Privacy policy

PRIVACY POLICY OF THE BEESPEAKER APPLICATION

(Information on joint controllership pursuant to Art. 13, 14, and 26 of the GDPR)

Document version: November 30, 2026

This Privacy Policy sets out the rules for collecting, using, and safeguarding the personal data of users using the BeeSpeaker mobile application and the associated website.

The Joint Controllers process your data in full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR).

1. WHO IS THE CONTROLLER OF YOUR DATA? (JOINT CONTROLLERSHIP)

Your personal data is processed jointly within the corporate group by two Joint Controllers (pursuant to Art. 26 of the GDPR):

  1. BeeSpeaker AB with its registered office in Stockholm, Björngårdsgatan 14B, 118 52 Stockholm, Sweden, entered into the Swedish Companies Registration Office under number 559363-5112 (hereinafter: the “Swedish Company” or the “Owner”);
  2. Beespeaker Sp. z o.o. with its registered office in Warsaw, Poland, ul. Al. Jerozolimskie 181B, 02-222 Warsaw, entered into the Register of Entrepreneurs of the National Court Register (KRS) under number 0000927598, NIP (Tax ID): 7011056060 (hereinafter: the “Polish Company” or the “Technical Operator”).

2. HOW DO WE SHARE RESPONSIBILITY? (ESSENTIAL TERMS OF THE ARRANGEMENT)

  1. Under the concluded joint controllership agreement, we have established an allocation of roles and tasks that reflects actual operations within the application:
  2. Role of the Swedish Company: As the formal owner and publisher of the application in the Apple App Store and Google Play stores, it is responsible for making the application available on international markets, publishing the current Privacy Policy in the store profiles, and global billing matters.
  3. Role of the Polish Company: As the entity concentrating the programming and engineering back-office, it acts as the Main Establishment in the technical area. It is responsible for IT architecture, server security, implementing privacy by design principles, integrating speech recognition modules, and ongoing handling of user requests.
  4. Main Contact Point: The Joint Controllers have agreed that the lead entity responsible for the operational execution of your rights and responding to inquiries is the Polish Company.
  5. Your entitlement: Regardless of the internal allocation of tasks, you have the full right to address your requests and exercise your rights under the GDPR directly against each of the Joint Controllers.

3. DATA PROTECTION OFFICER (DPO) AND PRIVACY CONTACT

The data protection structure within our group follows this contact model:

  1. Data Protection Officer at the Polish Company: The Polish Company (Technical Operator) has appointed a Data Protection Officer (DPO). You can contact them directly regarding all matters concerning the processing of your data in the application, system security, and the exercise of your rights under the GDPR:
    • E-mail: rodo@beespeaker.com
    • Mailing address: Beespeaker Sp. z o.o. with its registered office in Warsaw, Poland, ul. Al. Jerozolimskie 181B, 02-222 Warsaw, with the annotation “Data Protection Officer”
  1. The Swedish Company (BeeSpeaker AB) has not appointed a Data Protection Officer, relying on the absence of an obligation to appoint one for its corporate structure. In matters directly concerning the Swedish Company, you may contact:
    • electronically at: rodo@beespeaker.com
    • by traditional mail to: BeeSpeaker AB, Björngårdsgatan 14B, 118 52 Stockholm, Sweden.
  1. All inquiries directed to rodo@beespeaker.com go directly to the DPO of the Polish Company and the dedicated support team in Poland and Sweden, which ensures the fastest path for processing them.

4. WHAT DATA DO WE COLLECT AND HOW?

We process only the data that is adequate and necessary to provide services in the Application:

  1. Account and registration data:
    • Standard registration: e-mail address, username / first name, password (in encrypted form), declared age / date of birth. For learning certain languages, a preferred grammatical form may be indicated.
    • Third-party login (Google / Apple / Facebook): user identifier from the given portal (ID), first name, last name, e-mail address, and language – according to your privacy settings on these platforms.
  1. Learning progress and activity history: statistics of completed lessons, number of words spoken, points earned, trophies, exercise history, proficiency level, and subscription status (including Premium Account).
  2. Voice samples and audio stream (Speech Recognition):
    • During microphone exercises, the Application transmits an audio stream via the WebSocket protocol to speech-to-text modules (Google Cloud STT) or dedicated infrastructure matching pronunciation against the lesson template (in the AWS cloud).
    • No processing of biometric data: Audio samples are processed in real time solely for the purpose of verifying linguistic correctness (phonetic and textual analysis). The recordings are not used to identify your identity and do not constitute a special category of personal data (biometric data) within the meaning of Art. 9 of the GDPR.
  1. Technical and operational data: IP address, mobile device model, operating system version, anonymous advertising identifiers (if consent was given), error and diagnostic logs.
  2. Payments: information about the subscription status, purchase date, and transaction identifier from the Apple App Store / Google Play (we do not store your payment card details – transactions are processed directly by the mobile store operators).

5. PURPOSES AND LEGAL BASES OF PROCESSING

We process your data on the basis of applicable GDPR provisions:

Purpose of processingGDPR legal basis
Provision of services in the Application: account registration, unlocking courses, synchronizing progress, and running speech exercises with instant pronunciation feedback.Art. 6(1)(b) of the GDPR (necessity for the performance of a contract for the provision of electronic services).
Personalization of the service in the Application by adapting the grammatical forms used by the AI Tutor to your indicated preference, in languages where it applies.Art. 6(1)(a) of the GDPR (consent to the processing of information about the preferred grammatical form).
Consent can be withdrawn at any time in the Application settings without affecting the lawfulness of the processing carried out prior to withdrawal.
In-app notifications and system messages: sending push and e-mail notifications about account changes, lesson reminders, and maintaining the learning streak.Art. 6(1)(b) of the GDPR (performance of a contract) or Art. 6(1)(f) of the GDPR (legitimate interest).
Our legitimate interest consists in ensuring proper, secure, and transparent communication with our customers in matters related to the operation of the Application.
Cooperation within the corporate group: exchange of technical and operational data between the Swedish Company and the Polish Company for administrative purposes, IT support, and code development.Art. 6(1)(f) of the GDPR (legitimate interest of a group of undertakings).
Our legitimate interest consists in the efficient use of shared resources and competencies of the companies in the corporate group, ensuring business continuity of IT systems, and improving the quality and functionality of the developed software.
Accounting and tax requirements: issuing invoices, settling subscriptions, and maintaining financial records.Art. 6(1)(c) of the GDPR (legal obligation of the controller).
Analytics, statistics, and security: examining the quality of the Application, optimizing courses, fraud detection, and protection against cyberattacks.Art. 6(1)(f) of the GDPR (legitimate interest).
The legitimate interest of the controller consists in improving the quality and effectiveness of the offered courses and ensuring the secure and continuous operation of the Application, including the protection of data, systems, and users against fraud and cyber threats.
Newsletter and direct marketing: sending promotional materials and special offers to the e-mail address.Art. 6(1)(f) of the GDPR (legitimate interest).
Our legitimate interest consists in developing our business by promoting the Application and the offered courses and services, acquiring new customers, and maintaining relations with current customers.
Electronic communication law requires us to obtain consent to send marketing communication via e-mail or push notifications; such communication will be conducted after obtaining the required consent, including system consent on your device.
Defense against claims: establishment, exercise, or defense of civil claims arising from the provision of services.Art. 6(1)(f) of the GDPR (legitimate interest).
The legitimate interest of the controller consists in defending the interests or rights arising from a given claim.

6. DATA RECIPIENTS

  1. We may transfer your personal data to the following categories of recipients, to the extent necessary to achieve the purposes described in this Policy:
    • Entities from our corporate group and affiliated entities that support us in operating and developing the Application.
    • Providers of technology services, including hosting, IT infrastructure and security, AI functions, speech recognition, external login, and office and organizational tools.
    • Operators of app stores and payment service providers who process purchases, subscriptions, billing, and refunds.
    • Providers of communication and user support services, including e-mail, notifications, and technical support.
    • Providers of analytical and marketing services, including advertising and social media platforms, as well as providers of tools for website operation, forms, and user registration.
    • Providers of professional services, including legal, accounting, tax, audit, and consulting services, as well as insurers and entities supporting us in debt collection and the protection of our rights.
    • Providers of external AI services. More information in section 7 below.
  1. The databases of our users and audio analysis modules are located exclusively in the regions of the European Economic Area (EEA) within the infrastructure of Google Cloud Platform (Belgium) and AWS EMEA SARL (Frankfurt, Germany). The user’s personal data may be transferred outside the European Economic Area, in particular in connection with our use of global providers of IT, cloud, analytical, advertising, payment, communication, social media, speech recognition, AI functions, as well as cookies and similar technologies.
  2. The transfer of data outside the European Economic Area may concern in particular providers based or having infrastructure in the United States.
  3. If personal data is transferred outside the European Economic Area, the Controller ensures the application of mechanisms required by the GDPR, in particular by:
    • transferring data to countries for which the European Commission has issued a decision confirming an adequate level of personal data protection;
    • transferring data to entities based in the United States that participate in the EU-U.S. Data Privacy Framework.
    • applying standard contractual clauses adopted by the European Commission, if they are required for a given transfer.

7. EXTERNAL AI PROVIDERS (AI DATA SHARING)

  1. The Application uses artificial intelligence (AI) solutions. As a rule, we use our own solutions in a private cloud. In some cases, we may use external AI providers.
  2. If you grant explicit permissions to the Application, we may transfer the following data to the following external AI providers:
    • OpenAI: OpenAI Ireland Ltd. – speech transcripts, first name, learning goal, proficiency level, interests, preferred grammatical form to generate virtual teacher responses, notes, and feedback or translations;
    • Google Cloud: Google Cloud EMEA Limited – recordings of your utterances for speech recognition and tutor texts, which may contain your first name, for speech synthesis;
    • Microsoft Azure AI Speech: Microsoft Ireland Operations Limited – texts – of the AI Tutor, which may contain your first name, for speech synthesis. We will also transfer recordings of your utterances for speech recognition.
  1. The above recipients are our processors who process data on our behalf based on a data processing agreement. We do not sell your data or share it for purposes other than those indicated in this policy. Providers do not use your data for further training of their models.
  2. The AI service providers to whom we transfer your personal data provide them with protection at least equivalent to the protection described in this Privacy Policy.
  3. If you do not grant or if you withdraw your permission to share data with external AI providers, some functionalities of the Application may be unavailable. You can withdraw your permissions in the Application settings.

8. HOW LONG DO WE STORE DATA?

  1. Account data and learning history: until you delete your account. After its deletion, we retain only the data necessary for billing, fulfilling legal obligations, or establishing, exercising, and defending against claims.
  2. Purchase, payment, and billing data: for the duration of transaction processing, and then for the period required by applicable tax and accounting regulations.
  3. Correspondence, requests, and complaints: for the duration of handling the case, and then, if necessary, until the expiration of the relevant statute of limitations for claims. In the event of a dispute, we retain the data necessary for its resolution until the end of the proceedings and the settlement of its outcome.
  4. Voice samples (audio): we process them during the exercise, and after the analysis is completed, we delete or irreversibly anonymize them. The results of exercises saved in the learning history are stored according to the rules for account data.
  5. Marketing data, including the newsletter: until consent is withdrawn or an objection is raised, depending on the legal basis for processing. Afterwards, we may retain limited data needed to demonstrate the consent given and to process the opt-out and respect your choice.
  6. Technical, analytical data, and cookies: Retention periods for cookies and data obtained using similar technologies are indicated in the section on cookies.

9. YOUR RIGHTS UNDER THE GDPR

  1. Under the provisions of the GDPR, you have the right to:
    • Access your data (Art. 15 of the GDPR) – to obtain information about the processed data and receive a copy of it;
    • Rectify data (Art. 16 of the GDPR) – to correct incomplete or inaccurate data;
    • Erasure of data (the “right to be forgotten”) (Art. 17 of the GDPR) – to delete your account and associated data;
    • Restriction of processing (Art. 18 of the GDPR);
    • Data portability (Art. 20 of the GDPR) – to receive data in a structured, commonly used machine-readable format;
    • Object (Art. 21 of the GDPR) – to object to processing based on our legitimate interest (including for marketing purposes);
    • Withdraw consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal).
  1. How to submit a request? Contact our DPO and support team directly at: rodo@beespeaker.com. We will respond to your request without undue delay, no later than within 1 month.
  2. Right to lodge a complaint with a supervisory authority:
    If you believe that the processing violates the law, you have the right to lodge a complaint with the competent supervisory authority:
    • The lead supervisory authority for our Main Technical Establishment is the President of the Personal Data Protection Office (PUODO) in Poland.
    • You can also lodge a complaint with the authority in the country of your habitual residence or place of work (including in Sweden to the Integritetsskyddsmyndigheten – IMY).

10. AUTOMATED DECISION-MAKING AND PROFILING

  1. Within the Application, you use advanced speech analysis algorithms and can use the intelligent AI Tutor, which helps in language conversations. However, this processing is solely educational and auxiliary in nature.
  2. We may conduct automated analysis of your data to provide and personalize our Services available in the Application, as well as for marketing purposes. In particular, we may analyze your activity in the Application, lesson history, exercise results, learning progress, the language you selected, educational preferences, answers you provided in lessons, quizzes, and surveys, and how you use voice features, AI features, or dynamic lessons. We may use this analysis to tailor educational or marketing content, exercise sequences, feedback, reminders, and Application functionalities to the way you use our Services, and to measure the effectiveness of advertising.
  3. Using the Application does not result in decisions based solely on automated processing (including profiling) that would produce any legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 of the GDPR.

11. CHILDREN’S PRIVACY PROTECTION (AGE VERIFICATION)

  1. The BeeSpeaker Application is intended for individuals who are at least 16 years of age.
  2. The use of the Application by individuals under the age of 16 requires the consent and supervision of a parent or legal guardian.
  3. We do not knowingly collect data from children below the threshold required by the applicable law of a given country (including under the age of 13 within the meaning of the US COPPA act) without the consent of a guardian. If we learn that an account has been registered by a child without parental consent, we will take steps to immediately delete such data.

12. COOKIES AND MOBILE TECHNOLOGIES

  1. In the website and in the Application, we may use session and persistent cookies and SDK mobile identifiers.
  2. Cookies are small text files that are saved on your computer or smartphone when you use our website. In the Application, we also use similar technologies, including built-in SDK modules, which may save or read user, device, installation, and session identifiers, advertising identifiers, and push tokens on your device, used to support communication, analyze activity in the Application, and measure the effectiveness of marketing campaigns.
  3. We have divided cookies and similar technologies into two groups for you:
    • Necessary for using our website or Application.
    • Others.
  1. Necessary cookies and similar technologies are used, among others, to ensure the security and stability of our website or mobile application, remember your selected privacy preferences, support online forms, save your progress, and maintain a logged-in session. We use them without having to obtain your consent, exclusively to the extent necessary to carry out the transmission of an electronic communication or to provide the service you wish to use (pursuant to Art. 399 sec. 3 of the Act – Electronic Communications Law). We save or read information on your device when it is necessary to achieve these purposes.
  2. Other cookies and similar technologies are used solely after obtaining your consent. This principle also covers saving or reading mobile identifiers via SDKs for purposes other than necessary ones, e.g., for analytical or advertising purposes.
  3. The full list of cookies used on our website is available in the consent management tool for the use of cookies, which is displayed upon entering the website and in the Application. In this tool, you can review the specific types of cookies, their purpose, and information regarding each of them. Through it, you can also give or withdraw your consent and manage your preferences and consents regarding the use of cookies.

13. CHANGES TO THE PRIVACY POLICY

The Joint Controllers reserve the right to update this Privacy Policy in the event of modifying the Application’s functionalities, implementing new technologies, or changes in legal regulations. Users will be notified of any material changes in advance, appropriate to the significance of the changes, via the Application (in-app message) or by e-mail.

Version History

Beespeaker – Privacy policy v1 EN
Beespeaker – Privacy policy v2 EN