Privacy Policy

1. Who We Are (Data Controller)

NexSpeak is a language learning platform operated by Javier Wilfrido Garcia Goyes, a sole trader registered in the United Kingdom, trading as NexSpeak.

We are registered as a Data Controller with the UK Information Commissioner's Office (ICO) under the Data Protection Act 2018 and UK GDPR.

Data Controller: Javier Wilfrido Garcia Goyes (trading as NexSpeak)

Registered address: 60 Tottenham Court Road, Office 1203, Fitzrovia, London W1T 2EW, United Kingdom

ICO Registration No.: 00013746096

Email: [email protected]

2. What Data We Collect

We collect the following categories of personal data:

  • Account information: Name, email address, and profile picture (when provided via Google or email authentication).
  • Learning progress: Stories read, chunks learned, XP earned, SRS flashcard data, and session history.
  • Payment data: Subscription status and billing history. Payment card details are processed directly by Stripe and never stored on our servers.
  • Usage data: Information about how you interact with the audio player, stories, and learning tools.
  • Device information: Browser type, operating system, and general device characteristics (for compatibility and performance purposes).
  • Communications: Messages you send us via email or support channels.

3. How We Use Your Data

Your data is used to provide and improve the NexSpeak service:

  • Providing and personalising your language learning experience.
  • Synchronising your learning progress across devices.
  • Processing payments and managing your subscription.
  • Sending account-related communications (receipts, important updates).
  • Providing customer support.
  • Analysing usage trends to improve our content library and learning method.
  • Complying with our legal obligations.

3b. AI Speaking Tutor

NexSpeak includes an optional AI conversation tutor. When you use it, you are talking with an artificial intelligence system, not a human — this is clearly disclosed in the app before your first session, and the feature is available to users aged 18 and over.

  • Your voice is never stored. When you speak to the tutor, your audio is converted to text in real time and the audio is immediately discarded. No voice recordings are saved anywhere.
  • Conversation transcripts (text only) are stored for a maximum of 30 days to operate the feature and improve your learning experience, then automatically deleted. They are also deleted immediately if you delete your account.
  • Processors used by the tutor: Deepgram (speech-to-text, processed on EU infrastructure), Microsoft Azure (text-to-speech) and Google (language model). Each processes conversation content transiently to generate the tutor's responses and is bound by its own data processing agreement.
  • Tutor conversations are never used to train AI models and are never shared for advertising.

4. Lawful Basis for Processing

We process your personal data on the following lawful bases under UK GDPR:

  • Contract (Art. 6(1)(b)): Processing your account and learning data to deliver the service you signed up for.
  • Legitimate interests (Art. 6(1)(f)): Aggregate usage statistics to improve NexSpeak (see section 9 — in the UK, under the statistical exception in PECR Schedule A1, paragraph 5, without prior consent and with a simple way to object); fraud prevention and security.
  • Legal obligation (Art. 6(1)(c)): Retaining financial records as required by UK tax law.
  • Consent (Art. 6(1)(a)): Detailed usage analytics, advertising measurement (Meta Pixel) and, for visitors in the EU/EEA, aggregate statistics. You may withdraw consent at any time.

5. Data Processors & Third Parties

We share data with the following processors, each bound by their own privacy policies and data processing agreements:

Supabase — Database and authentication. Stores your account information and learning progress. Hosted on EU infrastructure.

Stripe — Payment processing. Handles all subscription payments and billing. PCI DSS Level 1 certified. Stripe stores payment card data; we never do.

ElevenLabs — Audio synthesis. Generates the British English voice audio used in our stories and learning content.

Cloudflare — Content delivery network and proxy for the whole website (nexspeak.com) and the audio files (audio.nexspeak.com). It tells our server only the visitor's country, which we use to apply the right privacy rules and to count visits by country group in aggregate; we do not store IP addresses for statistics.

Hetzner Online GmbH — Hosting provider for the servers that run nexspeak.com.

Deepgram — Speech-to-text for the AI tutor. Your voice is transcribed on EU infrastructure and the audio is immediately discarded (see section 3b).

Microsoft Azure — Text-to-speech for the AI tutor. Generates the tutor's spoken responses; processes only the tutor's reply text.

Google — Language model powering the AI tutor's conversation. Processes conversation text transiently to generate responses; not used to train models.

Umami Analytics — Website analytics, self-hosted on our infrastructure and only used if you allow usage analytics. It sets no cookies and does not store IP addresses. It records the pages viewed with a pseudonymous visit identifier, the referring site, campaign tags, approximate location (country, region and city) and device and browser details.

Meta Platforms, Inc. — Optional advertising measurement through Meta Pixel, loaded only after you allow advertising. The server-side Conversions API is currently disabled. You can change this choice in Privacy preferences. Meta is based in the USA.

6. International Transfers

Some of our processors (including Stripe, ElevenLabs, and Cloudflare) are based in the United States. When personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office.
  • Adequacy regulations under the UK GDPR framework.
  • Processor-specific certifications (e.g. Stripe's PCI DSS compliance).

7. Data Retention

We retain your personal data only for as long as necessary, in accordance with the UK GDPR principle of storage limitation (Article 5(1)(e)):

  • Account and learning data (email, name, learning progress, XP, session history): Retained while your account is active. If your account has had no login activity for 24 consecutive months, we will anonymise or delete your personal information. You may request deletion at any time — see Your Rights below.
  • Financial records (subscription history, payment amounts and dates): Retained for 6 years from the date of each transaction, as required by HMRC for Sole Trader tax records. After 24 months of inactivity, identifying personal data linked to these records (such as your name and email) is removed; only anonymised transaction data is kept for legal compliance.
  • Support communications: Retained for up to 2 years after your request is resolved.
  • Security and access logs: Retained for up to 12 months.
  • Aggregate statistics: Daily totals only, with no record per person, kept to compare trends over time.
  • Detailed usage analytics (only with your consent): Deleted automatically after 13 months.

8. Data Security

We implement industry-standard security measures including Row-Level Security (RLS) via Supabase (PostgreSQL), HTTPS encryption on all connections, secure authentication, and access controls. Your data is accessible only by you and authorised NexSpeak systems.

9. Cookies

You can change aggregate statistics, detailed analytics and advertising preferences for this browser at any time:

Privacy preferences
  • Essential session cookies: Required for authentication and to keep you logged in. Cannot be disabled without breaking the service.
  • Aggregate statistics (on by default in the UK; you can switch them off): To improve NexSpeak we count, per day, how many visits arrive, from which channel or social media post, which type of page they start and end on, which steps of the lesson are reached, active time in ranges, screen size category, browser language, approximate country group (for example United Kingdom, Spain, United States, Mexico or rest of Latin America, worked out by our server from the connection) and the choices made in the privacy notice. We do this without cookies and without following anyone: your browser keeps the entry channel and the steps already counted only for the current tab (session storage), and our server stores only daily totals — no IP address, identifier or record per person. Visits from paid advertising are counted without the ad they came from. We rely on the UK statistical exception (PECR Schedule A1, paragraph 5). If you are in the EU/EEA, or we cannot tell your country, these statistics only run if you switch them on. You can switch them off at any time in Privacy preferences; the choice is remembered in this browser.
  • Detailed usage analytics (optional — consent required): Umami measures website use. Our own analytics in Supabase records activity events, the pages you visit and their order, where a visit starts and ends, how long you are active on each page (time with the page visible and recent interaction or page audio playing), page URLs without query strings, referrer domains and campaign tags, browser details, screen size category and browser language, a per-tab identifier and, when signed in, your account identifier. It also records which version of an on-page experiment you were shown. Attribution may store the first referral source locally, and a local marker records the date of your first measured visit so we can tell new from returning visits. You can switch usage analytics off in Privacy preferences. This stops future browser events and clears local analytics identifiers; it does not delete previously received records or necessary learning progress.
  • Advertising cookies (optional — consent required): If you allow advertising in Privacy preferences, Meta Pixel may set cookies to measure ad performance. You can withdraw that choice using the same controls in the footer, your profile or this page. Withdrawal removes the advertising cookies accessible to this site and reloads the page to stop an already loaded Pixel. Previously transmitted data is not recalled by changing browser preferences.

10. Your UK GDPR Rights

Under UK GDPR, you have the following rights:

  • Right of access (SAR): Request a copy of the personal data we hold about you.
  • Right to rectification: Request correction of inaccurate or incomplete data.
  • Right to erasure: Request deletion of your personal data (“right to be forgotten”). See our dedicated Data Deletion page for the full procedure, including how to delete your account and what data is retained for legal reasons.
  • Right to restriction: Request that we limit how we process your data.
  • Right to data portability: Receive your data in a structured, machine-readable format.
  • Right to object: Object to processing based on legitimate interests.
  • Rights related to automated decision-making: Not to be subject to solely automated decisions that significantly affect you.
  • Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with the ICO: ico.org.uk/make-a-complaint

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email or via a notice within the app. The “Last Updated” date below always reflects the most recent version.

12. Contact

Data Controller: Javier Wilfrido Garcia Goyes (trading as NexSpeak)

Address: 60 Tottenham Court Road, Office 1203, Fitzrovia, London W1T 2EW, United Kingdom

ICO Registration No.: 00013746096

Email: 

NexSpeak™ is a trade mark of Javier Wilfrido Garcia Goyes (UK Trade Mark Application No. UK00004369436, Classes 9 and 41). Published 24 April 2026 by the UK Intellectual Property Office.

Last Updated: 22 October 2026