information and is likely to put your rights at high risk, we will notify you as the law requires.

Your pronunciation scores, feedback and training plan are produced automatically by our scoring system. These are learning aids only and have no legal or similarly significant effect on you. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

The Service is not intended for children under 16, and we do not knowingly collect personal information from them. If you are a parent or guardian and believe your child has given us personal information without your consent, please contact us at [email protected] and we will delete it.

The Service may contain links to, or integrations with, websites, apps and services run by third parties, such as app stores, sign-in providers and connected apps. These links are not an endorsement, and we are not responsible for how those third parties handle your information. Please read their privacy policies.

This section applies to residents of U.S. states whose privacy laws apply to us, such as California, Colorado, Connecticut, Virginia, Texas, Oregon and others (the "State Privacy Laws"), to the extent those laws apply. Terms such as "personal information," "sale," "sharing" and "sensitive personal information" have the meanings given by those laws.

Your rights

Depending on where you live, you may have the right to:

• Know the categories of personal information we collect, the sources, the purposes, and the categories of third parties we disclose it to;
• Access a copy of your personal information;
• Correct inaccurate personal information;
• Delete personal information we collected from you;
• Opt out of targeted advertising and of the "sale" or "sharing" of personal information;
• Appeal our decision on any of these requests; and
• Not be discriminated against for exercising these rights.

Targeted advertising, sales and sharing

We do not sell personal information for money. However, our use of the Meta Pixel, Meta Conversions API and Google advertising services for ad measurement and targeting may be considered "sharing" for cross-context behavioral advertising, a "sale," or processing for targeted advertising under some State Privacy Laws. To opt out, email [email protected] with the subject line "Do not sell or share my personal information," and use the browser and device controls described in our Cookie Policy.

Profiling. We do not use personal information for profiling or automated decision-making that produces legal or similarly significant effects.

Sensitive personal information. We do not use voice recordings for biometric identification, and we do not use or disclose sensitive personal information to infer characteristics about you or for any purpose that would give rise to a right to limit its use.

Consumers under 16. We do not have actual knowledge that we sell or share the personal information of consumers under 16.

Making a request

Email [email protected] from the email address on your account. We will verify your request by matching it to your account, and may ask for more information if needed. An authorized agent may make a request on your behalf if they provide proof of your written permission, and we may ask you to confirm your identity directly. To appeal a decision, reply to our response with the subject line "Appeal."

Information practices

The table below summarizes the personal information we have collected in the past 12 months, using the categories in this policy and in the California Consumer Privacy Act (Cal. Civ. Code §1798.140). We collect it from the sources and use it for the purposes described above, and keep it for the periods described in section 8. We do not attempt to re-identify de-identified information, except to test whether our de-identification processes comply with the law.

California "Shine the Light"

California residents may ask for a list of third parties to whom we disclosed personal information for their own direct marketing purposes in the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing purposes in that sense. To ask, email [email protected] with the subject line "Shine the Light Request."

Nevada

Nevada residents may opt out of the sale of certain personal information for monetary consideration. We do not make such sales, but you can submit an opt-out request for any future sales by emailing [email protected].

We may update this Privacy Policy from time to time. We will update the "Last Updated" date above, and if we make material changes we will notify you by email or with a notice in the Service before they take effect. Where a change requires your consent, we will ask for it.

If you have questions about this policy or want to exercise a privacy right, contact us:

SHELBY TECHNOLOGIES SRL
Strada Nerva Traian nr. 27-33, Sector 3, București, Romania
CUI: 49587901 · Reg. com.: J2024003096404
[email protected]