1. Information We Collect
We collect various types of information in order to provide, maintain, and improve our Service. The categories of personal data we process are described below.
1.1 Account Data
When you create a Ledoly account, we collect your full name, email address, and a securely hashed version of your password (using the bcrypt algorithm). If you sign up or log in through a third-party authentication provider (such as Google), we receive your name, email address, and profile picture URL from that provider. We also store your preferred display name, language preferences, and timezone.
1.2 Learning Data
As you use the Service, we automatically collect data about your learning activities, including: lesson and course progress, activity completion status, quiz scores and assessment results, time spent on individual activities and lessons, pronunciation scores and phoneme-level analysis results, streak and engagement metrics, and any notes or bookmarks you create. This data is essential for personalizing your learning path and tracking your improvement over time.
1.3 Voice and Audio Recordings
Our Service is an accent coaching platform, and pronunciation practice is a core feature. When you use pronunciation exercises, speaking activities, or the 60-Second Accent Audit, we record your voice through your device’s microphone. These recordings are used exclusively for pronunciation analysis and feedback. For detailed information about how we process voice data, please see Section 3: Voice & Audio Recordings.
1.4 Payment Data
When you purchase a subscription or course, payment transactions are processed entirely by our third-party payment processor, Stripe, Inc. SVFF LLC is the merchant of record for your purchase, and Stripe acts as our payment processor. We do not collect, store, or have access to your full credit card number, debit card number, or bank account details. We receive and store only a transaction reference ID, the payment amount and currency, subscription status and billing cycle dates, and the last four digits of your payment card (for your reference in your account settings). Stripe’s handling of your payment data is governed by the Stripe Privacy Policy.
1.5 Device and Browser Information
We automatically collect certain technical information when you access the Service, including: your IP address, browser type and version, operating system and device type, screen resolution, referring URL, pages visited and features used within the Service, and timestamps of your interactions. This information is collected through standard web server logs and our analytics tools.
1.6 Cookies and Similar Technologies
We use cookies and similar tracking technologies (such as local storage and session storage) to maintain your session, remember your preferences, and analyze usage patterns. For a comprehensive explanation of the cookies we use and how to manage them, please refer to our Cookie Policy.
2. How We Use Your Information
We process your personal data on the basis of contractual necessity (to deliver the Service you signed up for), legitimate interest (to improve and secure the Service), consent (for voice recordings), legitimate interest in marketing our own similar courses to our users, where you are told at sign-up and given a clear way to refuse then and in every message we send, and legal obligation (for tax and financial record-keeping). Specifically, we use your information for the following purposes:
2.1 Providing the Service
We use your account data and learning data to operate the platform, authenticate your identity, deliver lessons and activities, track your progress, and provide a seamless learning experience across sessions and devices.
2.2 Personalizing Your Learning Path
We analyze your learning data—including quiz scores, pronunciation assessments, time spent on activities, and areas of difficulty—to personalize your curriculum, recommend courses, adjust difficulty levels, and highlight areas where you need additional practice. This personalization is central to the value Ledoly provides.
2.3 AI Pronunciation Feedback
Your voice recordings are processed by our AI systems and third-party pronunciation analysis services to provide real-time feedback on your accent, intonation, stress patterns, and individual phoneme accuracy. See Section 3 and Section 4 for further details.
2.4 Analytics and Service Improvement
We use aggregated and anonymized data to analyze usage patterns, identify popular content, diagnose technical issues, measure the effectiveness of our teaching methodology, and develop new features. Individual users are not identified in these analyses.
2.5 Communication
We use your email address to send transactional messages (account confirmation, password resets, payment receipts), learning reminders and progress updates (which you can disable in your settings), and marketing communications about new courses, features, or promotions. When you create an account we offer to send you these marketing emails, with the option pre-selected; you may decline at sign-up, and we record your choice. You may unsubscribe from marketing emails at any time via the link in each email or through your account settings.
2.6 Security and Fraud Prevention
We use device, browser, and IP address information to detect unauthorized access attempts, prevent fraudulent transactions, protect against abuse of the platform, and maintain the integrity of our systems.
3. Voice & Audio Recordings
Because Ledoly is an English accent coaching platform, voice recording is a fundamental part of our Service. We take the privacy of your voice data very seriously and want to be fully transparent about how it is handled.
3.1 What We Record
We record audio from your device’s microphone only during specific learning activities where pronunciation practice is required. These include: pronunciation exercises where you repeat words, phrases, or sentences; speaking activities where you respond to prompts or engage in simulated conversations; the 60-Second Accent Audit (our initial diagnostic assessment); and any other activities explicitly marked with a microphone or speaking icon. We never access your microphone outside of these activities, and your browser will always display a microphone indicator when recording is active. Recording begins only after you explicitly tap or click a “Record” button and stops when you tap “Stop” or after a configurable maximum duration.
3.2 How Recordings Are Processed
Your voice recordings are processed through a multi-step pipeline:
- Capture: Audio is recorded in your browser using the Web Audio API and temporarily buffered on your device.
- Transmission: The audio is transmitted to our servers over an encrypted TLS/SSL connection.
- Phoneme Analysis: We transmit the audio to SpeechSuper, a third-party pronunciation assessment API, which performs phoneme-level analysis. SpeechSuper evaluates individual sound accuracy, word-level and sentence-level pronunciation scores, intonation and stress patterns, fluency and rhythm metrics, and specific phoneme errors common to English learners.
- Feedback Generation: The analysis results (scores, phoneme breakdowns, and improvement suggestions) are returned to our platform and presented to you as visual and textual feedback within the lesson interface.
- Storage: The raw audio recording and the resulting analysis data are stored on our servers for the retention period described below.
3.3 Storage Duration
Voice recordings are retained according to the following schedule:
- Active retention (90 days): For 90 days after recording, the audio file and its associated analysis data are stored in their original form. During this period, you can replay your recordings, review your pronunciation scores, and track improvement on specific sounds over time.
- Anonymization (after 90 days): After 90 days, the original audio file is permanently deleted. Only the anonymized, aggregated analysis data (scores and phoneme accuracy metrics, stripped of any identifying information) is retained for the purpose of improving our AI models and pronunciation assessment accuracy.
- Immediate deletion on request: You may request immediate deletion of all your voice recordings at any time by contacting us at privacy@ledoly.com or through the data management section in your account settings.
3.4 SpeechSuper Data Processing
SpeechSuper processes your audio solely for the purpose of returning pronunciation analysis results to Ledoly. Under our data processing agreement with SpeechSuper, they are contractually prohibited from retaining your audio recordings beyond the time needed to perform the analysis (typically seconds), using your audio for training their own models without separate consent, sharing your audio with any third party, and re-identifying anonymized data. SpeechSuper processes audio data on servers located in Asia and the United States.
3.5 Opt-Out Options
While voice recording is integral to the pronunciation coaching features of Ledoly, you have the following choices:
- Skip speaking activities: You may choose to skip pronunciation exercises and speaking activities. Your course progress may be affected, as some lessons require speaking practice for completion.
- Disable recording storage: In your account settings, you can enable a “no-storage” mode where your audio is sent for real-time analysis but is not stored on our servers after the analysis is returned. Note that this means you will not be able to replay past recordings or view historical pronunciation comparisons.
- Delete all recordings: You may request deletion of all stored recordings at any time.
- Withdraw microphone permission: You can revoke microphone access through your browser settings at any time. This will prevent all recording functionality.
4. AI Processing
Ledoly uses artificial intelligence and automated processing systems to enhance your learning experience. We are committed to transparency about how these systems work and the safeguards we have in place.
4.1 How AI Evaluates Your Submissions
Our AI systems process several types of learning submissions:
- Pronunciation assessments: Voice recordings are analyzed by SpeechSuper’s AI to score phoneme accuracy, intonation, stress, and fluency (as described in Section 3).
- Written responses: Text answers to writing exercises are evaluated by language models for grammar, vocabulary usage, coherence, and relevance to the prompt.
- Quiz and exercise answers: Objective answers (multiple choice, fill-in-the-blank, matching) are checked against defined correct answers by deterministic logic, not AI.
- Learning path recommendations: Your overall learning data is analyzed to suggest which courses, lessons, or practice areas would be most beneficial for your improvement.
4.2 No Fully Automated Decisions with Legal Effects
In accordance with Article 22 of the GDPR and Article 12 of Vietnam’s PDPD, we do not make any fully automated decisions that produce legal effects or similarly significant effects on you. Specifically: AI-generated pronunciation scores and feedback are advisory and intended to guide your learning—they do not constitute formal certifications or qualifications; no automated decision will result in denial of service, alteration of pricing, or any other consequential action without human involvement; and subscription management, account actions, and billing decisions always involve human review processes.
4.3 Human Review
You have the right to request human review of any AI-generated assessment or feedback. To request a human review, you may use the “Request Review” option available on assessment result screens, contact our support team at privacy@ledoly.com, or submit a request through your account settings. Human reviews are conducted by qualified English language instructors and are typically completed within 5 business days.
5. Information Sharing
We do not sell, rent, or trade your personal data to third parties. We share your information only in the limited circumstances described below.
5.1 Service Processors
We use the following third-party service providers (data processors) who process personal data on our behalf and under our instructions:
- SiteGround (hosting): Our web application and databases are hosted on SiteGround servers in Singapore. SiteGround stores your account data, learning data, and voice recordings as our infrastructure provider.
- Stripe (payments): Stripe processes all payment transactions. They receive your payment card details, billing address, and transaction amounts. We have a Data Processing Agreement (DPA) with Stripe.
- SpeechSuper (pronunciation analysis): SpeechSuper receives your voice recordings for phoneme-level pronunciation analysis. Audio is processed in near-real-time and is not retained by SpeechSuper beyond the analysis duration.
5.2 Analytics Tools
We may use analytics services to understand how users interact with our Service. These tools collect anonymized or pseudonymized usage data (pages visited, features used, session duration). We configure these tools to respect Do Not Track (DNT) browser signals and to minimize the collection of personally identifiable information.
5.3 Legal Requirements
We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, including requests from Vietnamese authorities under the Cybersecurity Law (Law No. 24/2018/QH14) and the PDPD, or from EU data protection authorities under the GDPR.
5.4 Business Transfers
In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Service before your data is transferred and becomes subject to a different privacy policy.
5.5 Our Commitment
We want to be unequivocal: we never sell your personal data. We do not share your data with advertisers. We do not participate in data broker marketplaces. Your learning data, voice recordings, and personal information are used solely to provide and improve the Ledoly Service.
6. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The specific retention periods are as follows:
| Data Type | Retention Period |
|---|---|
| Account data | Until account deletion |
| Learning progress & scores | 2 years after last activity |
| Voice recordings | 90 days, then anonymized |
| Payment records | 7 years |
| Server & access logs | 12 months |
| Cookie & analytics data | Per cookie type (see Cookie Policy) |
When you delete your account, we will delete or anonymize your personal data within 30 days, except for data we are legally required to retain (such as payment records for tax compliance). Anonymized and aggregated data that cannot be used to identify you may be retained indefinitely for research, analytics, and service improvement purposes.
If your account is inactive (no login or learning activity) for a continuous period of 2 years, we will send you a notice before deleting your learning data. Your account credentials will be retained so you can log in again, but course progress and scores will be removed after the notice period.
7. Your Rights
Under the GDPR (for users in the European Economic Area), Vietnam’s PDPD (for users in Vietnam), and other applicable data protection laws, you have the following rights regarding your personal data:
7.1 Right of Access
You have the right to request a copy of all personal data we hold about you. This includes your account information, learning data, pronunciation scores, stored voice recordings, and any other data associated with your account. We will provide this data in a commonly used, machine-readable format (JSON or CSV) within 30 days of your request.
7.2 Right to Correction
You have the right to request correction of any inaccurate or incomplete personal data. You can update your name, email address, and profile information directly in your account settings. For corrections to other data, please contact us.
7.3 Right to Deletion (Right to Be Forgotten)
You have the right to request that we delete your personal data. You can delete your entire account through your account settings, which will trigger deletion of all associated personal data (subject to the retention periods for legally required records described in Section 6). You can also request deletion of specific data categories, such as voice recordings only.
7.4 Right to Data Portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another service provider. Upon request, we will provide an export of your learning data, pronunciation history, and account information.
7.5 Right to Restrict Processing
You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when you have objected to processing pending verification of our legitimate grounds.
7.6 Right to Object
You have the right to object to the processing of your personal data based on our legitimate interests. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defense of legal claims.
7.7 Right to Withdraw Consent
Where we rely on your consent to process personal data (such as for voice recordings or marketing communications), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw consent through your account settings, by following the unsubscribe link in marketing emails, by revoking microphone permissions in your browser, or by contacting us directly.
7.8 How to Exercise Your Rights
To exercise any of these rights, you may:
- Email our Data Protection Officer at privacy@ledoly.com
- Use the data management tools in your account settings
- Write to us at: SVFF LLC (operating as Ledoly), Delaware, USA
We will respond to your request within 30 days. If we need more time (up to an additional 60 days for complex requests), we will inform you of the extension and the reasons for it. We will verify your identity before processing any rights request to protect your data from unauthorized access.
7.9 Right to Lodge a Complaint
If you believe that our processing of your personal data violates applicable data protection laws, you have the right to lodge a complaint with a supervisory authority. For users in the EU/EEA, this is the Data Protection Authority in your member state. For users in Vietnam, you may contact the Ministry of Public Security’s Department of Cybersecurity and High-tech Crime Prevention.
8. Children’s Privacy
We take the privacy of children seriously and comply with the U.S. Children’s Online Privacy Protection Act (COPPA), the GDPR’s provisions on children’s consent, and Vietnam’s PDPD requirements for minor data subjects.
8.1 Age Restrictions
The Ledoly Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we discover that we have inadvertently collected personal data from a child under 13, we will promptly delete that data and terminate the associated account.
8.2 Users Aged 13 to 16
Users between the ages of 13 and 16 may use the Service only with verifiable parental or guardian consent. During registration, users who indicate they are in this age range will be prompted to provide a parent or guardian’s email address. We will send a consent request to that email address and will not activate the account or collect further data until consent is confirmed. Parents or guardians of users aged 13–16 may review their child’s personal data, request corrections or deletion, and withdraw consent at any time by contacting privacy@ledoly.com.
8.3 Voice Recordings of Minors
For users aged 13–16 who have parental consent, voice recordings during pronunciation exercises are subject to the same processing described in Section 3, with the additional safeguard that all voice data for minor users is flagged for priority deletion and is automatically purged after 30 days (rather than the standard 90 days). Parents may request immediate deletion of their child’s voice recordings at any time.
8.4 Reporting
If you believe a child under 13 has provided us with personal information, or if you are a parent or guardian who wishes to exercise rights on behalf of a minor, please contact us immediately at privacy@ledoly.com.
10. International Data Transfers
Ledoly is owned and operated by SVFF LLC, a United States limited liability company registered in the State of Delaware, USA. Your data may be processed in multiple jurisdictions, as described below.
10.1 Where Your Data Is Stored
Your primary data (account information, learning progress, and voice recordings) is stored on SiteGround servers located in Singapore. We selected Singapore for its strong data protection framework (the Personal Data Protection Act 2012), geographic proximity to a large share of our users across Asia, and robust digital infrastructure.
10.2 Where Your Data Is Processed
In addition to Singapore, your data may be processed in the following locations:
- United States: Voice recordings are transmitted to SpeechSuper for pronunciation analysis. Stripe processes payment data through its U.S.-based infrastructure. AI language models used for writing feedback may be hosted in the U.S.
- Vietnam: Our team members in Ho Chi Minh City may access personal data for customer support, human review of AI assessments, and platform administration.
10.3 Transfer Safeguards
For transfers of personal data from the EU/EEA to countries that have not received an adequacy decision from the European Commission, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision 2021/914). We also conduct Transfer Impact Assessments (TIAs) as required. For transfers under Vietnam’s PDPD, we comply with the cross-border data transfer requirements of Decree 13/2023/ND-CP, including filing impact assessments with the Ministry of Public Security where required. All third-party processors with access to personal data have executed Data Processing Agreements that include appropriate data protection obligations, data breach notification requirements, sub-processor restrictions, and audit rights.
11. Security Measures
We implement comprehensive technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.
11.1 Encryption
All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (SSL/TLS). Voice recordings are encrypted during transmission and at rest on our servers. Database backups are encrypted using AES-256 encryption.
11.2 Password Security
Your password is never stored in plain text. We use the bcrypt hashing algorithm with a high-cost factor to generate a one-way hash of your password. Even in the unlikely event of a database breach, your actual password cannot be recovered from the stored hash.
11.3 Access Controls
Access to personal data within our organization is restricted on a strict need-to-know basis. Team members who require access to user data for support or administrative purposes use individual authenticated accounts with role-based permissions. All access to production systems is logged and auditable.
11.4 Infrastructure Security
Our hosting infrastructure (SiteGround) provides firewall protection, DDoS mitigation, intrusion detection systems, automated malware scanning, and regular security patching. We use Web Application Firewall (WAF) rules to protect against common web vulnerabilities (SQL injection, cross-site scripting, etc.).
11.5 Regular Audits and Testing
We conduct regular security reviews of our codebase and infrastructure, vulnerability assessments, dependency audits (to ensure third-party libraries are up to date and free of known vulnerabilities), and review of access logs and security events. We also maintain an incident response plan to address any potential data breaches promptly.
11.6 Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by the GDPR) and notify affected users without undue delay via email, describing the nature of the breach, the likely consequences, and the measures we have taken or propose to take to address it. We will also comply with Vietnam’s PDPD breach notification requirements.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable laws. When we make changes, we will follow the process described below.
12.1 Notification
For material changes to this Privacy Policy, we will provide at least 30 days’ advance notice before the changes take effect. Notice will be provided by posting the updated policy on this page with a revised “Last updated” date, displaying a prominent banner notification on the Service, and sending an email to the address associated with your account (for registered users).
12.2 Acceptance
Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes. If you do not agree with the updated policy, you should discontinue use of the Service and may request deletion of your account and personal data as described in Section 7.
12.3 Version History
We will maintain a record of previous versions of this Privacy Policy. You may request access to any prior version by contacting us at privacy@ledoly.com.
13. Data Protection Officer
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our Data Protection Officer:
SVFF LLC (operating as Ledoly)
SVFF LLC · Delaware, USA
We aim to respond to all privacy-related inquiries within 5 business days.
For general support inquiries unrelated to data privacy, please use our Contact page.