Privacy Policy

Fluenci — AI-Powered Language Learning Platform
Operated by NovaWealth
Effective Date: October 15, 2026

Fluenci ("we," "us," or "our") is an AI-powered language learning platform operated by NovaWealth. This Privacy Policy describes how we collect, use, share, and protect information when you use the Fluenci application and related services (collectively, the "Service"). It applies to all users, including individual learners, students, teachers, and school administrators.

We are committed to protecting your privacy and complying with applicable laws, including the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and applicable state student privacy laws. If you have questions after reading this policy, please contact us at privacy@fluenciapp.com.

Table of Contents

1. Information We Collect
2. How We Use Your Information
3. How We Do Not Use Your Information
4. Data Sharing and Subprocessors
5. Data Retention
6. Your Rights
7. Children's Privacy and COPPA
8. FERPA Compliance
9. Security Measures
10. Breach Notification
11. International Users
12. Changes to This Policy
13. Contact Us

1. Information We Collect

We collect information in the following categories:

Account Information

• Email address — used for authentication and account recovery.
• Display name — used for in-app identification and teacher visibility within classrooms.
• Early-access preference and campaign source — when an individual chooses iPhone launch updates, we store that choice, the time it was made, and limited campaign tags (such as source and campaign name) so we can send the requested launch messages and understand which outreach brought people to Fluenci. We do not use this information to market to students through a school account.

Educational Records

When you use Fluenci through a school or educational institution, the following data constitutes education records under FERPA:

• Organization membership — your role (student, teacher, administrator) and classroom assignments.
• Learning progress — CEFR proficiency level, lesson completion data, and time practised.
• Chat messages — text conversations with the AI tutor, used for tutoring and teacher review.
• Voice and photo inputs — microphone audio used for transcription or live tutoring, and photos you explicitly select for avatar generation. Fluenci does not store raw microphone audio after processing. A photo you submit for an avatar is held in private storage only until your avatar is drawn and is deleted immediately afterwards (and in any case within one hour); generated avatar images and derived transcripts may be stored with your account.
• Assignment submissions — work submitted for grading and progress tracking.
• Spaced repetition data — review scheduling data that personalizes your learning experience.

Operational Data

• Usage analytics — named product events, screens visited, session duration, feature engagement, app version, subscription tier, and an internal account identifier. Our analytics provider also receives your device's IP address with each event and may use it to derive an approximate location (city and country). Free-form lesson, chat, and voice content is excluded from analytics events.
• Crash and error reports — when the app crashes or encounters an unexpected error, we collect a technical report containing the error message, stack trace, app version, device model, operating system version, and your internal account identifier (a random ID, not your name or email). We use this solely to diagnose and fix defects. Reports never include lesson content, chat messages, or voice audio, and credentials are stripped before the report leaves the device.
• Network data — like any internet service, our hosting and infrastructure providers (Supabase, Vercel for this website, and our analytics and crash-reporting providers) receive your IP address when your device connects to them. It is used to deliver the Service, secure it, and prevent abuse.

Payment Information

• Subscription and billing data — purchases may be made through Apple In-App Purchase, Google Play, or Fluenci's web checkout. RevenueCat manages subscription entitlements across platforms, and Stripe processes web payments. Fluenci stores provider customer/transaction identifiers, entitlement status, plan, and expiration metadata. We do not receive or store full payment-card credentials.

2. How We Use Your Information

We use the information we collect exclusively for the following purposes:

1. Delivering personalized language instruction — adapting lessons, exercises, and review schedules to your proficiency level and learning goals.
2. Generating progress reports — providing performance data to you and, when applicable, to your educational institution and teachers.
3. Enabling teacher oversight — allowing teachers to grade work, provide feedback, and adjust curriculum for their classrooms.
4. Improving the Service — analyzing aggregated, de-identified usage data to improve product quality and educational outcomes. Individual student data is never used for this purpose in identifiable form.
5. Sending requested launch updates — emailing individual users who explicitly ask for iPhone early-access, launch, or founding-member updates. These messages are optional and can be stopped at any time.

3. How We Do Not Use Your Information

We want to be explicit about what we will never do with your data:

• No advertising or marketing to students. We do not use student data to advertise or market products or services. Optional launch emails are limited to individuals who request them outside a school-managed context.
• No sale or rental of data. We do not sell, rent, or lease personal information or education records to any third party, for any reason, under any circumstances.
• No non-educational profiling. We do not build behavioral profiles of students for purposes unrelated to their education.
• No AI training on your content. Fluenci does not use learner content to train models. Our AI providers receive it through their commercial APIs, which restrict how they may use it: Anthropic and OpenAI do not train on data sent through their commercial APIs by default, and we have not opted in to any programme that would allow it. Fish Audio and Microsoft Azure receive only the text to be spoken aloud and which voice to speak it in. Institutions that need additional contractual terms can contact us before deployment.

4. Data Sharing and Subprocessors

We share data only with the subprocessors listed below, solely to operate the Service. Each subprocessor is bound by a data processing agreement (DPA) that restricts use of data to service delivery only.

We use these providers only to operate, secure, bill, and improve the Service. If we add a new subprocessor that will receive student personal information, we will update this policy and provide any notice required by the applicable institutional agreement or law.

Your choices about AI processing

Fluenci does not build its own language models, so delivering AI tutoring means sending your content to the providers above. How you control that depends on what is being sent:

• Typed content — before messages or writing are sent for AI replies or feedback, the app asks for explicit permission. Anthropic receives the submitted text and relevant conversation history; OpenAI may process text for safety checks. Text-to-speech sends the text to be spoken and voice selection to Microsoft Azure or Fish Audio. You may decline, keep your draft, and use non-AI lessons, reviews and reading. Withdraw text and voice permission in Profile → Settings; this does not recall requests already sent or delete saved content.
• Microphone audio and photos — voice sessions, spoken practice, and a photo you select for an avatar go to OpenAI. Transcripts may also go to Anthropic for feedback and debriefs. We ask for permission in the app before using these features. You may decline and keep using non-AI features, or the typed tutor if you allow text sharing. You can withdraw text and voice permission at any time in Profile → Settings. Avatar photos are confirmed for each generation.

Two limits apply to all of it:

• No voiceprints. We do not create voiceprints, and we never use your voice to identify or authenticate you. Speech is transcribed and scored for pronunciation; it is not used for recognition.
• No training. We do not train models on learner content, and Anthropic and OpenAI do not train on data sent through their commercial APIs (see Section 3).

We will ask again if the set of providers, what is sent, or how it is used materially changes — permission granted for one arrangement is not permission for a different one.

5. Data Retention

We retain data only as long as necessary to provide the Service. Retention periods vary by data type:

Upon contract termination or at the institution's request, all PII is anonymized or permanently deleted within 30 days. Anonymized, aggregate data may be retained for service improvement purposes.

6. Your Rights

For All Users

• Access. You may request a copy of the personal information we hold about you.
• Correction. You may request correction of inaccurate personal information.
• Deletion. You can delete your account and its data yourself in the app: Profile → Settings → Delete account. You may also request deletion by email, subject to any legal obligations requiring retention. Deleting your account does not cancel a subscription; cancel it where you bought it (Apple, Google Play, or your Fluenci web subscription settings).
• Data export. You may request an export of your data in a machine-readable format.
• Withdraw AI permissions. You may withdraw permission for microphone and photo processing at any time in Profile → Settings, without contacting us and without losing access to the rest of the Service.
• Stop launch emails. You may unsubscribe using the link in a launch email or contact us at privacy@fluenciapp.com.

For Educational Institutions

School administrators have additional controls:

• Organization-wide data export at any time via the Fluenci administrative dashboard.
• Full data deletion for any student, teacher, or the entire organization upon request.
• Audit logs for all administrative actions within the organization.
• User management, including the ability to add or remove students and teachers, configure classroom settings, and deactivate the organization.

Individual student deletion requests from institutions are fulfilled upon request from the institution's authorized representative.

How to Exercise Your Rights

To delete your account, use Profile → Settings → Delete account in the app. For any other request, contact us at privacy@fluenciapp.com. For institutional requests, we respond within 48 hours.

7. Children's Privacy and COPPA

Fluenci may be used by students under the age of 13 when deployed by an educational institution. In these cases:

• The institution provides consent. Under COPPA, when an educational institution contracts with Fluenci for use in a school setting, the institution may consent to the collection of student information on behalf of parents or guardians, consistent with the educational purpose.
• Content safety. All AI-generated content is processed through a content safety validation pipeline before being displayed to any user under 18.
• No direct marketing. We do not engage in any direct marketing to students under 18.
• Voice handling. Raw microphone audio is processed transiently and is not stored by Fluenci after the request or live session ends, for all users including minors. Derived material — a transcript, a pronunciation score, or a tutoring note — is retained with the account on the same schedule as other learning data.
• Parental access. Parents or guardians who wish to review their child's data, request corrections, or request deletion should contact their child's school. The school, as the contracting institution, manages these requests and may direct them to us.

We do not knowingly collect personal information from children under 13 outside of a school-contracted context. If you believe a child under 13 has provided us with personal information without appropriate consent, please contact us immediately at privacy@fluenciapp.com and we will promptly delete the information.

8. FERPA Compliance

When Fluenci is deployed by an educational institution, we operate as a "school official" under the FERPA school official exception (34 CFR Section 99.31(a)(1)(i)(B)). This means:

1. We perform a service that the institution would otherwise use its own employees to provide — specifically, personalized language instruction, practice, and assessment.
2. We are under the direct control of the institution with respect to use and maintenance of education records. Institutions control which students and teachers have access, what data is collected through assignments, and can export or delete all data at any time.
3. We use education records only for the purposes for which disclosure was authorized — delivering language instruction and enabling institutional oversight. We do not repurpose education records for any other use.

Access Controls Under FERPA

To protect the confidentiality of education records:

• Students can access only their own data.
• Teachers can access data only for students enrolled in their classrooms.
• School administrators can access data only within their own organization.
• Fluenci personnel access production data only when necessary for technical support or debugging, and all such access is subject to audit logging. No Fluenci employee may access student data without a documented reason.

Institutional Rights Under FERPA

Institutions retain full control over education records held by Fluenci, including the right to:

• Inspect and review all education records we maintain on their behalf.
• Request amendment of records they believe to be inaccurate.
• Export all organizational data at any time.
• Request complete deletion of all data upon contract termination.
• Receive confirmation of deletion upon completion.

9. Security Measures

We implement the following technical and organizational safeguards to protect your information:

Encryption

• At rest: All data stored in our database and file storage is encrypted using AES-256 encryption.
• In transit: All data transmitted between your device, our servers, and our subprocessors is encrypted using TLS 1.2 or higher. HSTS (HTTP Strict Transport Security) is enabled on all endpoints.

Infrastructure

• Our database, authentication, file storage, and server-side compute are hosted on Supabase, which runs on AWS infrastructure in the us-east-1 region.
• Backups are encrypted at rest using the same encryption standards as primary data.

Authentication and Authorization

• User authentication is handled via JWT-based sessions with role-based access control.
• Row-level security policies enforce data isolation between users, classrooms, and organizations at the database level.

Operational Security

• All access to production systems and student data by Fluenci personnel is logged and auditable.
• We follow the principle of least privilege for all internal access.

10. Breach Notification

In the event of a confirmed data breach affecting education records or personal information:

• Timing: We will notify affected institutions within 72 hours of confirming the breach.
• Method: Direct email to the institutional IT or privacy contact on file, supplemented by a phone call for high-severity incidents.
• Content: Our notification will include the nature of the breach, the categories of data affected, remediation steps we are taking, and recommended actions for the institution.
• Follow-up: A full written incident report will be provided within 14 days of the initial notification.

11. International Users

Fluenci's infrastructure is hosted in the United States (AWS us-east-1). If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions, by using the Service you acknowledge that your data will be transferred to the United States. We apply the same privacy protections described in this policy to all users regardless of location.

If you are an institution subject to GDPR or other international privacy regulations, please contact us at privacy@fluenciapp.com to discuss applicable data transfer mechanisms and any supplementary agreements that may be needed.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our subprocessors, or applicable law. When we make changes:

• We will update the "Effective Date" at the top of this policy.
• For material changes affecting how we handle education records or student data, we will notify affected institutions by email at least 30 days before the changes take effect.
• The current version of this policy will always be available within the Fluenci application and on our website.

Continued use of the Service after the effective date of a revised policy constitutes acceptance of the updated terms.

13. Contact Us

If you have questions about this Privacy Policy, your data, or our privacy practices, please contact us:

• Privacy inquiries: privacy@fluenciapp.com
• Data deletion: in the app at Profile → Settings → Delete account, or by email to privacy@fluenciapp.com
• Data processing agreement (DPA) requests: legal@fluenciapp.com
• Response time: 48 hours for institutional requests

NovaWealth
Operator of Fluenci
privacy@fluenciapp.com

This Privacy Policy is effective as of September 23, 2026.