Privacy Policy

Before the legal text: plain answers for parents

What does SpeechStep record? Your child’s voice while they say a practice word, once you have an account. The short first check before an account is a questionnaire; it records nothing. Your child’s recording is discarded after scoring unless you choose to save recordings; the practice result itself (clear, keep practising, not sure) is kept in your account.

What happens to the recording? It is analysed straight away to give feedback and then discarded. That is all that happens unless you choose otherwise. You can make up to four separate choices, all off until you turn them on: Save recordings (kept 90 days, so your child can listen back, track practice or share with their SLP) · Share with my SLP (made separately for each SLP) · Help improve SpeechStep (lets us use saved recordings to improve and test our speech feedback; needs Save recordings) · Allow SpeechStep team review (lets authorised team members listen to saved recordings to evaluate and improve feedback; needs Help improve).

Do you use my child’s recordings to train your AI? Only if you turn on “Help improve SpeechStep”. SpeechStep works completely without it. We never sell recordings, never use them for ads, and never give or license them to other companies.

Will a person listen to my child’s recordings? You, if you save them. Your child’s SLP, only if you connect them and share recordings. Authorised SpeechStep team members, only if you turn on team review, and every access is logged. Nobody else.

How do I know a setting changed? When you turn an optional choice on, including when you first set up your account, we email you a record of what you chose. There is nothing to click: the choice is already on. Everything you change, on or off, is also listed in Account & family.

What if I change my mind? Turn any choice off in Account & family → Sharing & consent. Turning one off also turns off the choices that depend on it. What happens to recordings already used for improvement is in §7.5, including one limit we will not pretend does not exist.

Do you sell data or show ads? No. There is no advertising in SpeechStep and no advertising trackers. One analytics service, PostHog, runs only if you accept optional cookies, and it never receives anything about your child (§4).

What can the AI tell me? Instant feedback on the sounds where our scoring has been checked for your child’s age and accent. For every other sound it helps your child listen and compare, or tells you only that it heard nothing to flag today. It is not a diagnosis.

How do I delete everything? Account & family → Delete account, in the app or on the web, or email support@speechstep.com. We delete within 30 days and confirm by email.

1. Who we are

SpeechStep (“SpeechStep”, “we”, “us”) is operated by Mendios Technologies Bangalore Pvt Ltd (the company behind WebMobi), 139 HAL Old Airport Road, Unit 101, Bengaluru, Karnataka 560008, India, CIN U74900KA2010PTC055525. This policy covers speechstep.com, the SpeechStep apps, and SpeechStep Pro, which speech-language professionals use. Our privacy contact, and our grievance officer for India, is reachable at support@speechstep.com.

2. Who uses SpeechStep

• Parents and guardians hold the account when a child or teen practises. You must be 18 or older and the child’s parent or legal guardian, and you confirm this when you set up your account (§6.1).
• Adults (18 and over) may use SpeechStep for their own speech, including the lisp check. You hold your own account and confirm that you are 18 or older. While you practise on your own, your recordings are used only to give you feedback during practice and are then discarded (§7); the optional choices (Save recordings, Help improve SpeechStep, team review) are not yet offered to adults practising on their own.
• Children and teenagers aged 4–17 practise through their parent’s account. The parent or guardian owns the account, every consent choice, the subscription and any SLP connection, at every age up to 17, in every country. Teens (13–17) own the day-to-day: practice, progress, their goals and their SLP plan.
• Speech-language professionals (“SLPs”) who connect with families use SpeechStep Pro under the separate Professional Terms. Referral partners also accept the Partner Terms. §10 covers the data about SLPs and partners.

3. What we collect

• Parent account: email; an optional phone number (the parent’s own, never a child’s); the country you signed up from. For the account, security, support and your country’s privacy settings.
• Guardian confirmation: that you confirmed you are the parent or guardian, how your account was verified, and when. To prove consent came from a verified adult.
• Child profile: a display name (optional; default “My child”), age in months (never a full date of birth), pronunciation profile (accent), and goals (teens: their chosen goal). For age-appropriate practice and feedback.
• Practice recordings: the child’s voice saying practice words. For instant feedback, then discarded; kept only with Save recordings.
• The first check (no account): your child’s age in months and your answers to four questions, held on your device until you create an account. No recording (§7.7).
• Assessment of recordings: the AI’s result per word (clear, keep practising, not sure, or heard as another sound), its confidence and the model version. For feedback and progress.
• Reviews: an SLP’s judgement of a recording and their notes; with team review on, our team’s judgement.
• Practice history: sounds, words, sessions, streaks, progress, practice plans and speech snapshots.
• Speech Snapshots and SLP messages: summaries and structured notes between a family and their SLP.
• Consent records: each choice, when, on which device and screen, and which versions of this policy and the consent screen you saw (§6.3).
• Purchases: plan, status and renewal dates. Card details are handled by the payment provider, never by us.
• Referral attribution: which SLP invitation, partner link or code a family arrived through (§10).
• Product events: the in-product events in §4, linked to the account.
• Page counts: page path, campaign details, two-letter country and time; no cookie, no visitor, device, advertising or account identifier (§4).
• Hosting logs: our hosting provider’s ordinary request logs record the IP address and the page or route requested, for security and to debug failures, for a short time. They are not joined to accounts or children.
• Device diagnostics (app): a random install id for crash and reliability diagnostics only; not an advertising id.
• Free tools without an account: if you ask a free tool to email you its result, the email address, your child’s age in months and that result, kept 12 months (§11) and deletable at speechstep.com/erase.

What we do not collect: a child’s full date of birth, address, phone number or precise location; contacts, photos or the list of apps on your device; advertising identifiers.

4. Usage and technical data (how we count visits)

We count how our pages are used, so we can tell which guides and pages actually help families and where people get stuck. We do this ourselves — it is our own code on our own servers, not an analytics company’s — and we do it without cookies and without identifying you. (If you accept optional cookies, one analytics service also runs; it is described separately below.)

What a page view records

• The page address — the path only, such as /pricing. Everything after a ? or # is discarded before the record is written, so a link that happened to carry an email address or a one-time code cannot end up in our logs.
• How you arrived — recorded once, on the first page of a visit: the campaign details in the link you clicked (source, medium, campaign, and our own from parameter) and the referring website’s address only, for example google.com — never the full page, and never the search you typed.
• A two-letter country code such as IN or GB, supplied by the hosting network that serves the page. Country only — no city, no region, no precise location.
• The date and time, that it was a web page view, and whether it was the first page you opened on that visit.

What a page view does not record

• No cookie. None is set and none is read for this, and nothing at all is written to your device — no local storage, no session storage, nothing.
• No identifier. No visitor id, no device or install id, no advertising id, no fingerprint. There is no key in these records that joins one page view to another, and nothing that joins today’s visit to your next one.
• The mobile app works differently — and we would rather say so. Everything in this section describes our website. The SpeechStep app does use a random “install id” for its own diagnostics, so that a crash or a stuck step can be followed through a single install. It is generated on the device, is not your name, email, account or advertising id, is not shared with anyone, and is gone when the app is uninstalled.
• No IP address stored. Your address is used for a moment, in memory, to stop one machine flooding the endpoint — it is never written into the record. The two-letter country above is not something we work out from it either: it arrives as a header our hosting network adds to the request, which that network derives before the request reaches us. (It necessarily handles your IP address to deliver the page at all — see §9.)
• No cross-site tracking. Nothing here can follow you to another website, no ad network is involved, no profile is built, and these records are never sold or shared.
• Nothing about your child. No recording, no score, no sound or word practiced, no name, no age, and no child or account identifier ever travels with a page view — including on the pages your child practices on, where the record is the page address and nothing more.
• Not linked to your account. A page view carries no user id; we deliberately do not look up who is signed in in order to count one.

Sign-up and in-product events

Separately from page counts, we record what happens inside the product, so we can see where families get stuck and whether the things we build actually work. These records are linked to your account from the moment you are signed in. We describe them by category rather than as a list of names, because a list goes out of date the day someone adds a feature — and a policy that is quietly out of date is worse than one that is general on purpose:

• Getting in. Reaching the sign-up screen (which page you started from and where you were heading), requesting a sign-in code and whether sending it succeeded, and verifying it — how many attempts it took, never the code itself and never your email address or phone number.
• Practice, including per-attempt scoring detail. When a session starts and finishes, and — for each recorded attempt saved to your account — the sound practised, the clarity score, the version of the model that produced it and a measure of the recording quality. This is the category the earlier version of this page did not mention, and it is the most detailed thing we keep about your child’s practice. It is not sent for practice you do without recording consent, because there is no saved attempt to describe.
• Account and consent changes. Adding a child, setting a pronunciation profile, changing a consent, accepting our terms, leaving a callback number, deleting recordings, and deleting an account.
• Money and bookings. Seeing the upgrade screen, choosing a plan, starting or completing a checkout, a payment provider’s callback, and requesting or scheduling a Welcome Session.
• Things that went wrong. Errors and refusals — a score we declined to produce and why, a failed email, a failed upload — so that a broken step is visible to us rather than only to you.

Each carries the same two-letter country and time as above. We deliberately keep names, email addresses, phone numbers and the text of anything you type OUT of these records; where one refers to a child it does so by the same random identifier used everywhere else. If you accepted the optional cookie, the “how you found us” details travel with them (§16). You can see every one of these records for your own account in your data export, and they are deleted when you delete your account (§11).

Your choices here

Because these page-view records contain no cookie and no identifier, there is nothing on your device to switch off, and nothing in them we could single out as yours to show, correct or delete — which is precisely why we keep them that way. Declining optional cookies does not stop this counting, and accepting them adds nothing to it (accepting does switch on the separate analytics described next). If you would rather not be counted at all, the counting is ordinary page script, so browser settings or extensions that block scripts will prevent it, and we make no attempt to work around them. The in-product events recorded once you are signed in are account data, and are deleted when you delete your account (§11).

Since October 2026 the product events also include: SLP connections (connect, disconnect, invitation accepted); reviews and Speech Snapshots (published, viewed); and consent changes (each grant and withdrawal, which is also written to the consent ledger in §6.3).

Optional product analytics (PostHog) — only if you accept cookies

If you choose Accept in the cookie banner, our website also uses PostHog, a product-analytics service, so we can see how the site is used — which pages, tools and account steps families move between, and where they stop. If you have not answered the banner, or you choose Decline, PostHog is not loaded at all.

• What it stores on your device. A cookie and a local-storage entry holding a random visitor ID, so that page views from the same browser can be counted together. The ID is random — not your name, email address or advertising ID. Once you sign in, PostHog is told your account’s ID instead (next point).
• What it receives. The name of each step (for example a page view, starting a tool, starting a practice session, or opening checkout); the page address with everything after a ? removed and any private link codes or IDs replaced; which tool, screen or plan was involved; the referring website’s address only; the campaign labels in the link you clicked; your browser and device type and screen size; and the time. When you are signed in, also your account’s random ID, so the steps of your visits can be seen together, and the account steps themselves — signing up and signing in, accepting our terms, adding a child, changing a consent choice, requesting a Welcome Session, and starting or managing a subscription: the step only, never what you typed. Earlier visits on the same browser are joined to that ID.
• What it never receives. Your name, email address or phone number — PostHog knows you only by that random account ID. And nothing about your child: no name, no age, no sound practised, no score or result, no recording. Session recording, heatmaps and click capture are switched off.
• Your IP address. Your browser sends it with each request, as it does to any website; PostHog is set to discard it rather than store it.
• Where, and for how long. PostHog stores these records in the United States, for up to one year. We use them only to improve SpeechStep — never for advertising — and they are never sold.
• Changing your mind. Choosing Decline in Cookie settings stops PostHog straight away, clears its visitor ID from your browser, and stops your account steps being sent to it. When you delete your account, we also ask PostHog to delete everything it holds under your account ID. Visits that were never linked to an account cannot be picked out, so we cannot show or delete those individually.

5. Why we use information

• To provide practice and instant feedback (recording analysed, then discarded). Core service. UK/EU basis: performance of our contract with you, with your parental consent for your child’s data. Elsewhere: verifiable parental consent.
• The first check (§7.7): a questionnaire before an account; the listening part only after you have an account, under the same consent as practice.
• Save recordings; Share with my SLP; Help improve SpeechStep; SpeechStep team review: each optional, off by default, each on your separate consent.
• Research outside SpeechStep and third-party research: not offered. It would need a separate opt-in per project.
• Account, security, subscriptions, support and fraud prevention: core service (contract; our legitimate interests).
• Consent records and record emails: required to prove and notify consent (legal obligation; legitimate interests).
• The SLP partner programme: attribution and commission accounting (§10) (contract; legitimate interests).
• Legal obligations: tax, accounting and lawful requests.

We do not: use your or your child’s information for advertising; build advertising profiles; sell it or “share” it for cross-context behavioural advertising; or turn on any optional use of recordings by default, in any country.

6. Your choices, and how we record them

6.1 Verifying that you are the parent or guardian

Three things are different, and we keep them apart:

• Email verified: you sign in with a one-time code sent to your email, which proves you control that address.
• Parent attested: you confirm “I’m the parent or legal guardian of this child, and 18 or older”. We rely on that statement; we do not check identity documents. An adult practising for themselves confirms instead that they are 18 or older.
• Stronger verification: some countries’ laws can require a stronger method before certain uses of a child’s data. We do not offer one today. Where such a method is required for a choice, we add it before offering that choice there.

The first two happen once, at sign-up, in every country. Every choice you then turn on, including at sign-up, sends you an email record (nothing to click; the choice is already on). Changing a choice later never asks you to verify again. Signed in with Google or Apple? Practice works straight away; to turn on any optional choice, sign in once with the code we email you.

6.2 The choices

You choose before your child’s first saved recording, and anytime in Account & family → Sharing & consent. Core practice (required): your child’s recording is processed to give feedback and is not kept. The four optional choices, all off until you turn them on, shown separately and never combined:

• Save recordings — Save recordings so your child can listen back, track practice, or share them with their SLP.
• Share with my SLP (per SLP) — the SLP sees practice history and, if you allow it, recordings (recordings need Save recordings).
• Help improve SpeechStep — Allow SpeechStep to use saved recordings to improve and test our speech-feedback systems. Automated use only; no person listens. Needs Save recordings.
• Allow SpeechStep team review — Allow authorised SpeechStep team members to listen to saved recordings when needed to evaluate and improve speech feedback. Needs Help improve.

A choice that needs another is shown greyed out with the reason. Turning one off turns off everything that depends on it: Save recordings off turns off Help improve and team review and ends your SLP’s access to recordings (not to practice history); Help improve off turns off team review. Turning a choice off sends no email; the change is recorded and shown in Account & family. Declining any choice never limits practice or feedback.

6.3 Consent records

Every choice is kept as a permanent, append-only record: which choice, for which child, granted or withdrawn (and whether it was withdrawn because another choice was turned off), when, on which platform and screen, how your account was verified, your country setting, and which versions of this policy and the consent screen you saw. We never edit or delete a record except when your whole account is deleted; a change adds a new record.

6.4 Your country

The choices on offer depend on the country you signed up from, and we apply the most protective settings: every optional choice is off by default in every country, and team review is always separate from improvement. India: core practice (recording → instant feedback → recording discarded) is available to every family; the optional choices are available too, each a separate explicit opt-in, but only a parent verified by the email sign-in code and attested as the parent can turn them on; there is no default-on improvement and no teen self-consent. If we cannot tell your country, we treat it the same way: core practice only, no optional processing. In every country, no child audio is processed before a signed-in parent account (§7.7).

7. Voice recordings, AI feedback and improvement

7.1 Instant feedback (core)

Each practice recording is sent securely to our scoring service, which runs on Hugging Face in the United States. It is analysed in memory and discarded unless Save recordings is on. Discarding the audio does not discard the result: the practice result (clear, keep practising, not sure), its confidence and the model version are kept in your account as practice history. Our service writes nothing to disk and logs no request bodies, so the runtime logs Hugging Face keeps for a Space (for 30 days) contain no audio. Hugging Face’s published terms do not state whether its platform keeps request payloads of its own; we say so here rather than round it up, and we will update this line once Hugging Face confirms in writing.

What you are told about the AI. Instant feedback (✓ clear / ○ keep practising) is shown only for sounds where our scoring has been checked for your child’s age group and accent. For other sounds the app helps your child listen back and compare with an example, and may say only that it heard nothing to flag today and will keep listening. If the AI cannot reliably judge a recording it says so and asks for another try; it never guesses. Your SLP’s judgement comes first: if your connected SLP reviews a recording you see their result, labelled “Reviewed by your SLP”, and we keep the AI’s original result unchanged for quality purposes. AI feedback is guidance for practice. It is not a diagnosis, has no legal or similarly significant effect on you or your child, and does not decide access to any service.

7.2 Saved recordings

Kept in a private storage bucket under a random child identifier, never your child’s name. Accessible to you; to an SLP you have connected and allowed to hear recordings; and to authorised SpeechStep team members only if team review is on. Deleted 90 days after recording (§11).

7.3 Help improve SpeechStep (optional)

Off unless you turn it on; SpeechStep works completely without it. It allows automated use of your child’s saved recordings to train, test and calibrate SpeechStep’s own speech-feedback models. A recording is used only if Save recordings and Help improve are both on when we build a training or test set, and every set records exactly which recordings it contains, so a withdrawal can be acted on. We keep no separate long-term copy: improvement uses saved recordings inside their 90-day window. Recordings used for improvement are identified by random ids, age band, accent, target sound and word, never by name or email. We never claim to own your child’s voice, sell recordings, use them for advertising, or give or license them to any other company. A recording is an example, not a verdict: only human or SLP reviews are assessments.

7.4 SpeechStep team review (optional)

Off unless you turn it on, and only available when Help improve is on, because letting a person listen is different from automated use. Authorised SpeechStep team members (in India) and contracted reviewers under written confidentiality listen one recording at a time, with no names shown, and every access is logged; the countries of contracted reviewers are available on request. Turning team review off (or turning off Help improve or Save recordings) removes your child’s recordings from the review queue, and no one can play them for review.

7.5 Withdrawing, and what we cannot undo

Turning Help improve off leaves your child’s recordings out of every future training or test set, and any working copy made for improvement is deleted within 30 days. Models already trained are not un-trained. If a recording was already used to train a model, or to build aggregate statistics, deleting it or withdrawing permission does not necessarily remove what that model or aggregate learned, and we do not retrain models to remove a single recording. We will not claim otherwise. Deleting your account deletes saved recordings, working copies and the link between your child and their random ids within 30 days.

7.6 When you turn “Save recordings” off

Saved recordings are deleted within 30 days, including from backups as they expire on their normal cycle, and we email you when it is done. Help improve and team review turn off too. Your SLP can no longer hear recordings; practice-history sharing is unaffected. Practice and instant feedback keep working.

7.7 The first check, before you have an account

When you start, before you have an account, SpeechStep asks your child’s age and four questions and builds a first plan from your answers. It records nothing. The listening part, in which your child says a few words and a sentence so the sounds can be checked, comes after you have created your account and attested that you are the parent or guardian, in every country. Our servers refuse any child audio sent without a signed-in parent account, and the app does not ask for the microphone before then. The same applies to the optional AI check on our free lisp tool.

• Your child’s age in months and your four answers are held on your device until you create an account and choose to attach them. They travel without any identifier.
• Once you have an account, recordings for the check are handled exactly like practice recordings (§7.1): analysed in memory, discarded unless Save recordings is on, never used to improve our models unless Help improve is on.

8. SLPs you connect

You connect by accepting your SLP’s invitation or by inviting your SLP yourself, and for each SLP you choose what they can see: practice history (days, words, results) and/or recordings (needs Save recordings). The SLP can set your child’s practice plan, review recordings, write Speech Snapshots and reply to your messages. Disconnecting in Sharing & consent ends their access immediately; their past reviews stay in your child’s history. The SLP is an independent professional, not SpeechStep, with their own professional and legal duties for what you share.

Referral disclosure. Before you subscribe, the invitation tells you: Your SLP invited you to SpeechStep and may receive a referral payment if you subscribe through their invitation. This does not affect their professional independence or your care choices. Your connected SLP (the clinical relationship) and a referral partner (the commercial relationship) are kept separate in the product, in our data and in what we tell you. Partners never see payment details, and never see names or children next to money.

9. Who we share information with: our providers

We do not sell or rent personal information. Providers process data only to provide their service to us, under their data-processing terms.

• Supabase — database, authentication, file storage (including saved recordings), consent records and the service log. Account, profiles, practice, saved recordings. Hosted on Amazon Web Services in Sydney, Australia (ap-southeast-2).
• Hugging Face — hosts our speech-scoring model. Practice and first-check recordings, in memory, for scoring. United States.
• Vercel — website and API hosting. Requests and IP address, to serve pages. Global edge, US.
• Amazon Web Services (SES) — email delivery, from updates.speechstep.com. Email address and message. US (us-east-1).
• Resend — backup email delivery, used automatically if the primary fails. US.
• PostHog — product analytics, only if you accept optional cookies (§4). A random visitor ID — your account’s ID once you sign in — and the steps described there, with private link details removed; never your name, email or anything about your child. United States.
• Amazon Web Services (S3) — machine-learning storage and training. Only saved recordings with Help improve on, pseudonymised (§7.3), deleted after 90 days. US (us-east-1).
• RevenueCat — in-app subscription management. Account identifier and store subscription events. US.
• Razorpay — payment gateway for purchases in India (INR). Payment and billing details; we never see card numbers. India.
• Kotak Mahindra Bank and RazorpayX — pay SLP referral partners by bank transfer or UPI. Partner payout details only, never families’ data. India.
• cal.com — the Welcome Session booking calendar, only if you open it. Name, email and notes. EU/US.

Sellers in their own right (not our providers): Dodo Payments is the merchant of record for web purchases outside India; it sells to you directly and handles payment and tax under its own privacy policy. Apple and Google do the same for in-app purchases. We receive only a purchase record from each. Not used today: error-reporting services (for example Sentry) are not switched on; if we add one it will be listed here first. Contracted reviewers (§7.4) are bound by the same confidentiality terms. We may disclose information if the law requires it, or to protect the safety of a child or others.

10. Information about SLPs and partners

From SLPs we collect name, profession, region and optional licence details; professional-terms and partner-terms acceptance records; partner link and code activity; and commission and payout records. Bank and tax details for payouts are collected through a secure form outside SpeechStep, or entered by the partner on RazorpayX’s page, never through SpeechStep Pro screens. Commission records never show a child’s or family’s name, and clinical screens never show money.

The referral programme. Partners are speech-language professionals and clinics with a SpeechStep Pro account. About a partner we hold identity and contact details (name, email, profession, country, and a professional registration number where the verified tier applies), the Partner Terms acceptance, link and code activity counted without advertising cookies, the commission ledger per family payment (a reference number, plan, amount, currency, status and dates, with an append-only history), and payout and tax details collected as above. About a family who came through a partner we record which invitation, link, code or QR they came through, when they accepted, and the commission on each payment; the family is told before subscribing. A partner sees reference numbers, each family’s stage (invited, opened, account, trial, subscribed, practising) and their own commission and payouts, never a family’s name next to money, payment details or a child’s recordings. Reminder emails to families who came through a partner are sent once each, by SpeechStep, never by the partner. Other partnerships (content licensing, brands, community programmes, schools) run under written agreements and share no family’s information without that family’s choice.

11. How long we keep information

• Recordings for instant feedback and the first check: the time it takes to score; then discarded.
• Saved recordings: 90 days from recording, or until Save recordings is turned off (deleted within 30 days) or the account is deleted.
• Working copies used for Help improve: no longer than the saved recording they came from, and deleted when Help improve or Save recordings is turned off.
• Trained models and aggregate statistics: while in service; not reversible per recording (§7.5).
• Practice history, reviews, Speech Snapshots: while the account is active; deleted with the account.
• Consent records: for the life of the account; deleted with the account.
• Purchases, invoices, commissions: as long as tax and accounting law requires (in India, eight years).
• Referral attribution: 2 years from the family’s first payment, then only inside the commission records.
• Partner link visits and sign-up counts: 13 months.
• Account data: until you delete the account; deleted within 30 days, confirmed by email.
• Free-tool results and email (no account): 12 months, or sooner if you delete them at speechstep.com/erase.
• Anonymous page counts: 13 months.

12. Your rights

Depending on where you live, and on your child’s behalf, you can access your data, correct it, delete it, export it, restrict or object to processing, withdraw consent at any time as easily as you gave it, nominate someone to exercise these rights (India), and complain to a regulator. Where to do it: Account & family for consent, recordings, SLP connections and account deletion; speechstep.com/erase for data held without an account; or support@speechstep.com. We respond to verified requests within 30 days, or sooner where the law requires, and confirm deletions by email.

• United States: parents’ rights under COPPA to review, delete and refuse further collection of a child’s information, plus state privacy laws such as the CCPA/CPRA.
• United Kingdom: the UK GDPR and the Age-Appropriate Design Code; complaints to the ICO.
• European Union: the GDPR; complaints to your national supervisory authority.
• India: the Digital Personal Data Protection Act 2023 and its Rules, including the grievance officer at support@speechstep.com and the Data Protection Board of India.
• Australia: the Privacy Act 1988 and the Australian Privacy Principles; complaints to the OAIC.

13. Children’s privacy

Our Children’s Privacy page says the same things in one place and gets the same updates: a verified parent or guardian holds the account and makes every choice, up to age 17; instant feedback without keeping the recording; no child audio before a signed-in parent account; four separate optional choices, all off by default, with human listening never bundled with improvement; verification once and an email record whenever you turn a choice on; no ads and no child contact details; the teen/parent split in §2. We display no compliance badges: the site and app never claim to be “COPPA compliant” or “HIPAA compliant”.

14. International transfers

SpeechStep is operated from India. Our providers may process data in the United States, the EU/UK and India (§9). Where data leaves the UK or EU, our providers’ data-processing terms include the EU standard contractual clauses and the UK addendum. Transfers from India are made only to countries not restricted under the Digital Personal Data Protection Act.

15. Security

Encryption in transit and at rest; row-level access controls; private recordings storage; passwordless sign-in; an append-only consent ledger; logged reviewer access; least-privilege roles. If a breach affects your or your child’s data we notify the relevant authority and you as the law requires, and in any case without undue delay.

16. Cookies

We use cookies in two groups, and only the first is on by default. Another company sets cookies only where you open something of theirs — the booking calendar or the payment checkout. We do not use advertising cookies, and we do not use cookies to build a profile of you or your child.

This section covers cookies only. Our page counting (§4) uses none — it stores nothing on your device — so your answer to the banner neither switches it on nor switches it off. We say so here because a banner that quietly implied otherwise would be asking for permission under false pretences.

Strictly necessary (always on)

Sign-in and session cookies set by Supabase, our authentication provider, which keep you logged in and your session secure, plus small cookies that remember which child profile is selected and what you chose in the cookie banner. These are required for the site to work, so they are not optional — but they are not used for tracking or advertising. The record of your banner choice lasts 180 days; after that we ask again.

Optional: how you found us (only with your consent)

If you choose “Accept” in the cookie banner, we set one first-party cookie called ss_attr. It records only how you arrived: the campaign details in the link you clicked (source, medium, campaign), the website that referred you — the site’s address only, never the full page or search you came from — and the first page of ours you landed on, plus the date and time, and a flag noting whether we recorded this on your first visit or had to record it again after an earlier cookie was cleared or expired. It contains no name, no email, no account or child identifier, and nothing about your child’s practice. It lasts 90 days and is never shared or sold. We use it to see which of our pages and guides actually help families find us.

Nothing is set until you accept. If you have not answered the banner yet, or you choose “Decline”, this cookie is not written — and if you had one from a previous visit, it is deleted. Declining does not affect signing in or using SpeechStep, and it does not change the anonymous page counting in §4, which has nothing on your device to switch off.

If you create an account while this cookie is present, we copy the same campaign details onto your sign-up record so we can see which page helped your family find us. That copy is account data: it is kept with your account (see §11) rather than for 90 days, and it is deleted when you delete your account. Clearing the cookie later does not remove the copy — ask us at support@speechstep.com if you want it deleted on its own.

Optional: product analytics (PostHog, only with your consent)

The same “Accept” also switches on PostHog (§4). It sets a first-party cookie and a local-storage entry named ph_…_posthog, holding a random visitor ID (your account’s ID once you sign in) and nothing else about you or your child. It lasts up to one year, and it is cleared when you choose Decline. Nothing is set until you accept.

Third-party embeds

Two places on the site can load something from another company, and neither loads until you ask for it:

• The booking calendar (cal.com). Our booking page shows a placeholder until you select “Show booking calendar”. Only then does cal.com load, and it sets its own cookies under cal.com (including a security/bot-protection cookie) under their privacy policy. If you never open it, nothing is requested from cal.com and no cal.com cookie is set. You can also open cal.com in a new tab from that page instead.
• Checkout (Dodo Payments, or Razorpay in India). If you choose a paid plan, the payment provider’s checkout opens — as a secure panel over our page, or as their own hosted page — and they set the cookies their payment and fraud checks need. This happens only after you click to subscribe, and never on an ordinary page view.

Apart from these, and PostHog if you accept optional cookies, no page on SpeechStep loads advertising or tracking code from another company.

What we count without a cookie

For completeness in one place: we also count page views ourselves, first-party and with no cookie, no identifier and nothing written to your device. It is not a cookie and so is not listed above, but you should not have to hunt for it — §4 describes exactly what it records and what it never touches.

Changing your mind

Select “Cookie settings” at the bottom of any page to re-open the banner and switch your answer at any time. Choosing Decline there removes the optional cookie immediately. You can also clear cookies in your browser settings. If we materially change what we use cookies for, we will ask you again.

17. Changes

We update this policy by changing its version and the “Last updated” date above, and we notify you of material changes by email or in the app. New optional purposes are never switched on by an update: we ask you again, as a new, separate choice.

18. Contact

Privacy, data requests and grievances: support@speechstep.com. General support: support@speechstep.com.

{
 "schema": "speechstep.privacy-summary/v2",
 "policyVersion": "privacy-2026-10-23",
 "verification": {
  "method": "email_plus",
  "account_level": true,
  "confirmation_email_on_every_change": true
 },
 "permissions": {
  "core_practice": "required",
  "recording": {
   "default": "off",
   "requires": []
  },
  "slp_sharing": {
   "default": "off",
   "per_slp": true,
   "audio_requires": [
    "recording"
   ]
  },
  "training_contribution": {
   "default": "off",
   "requires": [
    "recording"
   ]
  },
  "human_review": {
   "default": "off",
   "requires": [
    "training_contribution"
   ]
  }
 },
 "cascade_on_revoke": {
  "recording": [
   "training_contribution",
   "human_review",
   "slp_sharing.audio"
  ],
  "training_contribution": [
   "human_review"
  ]
 },
 "first_check": {
  "pre_account_audio": [],
  "audio_requires_parent_account": "everywhere",
  "retained": false,
  "used_for_improvement": false
 },
 "parent_verification": {
  "email_control": true,
  "parent_attestation": true,
  "identity_or_document_check": false
 },
 "jurisdictions": {
  "default_on_anywhere": false,
  "IN": "optional_only_for_email_verified_parent",
  "unknown": "core_only"
 },
 "retention": {
  "instant_feedback_audio": "discard_after_scoring",
  "first_check_audio": "discard_after_scoring",
  "saved_recordings_days": 90,
  "delete_after_storage_revoked_days": 30,
  "account_deletion_days": 30
 },
 "training": {
  "separate_long_lived_copy": false,
  "max_days": 90,
  "pseudonymised": true,
  "eligibility_checked_at_build": true,
  "manifests": true,
  "trained_models_unlearned": false
 },
 "licence": {
  "perpetual": false,
  "irrevocable": false,
  "sublicensable": false,
  "ownership_transfer": false
 },
 "teens": "parent_controls_until_18",
 "slp_referral_disclosed_before_subscribe": true,
 "outside_research": "not_offered",
 "sale": false,
 "advertising": false
}