Política de privacidad

This Privacy Policy explains how Verbalta, Inc. ("Verbalta," "we," "us") collects, uses, and shares personal information when you use verbalta.com and our English practice service delivered on WhatsApp (together, the "Service"), and the choices you have.

The short version. We collect your account details, your practice conversations (including voice messages), and billing information, and we use them to run your coaching and track your progress. We never use your voice, transcripts, or conversations to train AI models. We never share your voice recordings, transcripts, or conversation content with advertisers. We do use advertising and analytics tags on our website and share limited website and event data with advertising partners such as Meta and Google, and you can opt out of that. You can access, export, or delete your data at any time.

1. Who we are and how to reach us

Verbalta, Inc. (a Delaware corporation) 16690 Collins Avenue, Suite 1004 Sunny Isles Beach, FL 33160 United States

Privacy contact, and all privacy requests and choices: support@verbalta.com This Policy: https://www.verbalta.com/privacy/ Terms of Service: https://www.verbalta.com/terms/

Verbalta is the controller of your personal information (the "responsible party" under Mexican law, the "controlador" under Brazilian law).

Regional contacts. Wherever you live, you can reach us for any privacy question, request, or complaint at support@verbalta.com. That single address reaches:

• our privacy contact for the European Economic Area, the United Kingdom, and Switzerland
• our Encarregado (data protection officer) for Brazil, under LGPD Art. 41 — the designated encarregado is Verbalta, Inc., contactable at the address above
• our Departamento de Datos Personales (Personal Data Department) for Mexico
• our Privacy Officer for Canada, including for the purposes of Quebec's Law 25

2. Information we collect

You provide this directly

• Account information: name, email address, login credentials (managed by our authentication provider), your WhatsApp phone number, your self-reported English level, and your learning goals.
• Practice content: your voice messages, text messages, and anything else you send to the Verbalta coach on WhatsApp.
• Payment information: collected and processed by Stripe. We receive transaction records and card metadata (last four digits, expiration, billing country) but never your full card number. Stripe acts as merchant of record and processes your purchase under its own privacy policy as well.
• Communications with us: support emails and survey responses.
• Consent records: the fact, date, time, and version of each consent you give — including your voice-data consent — together with the identifier used to give it.

Generated by the Service

• Transcripts of your voice messages, produced by automated speech-to-text.
• Learning Profile: your baseline assessment, proficiency and fluency estimates, pronunciation feedback, a personal dictionary of your recurring errors used to schedule review, study plans, session history, and usage summaries. Parts of your Learning Profile are used internally to choose what to practice with you and are not displayed to you. You can request a copy at any time (see Section 12).

Collected automatically

• Usage data: session timing, message counts, feature use, exercise completion, and reminder interactions.
• Country and time zone, derived from your phone number's country code and your stated practice time.
• Website data: IP address, browser and device type, pages visited, referral source, and interactions on verbalta.com, collected via cookies, pixels, and similar technologies, including advertising and analytics tags (see Sections 9 and 16).

What we do not collect

We do not collect precise location, your contacts, or the content of your other WhatsApp conversations. We only receive messages you send to Verbalta's number.

3. A note about WhatsApp and encryption

WhatsApp personal chats are end-to-end encrypted, but messages you send to a business are handled differently: they are delivered to us through Meta's WhatsApp Cloud API, and we can read and store them. That is how the coaching works.

Your use of WhatsApp itself is governed by Meta's own terms and privacy policy, not ours.

4. Sensitive information: what to send and what not to send

Our coaching prompts are drawn from everyday life, and some practice situations may naturally lead you to talk about a doctor's appointment, a visa interview, a bank dispute, your family, or a difficult period in your life. If you choose to speak about those things, that content is stored with the rest of your practice history and is used only to coach you.

Please do not send us: government identification numbers, passport or visa numbers, financial account or card numbers, or login credentials for any other service. We do not need them, and the Service is not designed to hold them.

Where you do share information that qualifies as sensitive personal data, special category data, or datos personales sensibles under the law that applies to you, we process it only to deliver your coaching, on the basis of the consent you give at signup, and we never disclose it to advertising partners. You can delete it at any time.

The Service is not a health, therapy, crisis, or emergency service. If you are in crisis or need medical help, contact local emergency services or a qualified professional.

5. Voice data and biometric information

Your voice recordings, and speech characteristics derived from them, may be treated as biometric identifiers or biometric information under some laws, including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act, Washington's biometric statute, and Colorado's biometric provisions. We apply the protections below to all users everywhere, regardless of whether a given law requires it.

• Consent first. We will not collect, capture, store, or otherwise obtain your voice recordings until you have given informed written consent through our consent screen, which tells you what we collect, the specific purpose, and how long we keep it. Your electronic acceptance is your written release. If we receive audio from you before that consent exists, we discard it without transcribing or analysing it.
• Purpose. We collect and process voice data solely to transcribe your speech, generate coaching feedback, and assess your speaking progress. We do not use voice to identify or authenticate you, we do not match your voice across accounts, and we do not build voiceprints for recognition purposes.
• No sale, no profit, no advertising. We do not sell, lease, trade, or otherwise profit from your voice or biometric data, and we never share it with advertising partners.
• No AI training. We do not use your voice recordings, transcripts, or conversations to train, fine-tune, or improve AI models. We do not build our own models, and we contract only with AI providers whose terms prohibit training on our customers' data.
• Retention and destruction schedule. We delete voice recordings from our active systems within 30 days of transcription, retaining only the text transcript. Residual copies in encrypted backups are purged on a rolling 35-day cycle. If you request early deletion, we delete recordings from active systems within 7 days.
• Disclosure. We disclose voice data only to the service providers listed in Section 9, as needed to deliver the Service, under contracts restricting their use of it, or where required by law.
• Security. Voice data is encrypted in transit and at rest, and is protected using at least the standard of care we apply to passwords and other confidential information.

This section, together with Section 10, is our publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.

6. How we use artificial intelligence

Verbalta is an AI service. You are talking to an AI coach, not a human teacher. We tell you this in the Service itself, at the start of your first session, and the coach will tell you plainly if you ask.

• We use large language models, automated speech-to-text, and text-to-speech to run coaching conversations, generate corrections, and produce the coach's spoken audio.
• We use automated analysis of your speech to estimate your fluency, track recurring errors, and decide what to practice with you next. This is profiling, and it is how personalisation works. It has no legal effect on you and does not certify or grade you.
• We do not use your content to train AI models. See Section 5.
• We periodically review samples of AI output for quality and safety. Where such a review involves your content, it is performed by authorised staff under confidentiality obligations, and you may object (see Section 12).
• The AI can be wrong. Corrections, translations, pronunciation guidance, and factual statements may contain errors. Do not rely on the Service for high-stakes decisions.

If you are in the European Union: no decision producing legal effects or similarly significant effects for you is made about you by automated means. If you are in Quebec: where a decision about you were ever made exclusively by automated processing, we would tell you at the time, give you the information and principal factors behind it on request, and let you submit observations to a member of our staff.

7. How we use information

• Provide the Service: run coaching conversations, transcribe and analyse your speech, generate feedback, maintain your error dictionary and review schedule, and track progress against your baseline.
• Messaging: send session messages and, with your consent, practice reminders and study-plan messages. You can stop reminders at any time in your account settings or by replying STOP.
• Billing: process subscriptions, renewals, refunds, and pauses through Stripe.
• Advertising and growth: measure our advertising campaigns and reach people likely to be interested in Verbalta, using website and event data shared with advertising partners as described in Section 9. We never use your voice recordings, transcripts, conversation content, or Learning Profile for advertising.
• Improve the Service: analyse aggregate usage patterns, debug problems, and develop features. We use aggregated or de-identified data for this wherever feasible, and it never includes training AI models on your content.
• Safety and legal: prevent fraud and abuse, enforce our Terms, and comply with legal obligations.

Legal bases

Where the GDPR, the UK GDPR, or a similar law applies:

• Performance of our contract with you — delivering the coaching service, billing, and account administration.
• Your consent — voice data, any sensitive information you choose to share, reminder messages, and advertising and analytics cookies. You may withdraw consent at any time, without affecting processing already carried out.
• Our legitimate interests — security, fraud prevention, aggregate service analytics, and measuring our own advertising, balanced against your rights.
• Legal obligation — tax, accounting, and regulatory records.

Where Brazil's LGPD applies, our bases are execution of a contract with you (Art. 7, II and V), your consent (Art. 7, I, and Art. 11, I for sensitive data), our legitimate interests (Art. 7, IX), and compliance with legal obligations (Art. 7, II).

Where Mexico's Federal Law on the Protection of Personal Data Held by Private Parties applies, the primary purposes described above are necessary to the legal relationship between us; the secondary purposes (advertising measurement and analytics) require your consent and can be refused or withdrawn without affecting your Service.

8. Automated processing and your Learning Profile

Your Learning Profile is built automatically from your practice. It includes estimates of your fluency and proficiency and a record of your recurring errors. Some of it is deliberately not shown to you, because showing learners scores makes them practice less. That is a product choice, not a secrecy claim: you can request the whole of it at any time and we will provide it in a readable format.

We do not use the Learning Profile for advertising, we do not sell it, and we do not disclose it to any party other than the service providers in Section 9.

9. Who we share information with

Service providers (subprocessors)

These providers act on our instructions under written contracts that restrict their use of your data. Categories and current providers:

• Messaging delivery — Meta Platforms, via the WhatsApp Cloud API. This is how the Service reaches you and does not change.
• Payments — Stripe, as payment processor and merchant of record.
• Authentication and account management — our login and identity provider.
• AI coaching responses — our large language model provider, under API terms that prohibit training on your data.
• Speech-to-text — our voice transcription provider.
• Text-to-speech — our coach voice provider.
• Hosting, database, and content delivery — our cloud infrastructure providers.
• Product and website analytics — our analytics provider.
• Advertising measurement — our advertising partners, as described below.

We name categories rather than individual companies because the specific providers in each category change over time as we improve the Service. You can request the current named list of the providers we use at any time by emailing support@verbalta.com, and we will send it to you. If you are in Brazil, this is also how you exercise your right under LGPD Art. 18, V to be told the specific entities with which we have shared your data.

Whichever provider fills a role, the requirements do not change: each one processes your data only on our documented instructions, under a written contract, with confidentiality and security obligations, no right to use your data for its own purposes, and — for every provider that touches practice content — a contractual prohibition on training AI models on it.

Advertising partners

We use advertising and analytics tags on verbalta.com and share limited data with advertising partners to measure and improve our advertising: website activity and identifiers (cookie IDs, IP address, pages visited, signup events) and, for campaign matching, hashed contact identifiers such as your email address or phone number.

Under the California Consumer Privacy Act this may be considered "sharing" for cross-context behavioural advertising, and under several other US state laws it is "targeted advertising." You can opt out — see Section 11. We never provide these partners your voice recordings, transcripts, conversation content, Learning Profile, or any sensitive information you have shared in practice.

Other disclosures

• Legal and safety: when required by law or legal process, or to protect the rights, safety, or property of Verbalta, our users, or others.
• Business transfers: in a merger, acquisition, financing, or sale of assets, in which case this Policy continues to apply to your data and we will notify you of any change in ownership.

We do not sell personal information for money. We do not sell, lease, trade, or profit from voice or biometric data under any circumstances.

If you are in Brazil, you may request a list of the specific public and private entities with which we have shared your personal data, as provided by LGPD Art. 18, V.

10. Retention and deletion

• Voice recordings: deleted from active systems within 30 days of transcription; encrypted backups purged on a rolling 35-day cycle.
• Transcripts, Learning Profile, and assessments: kept while your account is active; deleted within 30 days after you delete your account.
• Account and profile data: kept while your account is active; deleted within 30 days after you delete your account.
• Consent records: kept for the life of the account and for 3 years afterwards, because we are required to be able to demonstrate that consent was given.
• Billing records: 7 years, as required by tax and accounting law.
• Support communications: 2 years.
• Server logs: 90 days.
• Advertising cookie data: per partner cookie lifetimes; see the cookie banner.

You can delete your account at any time from your account settings or by emailing support@verbalta.com. When you do, we delete or de-identify your personal information on the schedule above, except where retention is required by law, needed to resolve a dispute, or needed to enforce our agreements. Deletion from active systems is completed within 30 days; residual copies in encrypted backups are purged within a further 35 days and are not restored to active use in the meantime.

11. Your choices

• Opt out of advertising sharing / targeted advertising: use our cookie banner to reject advertising cookies and tags, or email support@verbalta.com and we will apply the opt-out to your account. We honour Global Privacy Control (GPC) browser signals as a valid opt-out. Opting out stops the sharing described in Section 9 for your browser and account. You may still see ads, just not ones informed by our data.
• Reminders: turn them off in your account settings, or reply STOP to any reminder. Replying HELP gets you help.
• Voice retention: request early deletion of your recordings at any time, from your account settings or by emailing support@verbalta.com.
• Withdraw consent: you can withdraw your voice-data consent at any time. Because voice is how the coaching works, withdrawing it ends the practice part of the Service; we will delete your recordings and cancel your subscription going forward.
• Cookies generally: cookie banner and browser settings (Section 16).
• Marketing email: unsubscribe link in every marketing email.

12. Your privacy rights

Wherever you live, you can ask us to: give you access to the personal information we hold about you, correct it, delete it, provide it in a portable format, restrict or object to certain processing, opt out of advertising sharing and targeted advertising, and withdraw any consent you have given.

How to exercise a right. Email support@verbalta.com from the address on your account, or use your account settings. We verify your identity, normally by confirming control of the phone number or email address on the account. We respond within the period the law requires — one month under the GDPR and UK GDPR (extendable by two months for complex requests), 45 days under the CCPA (extendable once), 15 days under Brazil's LGPD for confirmation and access, and 20 business days for ARCO requests under Mexican law. You may use an authorised agent where the law allows.

Appeals. If we deny a request, our decision will explain why and how to appeal. Reply to that decision and we will re-review it within 45 days and give you a written outcome, together with the contact details of the relevant regulator if we still decline. This appeal right applies to everyone, and is required in Colorado, Connecticut, Virginia, Texas, and several other states.

European Economic Area, United Kingdom, and Switzerland

You have the rights of access, rectification, erasure, restriction, portability, objection (including to processing based on our legitimate interests and to direct marketing), and the right not to be subject to solely automated decisions producing legal or similarly significant effects. You may withdraw consent at any time. You may lodge a complaint with your local data protection supervisory authority, or with the UK Information Commissioner's Office. Our EU and UK representatives are listed in Section 1.

Brazil

Under the LGPD you may request confirmation that processing exists, access to your data, correction of incomplete or outdated data, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed on the basis of consent, information about the public and private entities with which we have shared your data, information about the consequences of refusing consent, and review of decisions taken solely on the basis of automated processing. Contact our Encarregado at support@verbalta.com. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Mexico

You have ARCO rights: Acceso (access), Rectificación (correction), Cancelación (deletion), and Oposición (objection to processing). You may also limit the use or disclosure of your data and revoke your consent at any time. Send requests to support@verbalta.com, stating which right you are exercising, your name and contact details, proof of identity or of an agent's authority, a clear description of the data concerned, and any documents supporting the request. We respond within 20 business days and, if a request is granted, act on it within the following 15 business days. Our Personal Data Department is reachable at the same address. You may bring a complaint to the competent Mexican data protection authority.

Secondary purposes. Advertising measurement and website analytics are secondary purposes. You may refuse consent for them now, or withdraw it later, through our cookie banner or by emailing support@verbalta.com, and doing so will not affect your access to the Service.

Canada, including Quebec

Under PIPEDA you may access and correct your personal information and challenge our handling of it with our Privacy Officer, and you may complain to the Office of the Privacy Commissioner of Canada.

If you are in Quebec, Law 25 also gives you the right to data portability in a structured, commonly used technological format; the right to be informed of and object to technology that identifies, locates, or profiles you (profiling functions on our website are off by default and activate only with your consent); the right, where a decision is based exclusively on automated processing, to be told at the time, to receive the personal information used and the principal factors and parameters behind it, and to submit observations to a member of our staff who can review the decision; and the right to complain to the Commission d'accès à l'information. We will provide this Policy and our key notices in French on request, and our Quebec-facing notices are available in French.

We send commercial electronic messages only with your consent, identify ourselves in each one, and include a way to unsubscribe, as required by Canada's Anti-Spam Legislation.

California

You have the rights described above under the CCPA as amended by the CPRA, including the right to know, access, delete, and correct your personal information, and the right to opt out of "sharing" for cross-context behavioural advertising (Section 11). We do not sell personal information for money.

We collect the following statutory categories: identifiers; personal information under Cal. Civ. Code §1798.80; commercial information; internet and network activity; audio and electronic information; inferences; and sensitive personal information. Voice recordings are sensitive personal information. We use sensitive personal information only to perform the Service you asked for, to keep it secure, and for the purposes permitted by Cal. Civ. Code §1798.121(a); we do not use or disclose it to infer characteristics about you. We do not disclose sensitive personal information to advertising partners.

We will not discriminate against you for exercising your rights.

Other US states

Residents of Colorado, Connecticut, Virginia, Texas, Utah, Oregon, Montana, and other states with comprehensive privacy laws have similar rights, including access, correction, deletion, portability, and the right to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions producing legal or similarly significant effects. Use the same channels in Section 11 and this Section 12. We honour universal opt-out signals, including Global Privacy Control.

Illinois, Texas, Washington, and Colorado — biometric rights

See Section 5. In addition: we obtain your written consent before collecting voice data; we tell you the specific purpose and the length of time we keep it; we never sell, lease, trade, or profit from it; we do not disclose it without your consent except to the service providers in Section 9 or where the law requires; and we destroy it on the published schedule.

13. Age and who may use the Service

The Service is designed for adults.

• You must be 18 or older to create an account, enter into these terms, and pay for a subscription.
• A parent or legal guardian may open an account and allow a learner aged 13 to 17 to practice under their supervision. In that case the adult is the account holder, gives the voice-data consent on the minor's behalf, and is responsible for the account. We will not use that minor's data for advertising and will not share their identifiers with advertising partners.
• We do not knowingly collect personal information from anyone under 13, and we do not permit under-13s to use the Service. If you believe a child under 13 has given us information, email support@verbalta.com and we will delete it promptly.

In the European Economic Area, the minimum age for consent to information society services is between 13 and 16 depending on the country; our 18+ account rule sits above every national floor. In Brazil, processing of children's and adolescents' data is carried out in their best interest and with specific, highlighted consent from a parent or guardian, as LGPD Art. 14 requires.

14. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including encryption in transit and at rest, access controls, least-privilege access for staff, and a written information security programme. Voice data is protected using at least the standard of care we apply to passwords and other confidential information.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and the relevant regulators as required by law — within 72 hours to the supervisory authority under the GDPR where feasible, and promptly to the Commission d'accès à l'information and affected individuals in Quebec where the breach presents a risk of serious injury. We maintain an internal breach register.

15. International data transfers

We are based in the United States and process data on US-based infrastructure. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

• From the EEA, UK, and Switzerland: we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with a transfer impact assessment, and we flow equivalent terms down to our subprocessors.
• From Brazil: we rely on the international transfer mechanisms permitted by LGPD Art. 33 and ANPD Resolution CD/ANPD No. 19 of 23 August 2024, including the ANPD's standard contractual clauses.
• From Mexico and Canada: we transfer data to our service providers under contracts requiring them to protect it to the standard described in this Policy, and we remain accountable for it.

You may request a copy of the relevant safeguards by emailing support@verbalta.com.

16. Cookies, pixels, and website analytics

verbalta.com uses:

• Essential cookies — signup, login, and payment session management. Always on.
• Analytics cookies — to understand site traffic.
• Advertising pixels and tags — which collect the data described in Section 9 and involve "sharing" or "targeted advertising" you can opt out of.

Non-essential cookies and tags do not load until you accept them. Manage your preferences through our cookie banner and your browser settings, or email support@verbalta.com. We honour Global Privacy Control signals.

17. Changes to this Policy

We may update this Policy. For material changes, we will notify you by email and by WhatsApp at least 30 days before they take effect. The current version and its effective date will always be at https://www.verbalta.com/privacy/, and previous versions are archived and available on request from support@verbalta.com. Material changes to how we handle voice data will require your renewed consent.

18. Contact

Questions, requests, or complaints, from any country: support@verbalta.com Mail: Verbalta, Inc., 16690 Collins Avenue, Suite 1004, Sunny Isles Beach, FL 33160, United States