Privacy Policy

1. Introduction

FluenTea (“we,” “us,” or “our”) operates the FluenTea language learning platform. This Privacy Policy describes how we collect, use, and disclose personal data when you use our Service, and the choices you have. By using the Service, you agree to the collection and use of information as described here.

2. Information We Collect

2.1 Personal Data

• Email address
• First name and last name
• Date of birth, which we ask for when an account is created so we can tell whether you meet the age requirement in Section 4
• Profile pictures
• Language preferences
• Learning progress and activity data

2.2 Usage Data

• Browser type and version
• Pages you visit on our Service
• Time and date of your visit
• Time spent on pages
• Unique device identifiers

We keep usage data for 13 months. After that it is deleted, or reduced to aggregate counts that can no longer be linked to you.

2.3 Communication Data

2.3.1 Consumer/Individual Accounts. Voice recordings for language learning purposes; chat messages between users; conversations and messages exchanged with ChaCha (text and voice); video call metadata (duration, participants). Retention: voice recordings are kept for up to 30 days; transcripts of your ChaCha and practice conversations for 12 months; your chat messages and your call metadata for as long as your account exists; and usage analytics for 13 months. Recordings and transcripts made inside an Institutional Account follow Section 2.3.2 instead, which runs to the end of that account's contracted term plus a minimum of 30 days. All of it is deleted when you delete your account, as described in Section 5.

2.3.2 Institutional Accounts. If you access the Service through an Institutional Account (a school, university, corporation, or other organization) that has activated ChaCha's AI observation features, we additionally collect and generate:

• Session transcripts: generated by default for Institutional Account sessions. Retained through the end of the Institutional Account's contracted term, plus a minimum of 30 days, and not used to improve or train FluenTea's AI models unless the Institutional Account opts in via a separate written agreement. A specific Institutional Account's written agreement may specify a longer retention period; term end plus 30 days is a floor, not a ceiling.
• Audio and video recordings: only created if a session is explicitly recorded, with clear notice given to participants before or upon joining (see our Terms of Service, Sections 6.1–6.2). Not created by default. Retained through the end of the Institutional Account's contracted term, plus a minimum of 30 days, consistent with transcript retention above.
• Anonymized flag metadata: de-identified, aggregated behavioral patterns derived from ChaCha's session insights (for example, talk-time distribution over time), kept separately from raw transcripts and recordings because de-identified data carries substantially lower re-identification risk. Retained through the end of the Institutional Account's contracted term, plus a minimum of 30 days.
• Consent for all of the above is institution-level. An Institutional Account's acceptance of the Terms of Service, plus the age-appropriate consent mechanism in Section 4, covers every User it provisions. FluenTea does not separately collect this consent from each student.
• Accounts without a defined contract term (for example, an ongoing, non-term-based corporate deployment): retention runs on a rolling basis tied to the renewal or review cycle stated in that account's written agreement, applying the same 30-day-minimum-past-cycle-end principle.

2.4 Session Privacy Within Institutional Accounts

Transcripts of practice conversations during a session, including breakout rooms, are available to the Facilitator for that session. For practice outside a scheduled session, full transcripts are not made available to Facilitators or Institutional Account staff; instead, the Institutional Account receives a limited, defined dataset of high-level metrics (for example, time spent practicing, growth areas, strengths).

2.5 ChaCha Memory

ChaCha may retain a limited, user-visible memory of key facts you share with it and summaries of your recent sessions, to personalize coaching over time. This memory is transparent and editable in your account settings, and is not used to train or fine-tune FluenTea's underlying AI models.

2.6 Biometric Data

FluenTea does not currently perform voice-fingerprinting, speaker identification, or other biometric identification. If this changes, we will provide biometric-specific notice, consent, retention, and destruction terms before that processing begins, consistent with applicable biometric privacy laws.

2.7 Emotional and Affective Inference

FluenTea's AI systems do not infer, and are not designed to infer, the emotional or affective state of any user. ChaCha's prompting has been affirmatively reviewed to confirm this as of August 2026 (see our Terms of Service, Section 5.1).

3. How We Use Your Information

We use the collected data:

• To provide and maintain our Service
• To notify you about changes to our Service
• To provide customer support
• To gather analysis to improve our Service
• To match you with language partners and Facilitators
• To personalize your learning experience
• To process voice data for language learning feedback
• To generate AI-supported session insights for Institutional Accounts that have activated this feature (Sections 2.3.2 and 2.4; Terms of Service Section 5)

3.1 Institutional Accounts and Model Improvement

For Institutional Accounts, session transcripts are not used to improve or train FluenTea's models by default. An Institutional Account may opt in to this use via a separate written agreement. This is an institutional decision, not one collected from each student individually (see Section 2.3.2). For individual, personal accounts, session data, including conversations and messages exchanged with ChaCha (Section 2.3.1), may be used to improve the Service and FluenTea's AI models, consistent with this policy.

3.2 Human Analysis and Product Development

FluenTea personnel and select vendors (Section 10) may review session transcripts to draft coaching materials, refine product policy, and provide quality review, under human supervision. This is distinct from, and does not itself constitute, training or fine-tuning an AI model, and is subject to the same Institutional Account opt-in described in 3.1 where Institutional Account data is involved.

4. Children's Privacy and School-Provisioned Accounts

4.1 Consumer/Individual Accounts

Self-service accounts require the account holder to be at least 16. This age floor is not available to be lowered for individual/consumer signups under any circumstance.

4.2 Institutional Accounts: Minors

Where a school or educational Institutional Account provisions accounts on behalf of students, the following applies by age, consistent with our Terms of Service, Section 3.3:

• Ages 11–12 (COPPA-covered). The Institutional Account may consent as the parent's agent under the FTC's COPPA school-consent exception, valid only where the data is used solely for the Service's authorized educational purpose: no behavioral profiling and no advertising-related use of a minor's data under any circumstance. FluenTea also requires the Institutional Account to obtain and retain written parental or guardian permission before onboarding, the same requirement as the 13–15 band below, so this age group is not held to a lighter standard than older minors. FluenTea provides COPPA-required notice content to the Institutional Account for relay to parents.
• Ages 13–15. Not federally COPPA-covered, but FluenTea requires the Institutional Account to obtain and retain written parental or guardian permission before onboarding, produced to FluenTea or a parent on reasonable request.
• Ages 16–17. The Institutional Account consents as the contracting party, consistent with Terms of Service Section 3.3. Individualized written parental permission is not required by FluenTea at this age.
• 18 and older. Consents directly.

This is institution-level consent; FluenTea does not separately collect consent from each student beyond the mechanism above. In Mexico, a different rule applies: see the Mexico Regional Addendum.

4.3 Parents' Rights

A parent or legal guardian of a provisioned User under 16 may contact FluenTea directly to review or request deletion of that minor's data, independent of the student's own access rights and independent of the Institutional Account.

4.4 FERPA (Education Records)

Where FluenTea processes education records subject to the U.S. Family Educational Rights and Privacy Act on behalf of a US educational institution, FluenTea acts as a “school official” with a legitimate educational interest: it uses such records solely to provide the Service, does not redisclose them except as directed by the institution or required by law, and deletes or returns them at the institution's request consistent with our Terms of Service, Section 12.2.

5. Data Storage, Security, and Breach Notification

We use industry-standard security measures, including encryption in transit, to protect your personal data. No method of transmission is completely secure.

In the event of a data breach affecting your personal data, we will notify affected Institutional Accounts and, where required by applicable law, affected individuals, without undue delay and in any event within 72 hours of becoming aware of the breach, consistent with GDPR's notification standard. Institutional Accounts may negotiate a different notification timeline in a separate written agreement.

We retain personal data only as long as necessary for the purposes described in this policy and the specific retention periods stated in Section 2. Upon deletion of your account, we delete your personal data within 30 days, except where retention is required by law, to resolve an active dispute, or to enforce our agreements (consistent with our Terms of Service, Section 12.1). For Institutional Accounts, this is subject to the education-records handling described in Section 4.4.

6. Your Rights (GDPR: EEA and UK)

If you are in the EEA or UK, you have the right to:

• Access: request and download a copy of your personal data
• Rectification: request correction of inaccurate data
• Erasure: request deletion of your personal data
• Portability: download a copy of your data in a portable format
• Restriction: request limitation of processing
• Objection: object to certain types of processing
• Withdraw consent: withdraw consent at any time
• Automated decisions: not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (consistent with our Terms of Service, Section 5.2, which requires human review of any AI-generated insight before it informs a personnel decision)
• Complaint: lodge a complaint with your local data protection supervisory authority

We will respond to requests without undue delay, and in any event within one month of receipt, extendable by two further months for complex requests as permitted by law. To exercise these rights, contact [email protected] or use your account settings.

Legal basis for processing depends on context: performance of a contract, your consent, our legitimate interests in operating and improving the Service, or compliance with legal obligations.

International transfers. Where we transfer personal data from the EEA/UK to the United States or other countries, we rely on Standard Contractual Clauses or another lawful transfer mechanism recognized under applicable law.

EU Representative. FluenTea has designated Nancy Wang, Berlin, Germany as its representative in the European Union under Article 27 GDPR for matters relating to this Service. Contact: [email protected].

7. Your Rights (Mexico: LFPDPPP)

If you are in Mexico, you have ARCO rights under Mexico's Federal Law on Protection of Personal Data Held by Private Parties: Access to your personal data, Rectification of inaccurate data, Cancellation (deletion) of your data, and Objection to specific processing. To exercise these rights, contact [email protected]. Where we transfer your personal data outside Mexico (including to the United States), we require the recipient to maintain data protection obligations consistent with Mexican law.

The Spanish-language Aviso de Privacidad Simplificado, the parental-consent rule for students under 18, and other Mexico-specific terms are in the Mexico Regional Addendum.

8. Your Rights (California: CCPA/CPRA)

California residents have the right to know what personal information we collect, request deletion, correct inaccurate information, and limit use of sensitive personal information, and may not be discriminated against for exercising these rights.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We do not show ads and we build no advertising profiles. Our analytics tools (Microsoft Clarity and Cloudflare Web Analytics; see Section 10) are used solely for internal product analytics and are not used for cross-context ad targeting or ad-network data sharing. The one advertising-related tool is the Google Ads tag described in Section 9, which measures whether our own ads led to a sign-up. Because of this, a “Do Not Sell or Share My Personal Information” opt-out is not applicable to our current practices; if this changes, we will implement the required opt-out mechanism before doing so.

To exercise your California rights, contact [email protected].

9. Cookies

We use cookies and similar tracking technologies to operate and understand use of the Service. You can instruct your browser to refuse cookies or alert you when they are set.

We do not show ads, we do not sell or share personal data for advertising, and we build no advertising profiles. The one advertising-related tool we use measures our own ads: the Google Ads tag tells us whether someone who clicked a FluenTea ad went on to create an account. It loads only on the sign-up and onboarding pages of our web app. It never loads in the iOS app, never on a school page, and never for a learner who joins through a school's link. Google receives the address of the page and the technical details every browser sends (such as IP address and browser type) and, when an account is created, one sign-up event. No name, email address or other account details are sent. Whether the tag may set its cookie follows the marketing choice in our cookie banner: in the EU, EEA, UK and Switzerland the cookie is set only if you accept marketing cookies; elsewhere marketing cookies are on by default and you can turn them off in Cookie Settings. With marketing cookies off, the tag sets no cookie and sends Google only a signal without cookies. Student data is never used for advertising. The Microsoft Ads tag was removed from the Service on 19 September 2026 and does not return. The other non-essential cookies are the analytics cookies of the services named in Section 10.

10. Third-Party Services and Data Sharing

We share personal data with the following sub-processors, who process it only on our behalf and only to provide their part of the Service:

• Google Cloud: hosting of our servers, database, file storage (including recordings) and cache, in the us-central1 region (Iowa, United States).
• Cloudflare: delivery and protection of our website and web app. Cloudflare reads the country of your IP address so we can decide whether to show the cookie banner, and Cloudflare Web Analytics counts visits to our web pages.
• LiveKit: real-time video and audio calling infrastructure.
• Google (Gemini API): AI language coaching and conversation processing, in text and voice; lesson content and learner feedback; analysis of pronunciation in speech recordings; and translation of messages and transcripts.
• Anthropic (Claude): human-supervised analysis of session transcripts for product development, policy drafting, and quality review (see Section 3.2); subject to the Section 3.1 Institutional Account opt-in where institutional data is involved.
• Deepgram: live speech-to-text transcription.
• Google Cloud Speech-to-Text: backup transcription for calls when Deepgram is unavailable, and word timing in reading exercises.
• Google Cloud Text-to-Speech: speech synthesis.
• Stripe: payment processing on the web.
• Link (Link, LLC, a Stripe company): reseller and merchant of record for subscriptions bought on the web. Link processes the payment, calculates and remits sales tax and VAT, issues receipts and invoices, and handles billing support and fraud prevention. For these purchases Link is an independent controller of the payment and billing data it collects, under its own privacy policy.
• RevenueCat: subscription status for purchases made in the mobile apps.
• SendGrid (Twilio): email, such as account verification, password reset and notifications.
• Google Firebase (Cloud Messaging): push notifications.
• Slack: internal alerts for our support and safety team, including the usernames and email addresses of the accounts involved in a user report.
• Microsoft Clarity: internal product analytics only (session recordings and heatmaps, with text and typed input inside the web app masked); not used for cross-context advertising (see Section 8). On our website and web app it runs in the EU, EEA, UK and Switzerland only after you accept analytics cookies, and elsewhere it runs without asking first. The Android app starts Clarity each time it opens, in every country.
• GrowthBook: feature testing, based on a random browser identifier rather than your account.
• Google Tag Manager: loads in our web app. It currently carries no tags of its own; it delivers the Google Ads tag on the pages named in Section 9.
• Google Ads: measuring sign-ups from our own ads, on the pages and under the cookie choices described in Section 9.

When you use the following, the provider also receives some of your data and handles it under its own privacy policy:

• Sign in with Google, Microsoft or Apple: if you choose to sign in this way, the provider confirms your identity and shares your name and email address with us.
• Google Play and the Apple App Store: payment for purchases made in the mobile apps.
• OpenStreetMap (Nominatim): when you enter or detect a location in your profile, your browser sends the text you type, or your coordinates, to look up the place name.
• YouTube: some pages show a video embedded from YouTube, which receives your IP address and may set cookies when the video loads.
• Google Fonts: our public web pages load their fonts from Google, which receives your IP address.

The full list, with the data each provider handles and where it operates, is on our Sub-processors page.

We will provide notice before adding a new sub-processor that will process Institutional Account data, and Institutional Accounts may object consistent with any applicable written agreement. We do not sell personal data and do not share it with third parties for their own independent purposes.

11. Google User Data and Limited Use

If you connect the FluenTea Room add-on for Google Calendar, FluenTea requests access to your Google account to attach and manage language-practice rooms on your calendar events. The Google user data we access is limited to:

• Your Google account email address (to identify your calendar and link it to your FluenTea account).
• The event ID, title, start time, status, and conference details of events for which you create a FluenTea Room, so the room can be created, labeled, kept in sync when you reschedule, and cancelled when you delete the event.

We do not read or store attendee lists, guest email addresses, event descriptions, attachments, or the contents of any event for which you have not created a FluenTea Room. This Google data is transmitted only to FluenTea's own backend to operate the room, and is deleted or deactivated when you remove the room, delete the event, or disconnect the add-on. It is never shared with any advertiser or data broker, and it is never transferred to any third-party AI/ML service.

Limited Use. FluenTea's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use, transfer, or sell Google Workspace API data (raw, aggregated, or derived) to develop, improve, or train generalized or foundational AI/ML models.

12. Enterprise Agreements

An Institutional Account engaging FluenTea at scale may execute a separate Data Processing Addendum or other written agreement governing data handling. In the event of conflict, that agreement supplements and, where inconsistent, supersedes this Privacy Policy for that Institutional Account, consistent with our Terms of Service, Section 5.8.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, including any change that expands the categories of data we collect, how we use it, or who we share it with, we will: (1) notify all users by email, describing the changes in plain, itemized language; (2) require affirmative acceptance (“click to accept”) at next login before continued use of the Service; and (3) maintain a dated record of each user's acceptance as an audit trail, consistent with the notification mechanism in our Terms of Service, Section 18. Non-material changes, such as clarifications, formatting, or corrections that do not alter our actual data practices, take effect upon posting, without separate notice. Institutional Accounts subject to a separate written agreement will also be notified consistent with that agreement's own notice terms.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email: [email protected]
Address: FluenTea Inc., Cincinnati, OH, USA