← Back to Home

Privacy Policy

Last Updated: April 2026

SiteSpan Limited ("SiteSpan," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit and use the Hablacha platform at https://hablacha.com ("Service"). Please read this policy carefully. If you do not agree with the terms of this privacy policy, please do not access or use the Service.

1. Our Role in Data Processing (B2C vs. B2B)

How we handle your data depends on how you access Hablacha:

  • Individual Consumers (B2C): If you create a personal account for yourself, SiteSpan Limited acts as the Data Controller under the General Data Protection Regulation (GDPR) and UK GDPR. We determine the purposes and means of processing your personal data.
  • Enterprise/Educational Users (B2B): If you access Hablacha through a school, university, or employer, your organisation is the Data Controller, and SiteSpan acts as the Data Processor. We only process your data in accordance with the Data Processing Agreement (DPA) signed with your organisation. If you have questions about data handling in an educational context, please contact your institution directly.

2. Information We Collect

We collect several types of information from and about users of our Service:

  • Account & Authentication Information: When you register an account via email and password, we collect your email address and authentication credentials.
  • Google Account Data (Google Single Sign-On): If you choose to sign up or sign in using Google Single Sign-On (OAuth 2.0 / Google Identity Services), we receive basic profile information authorized by you via standard Google scopes (openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile). This includes your primary email address, full name, and profile picture URL. We do not request, access, or store sensitive Google account data such as your contacts, Google Drive files, calendar entries, location history, or Gmail messages.
  • Voice and Audio Data: When you speak during interactive language roleplay sessions, we process your voice audio in real-time to generate speech-to-text transcripts.
  • Text Inputs & Learning Content: The text you speak or type during roleplay scenarios, your saved flashcards, study bookmarks, vocabulary folders, and custom scenario prompts.
  • Usage and Technical Data: Technical logs, device and browser type, operating system, IP address, session timestamps, feature usage, and roleplay completion metrics.

3. How We Use Your Data and AI Training Policy

We use the information we collect strictly to:

  • Provide, operate, and maintain the Hablacha language learning platform.
  • Authenticate your identity and manage your secure account session.
  • Generate interactive AI roleplay dialogue, scenario translations, and immediate grammar corrections.
  • Turn what you say into text during a roleplay and give grammar corrections.
  • Process subscription payments and track usage allowances.
  • Respond to your customer support inquiries.

Zero AI Model Training Guarantee: SiteSpan Limited does not use your voice audio recordings, roleplay transcripts, or personal data to train, fine-tune, or develop our own or third-party Artificial Intelligence (AI) or machine learning models. Your data is processed purely in real-time to deliver interactive educational services back to you.

4. Google API Services User Data Policy Compliance & Limited Use

Hablacha integrates with Google APIs strictly for user authentication via Google Identity Services / OAuth. We adhere strictly to the Google API Services User Data Policy, including the Limited Use requirements:

  • Strict Purpose Limitation: Information received through Google APIs (email address, full name, profile picture) is used solely to authenticate your identity, create your Hablacha account, and display your user profile.
  • No Sale of Google Data: We never sell, rent, lease, or commercially transfer Google user data to third parties, data brokers, or advertising networks under any circumstances.
  • No Advertising Use: Google user data is never used or transferred for serving advertisements, retargeting, or personalized marketing.
  • No AI Training on Google Data: Information received via Google APIs is never used to train, retrain, or improve any generalized Artificial Intelligence (AI) or machine learning models.
  • Revocation of Google Access: You can revoke Hablacha's access to your Google account at any time by visiting Google Account Permissions. Revoking access disconnects future Google SSO sign-ins without deleting your existing study data unless you choose to delete your account.

Mandatory Compliance Disclosure: Hablacha's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Third-Party Sub-Processors and Data Transfers

To provide our Service, we rely on vetted third-party service providers (Sub-processors) who process data strictly on our behalf:

  1. Google LLC (Google Identity Services): Provides Single Sign-On authentication infrastructure. Processes authentication requests and verification tokens. Hosted in the USA / EU.
  2. Supabase: Provides our encrypted database, session management, and authentication storage. Hosted in the European Union (Ireland).
  3. Vercel Inc.: Hosts our web application front-end and secure edge API routes. Data is processed across EU and US edge networks with end-to-end encryption.
  4. Dodo Payments: Handles payment processing, PCI-compliant billing tokenization, and recurring subscriptions. We do not store raw credit card numbers.
  5. ElevenLabs & Verbatik: Generates Text-to-Speech (TTS) voice synthesis for native AI roleplay dialogue. They process only generated platform dialogue text, not user voice recordings.
  6. DeepSeek: Provides conversational language analysis and grammar evaluation models. Roleplay transcripts are processed ephemerally for pedagogical scoring. DeepSeek does not retain user conversation inputs to train general models.
  7. Speechmatics: Transcribes Irish speech during a roleplay into text.
  8. Brevo: Sends transactional and marketing emails (such as product tips) only when you have opted in. Processes your email address and message content to deliver mail. You can unsubscribe from marketing emails at any time via the link in each message or in Profile settings.

Ephemeral AI Processing: All API requests to our speech and language AI providers are configured with zero-retention flags where supported. No user data is retained by these providers for model training.

5a. Marketing Communications

With your explicit consent, we may send occasional product tips and offers to the email address on your account. Marketing email is optional and separate from account security messages (such as verification codes and password resets).

  • Opt-in: You can consent at signup, via an in-app prompt, or in Profile > Email tips.
  • Opt-out: Use the unsubscribe link in any marketing email, or turn off Email tips in Profile. We stop marketing sends immediately after opt-out.
  • No sale of data: We do not sell your personal data. Sub-processors only process data as needed to run the Service.

6. Age Restrictions and Children's Privacy

The Service is not intended for unsupervised use by children under 16 years of age:

  • Individual Accounts: You must be at least 16 years of age to register an individual account. We do not knowingly collect personal data from children under 16. If we learn that personal data of a user under 16 has been collected without verified parental consent, we will promptly delete that account and all associated data.
  • Educational Accounts: When Hablacha is deployed by schools or educational institutions, the institution acts as the consenting authority under applicable privacy laws (such as GDPR or FERPA). Institutions are responsible for obtaining required parental consents prior to student onboarding.

7. Data Security, Retention, and Account Deletion

We implement industry-standard technical and organisational safeguards, including HTTPS TLS 1.3 encryption in transit and AES-256 encryption at rest, to protect your personal data from unauthorised access, alteration, or disclosure.

Data Retention: We retain your personal data for as long as your account remains active or as necessary to provide you the Service, resolve disputes, and comply with legal obligations.

Self-Service Account Deletion: You have the right to delete your account and all associated data at any time. You can initiate immediate account deletion directly in the application by visiting Profile > Manage Account > Delete Account, or by emailing hello@hablacha.com. Upon deletion, your personal details, Google user data, voice evaluation history, and bookmarks are permanently and irreversibly purged from our active databases within 30 days.

8. Your Data Protection Rights (GDPR & UK GDPR)

Under European data protection legislation, you are entitled to the following rights:

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete personal data.
  • Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your personal data.
  • Right to Restrict Processing: Request suspension of processing under specific circumstances.
  • Right to Data Portability: Request export of your personal data in a structured, machine-readable format.
  • Right to Object: Object to processing based on legitimate interests or direct communication.

To exercise any of these statutory rights, please submit a request to hello@hablacha.com. We respond to all verified requests within 30 days without charge.

9. Contact Us

If you have questions, feedback, or concerns regarding this Privacy Policy or our privacy practices, please contact our Data Protection representative at:

Entity: SiteSpan Limited
Service: Hablacha (https://hablacha.com)
Email: hello@hablacha.com or contact@sitespanai.com
Jurisdiction: Ireland (European Union)