Your learning record is personal.

Who is responsible

Ashish Alexander is the data controller for Expat Speak.

Ashish Alexander | Lisa-Fittko-Straße 7 | 10557 Berlin | Germany | ashlx@hwsaver.com

What Expat Speak stores

• Account details: email address, account ID and authentication session.
• Free resources: bookmarked vocabulary words and grammar chapters, and the most recent time each entry was viewed while signed in. These records support saved entries, separate vocabulary and grammar progress, and resume; they do not measure language proficiency.
• Story profile: first name, form of address, selected portrait, country, and optional fictional family name and birth date used only inside the course.
• Learning record: chapter position, answers, transcripts, feedback, attempts, completion history, story messages and objects.
• Billing references: Stripe customer and subscription IDs, status and renewal dates. Expat Speak does not store card numbers.
• Service controls: bounded provider-use counters, command receipts and security or delivery logs needed to operate the application.
• Consumer requests: the name, email, contract reference, declaration and receipt time supplied through the cancellation or withdrawal form.

Microphone and generated audio

A speaking attempt sends the recording to the configured transcription provider and the resulting transcript to the assessment provider. Expat Speak does not persist the raw microphone recording in its database or object storage.

Personalised model audio may be privately cached using an opaque key. It can speak the fictional story profile, so it remains part of the coordinated deletion review.

Why the data is used

• To provide the account, save progress and continue the connected course story.
• To restore saved words and grammar chapters, and your place in each section of the free A1 German reader across devices.
• To assess course activities and return learner-facing feedback.
• To provide and manage the paid Chapters 2–16 subscription.
• To secure the service, prevent duplicate commands and control provider costs.
• To respond to support, access, correction, export or deletion requests.

The intended legal bases are performance of the learner agreement, legitimate interests in operating a secure service, and legal obligations for records that must be retained.

Service providers

The current application can use these processor categories:

• Neon for Postgres data and authentication.
• Cloudflare R2 for private reviewed and personalised audio.
• Stripe for checkout, subscription management and payment records.
• ElevenLabs for speech generation and transcription.
• OpenRouter-hosted models for configured assessment tasks.
• Resend for account and consumer-request confirmation email.
• Vercel for application delivery and operational logs.

Current provider details and available processing information can be requested through the support address above.

Retention and deletion

Course progress stays connected to the account so the learner can return. Cancelling a subscription removes paid access but does not delete progress. An account deletion request is coordinated across authentication, course data, vocabulary and grammar bookmarks and viewing records, billing references and personalised media; the account page never labels the request as completed early. A human operator reviews and completes valid requests within seven days.

Billing, fraud-prevention and legal records are retained only for the periods required by applicable tax, commercial and payment law. Operational records are retained only while needed to run and secure the service. Cancellation and withdrawal records are retained while the request is handled and for the period needed to document compliance or resolve a dispute.

International processing

Some service providers may process data outside Germany or the European Economic Area. Where this happens, Expat Speak relies on an applicable adequacy decision or contractual safeguards provided for under European data-protection law. Provider-specific information can be requested through the contact address above.

Your choices and rights

• Download the self-service account data export.
• Request or cancel coordinated account deletion from the account page.
• Ask to access, correct, restrict, object to, or erase personal data.
• Complain to the competent data-protection authority.

The European Data Protection Board explains these rights in its guidance for individuals’ rights.

Cookies and tracking

Expat Speak currently uses the essential authentication session needed to keep a learner signed in. The free reader stores no guest bookmarks or viewing history. A tab stores whether its sign-in prompt has appeared and, after a deliberate bookmark click, a pending action for up to 30 minutes. Dismissing sign-in clears that action. The repository contains no advertising tracker or analytics cookie. Stripe may use its own essential checkout and portal technologies on Stripe-hosted pages.