Privacy Policy

1. Introduction

Verbalyft (“we,” “us,” or “our”) provides an AI-powered speech therapy assistant designed for neurodivergent children (“the Service”). We are committed to protecting the privacy of all users, especially children under the age of 13. This Privacy Policy explains what information we collect, how we use it, and how we safeguard it in compliance with the Children's Online Privacy Protection Act (COPPA), the General Data Protection Regulation (GDPR), and other applicable privacy laws.

2. COPPA Compliance

Our Service is directed at children under 13 and we fully comply with COPPA. Key commitments:

• Verifiable Parental Consent: We require a parent or legal guardian to create the account and provide consent before any child data is collected. Children cannot create accounts independently.
• Minimal Collection: We collect only the information necessary to provide the speech therapy service. We do not collect more data than is reasonably needed.
• No Behavioral Advertising: We never use children's data for targeted advertising, behavioral profiling, or sale to third parties.
• Parental Control: Parents can review, modify, or delete their child's data at any time by contacting us or using the Parent Dashboard.
• Data Retention Limits: We retain child data only as long as the account is active. Upon account deletion, all associated child data is permanently removed within 30 days.

3. Information We Collect

3.1 Account Information (from Parents/Guardians)

• Parent email address and password (hashed)
• Child's first name and age group
• Avatar selection

3.2 Usage Data (Generated During Sessions)

• Speech Practice: Spoken text transcriptions processed in real-time for pronunciation evaluation. Audio is processed locally via the browser's Speech Recognition API and is not stored on our servers.
• Stories: AI-generated story content, reading progress, and vocabulary words learned.
• Chat Conversations: Messages exchanged with the AI assistant for conversational practice. These are stored to maintain session context and track communication development.
• Quiz & Memory Games: Answers, scores, and completion status to measure comprehension and cognitive progress.
• Progress Data: Daily streaks, missions completed, badges earned, and overall speech development metrics.

3.3 Information We Do NOT Collect

• Precise geolocation data
• Photos, videos, or audio recordings stored on our servers
• Contact lists, phone numbers, or social media identifiers
• Device identifiers used for cross-site tracking
• Biometric data

4. How We Use Information

We use collected information solely to:

• Provide personalized speech therapy activities tailored to the child's level
• Generate age-appropriate stories and exercises using AI
• Track and display learning progress to parents and therapists
• Evaluate speech pronunciation and provide real-time feedback
• Generate progress reports for parents and clinical professionals
• Improve the quality and safety of our Service

We do not use children's data to build advertising profiles, sell to data brokers, or for any purpose unrelated to the educational service.

5. AI-Generated Content

Verbalyft uses large language models (LLMs) to generate stories, quiz questions, and conversational responses. Important safeguards:

• All AI prompts are designed to produce safe, age-appropriate, and positive content.
• No personally identifiable information (PII) about the child is sent to AI providers. Only the child's first name may be used to personalize greetings.
• AI-generated content is not used to train third-party models.
• We use commercial AI APIs (Google Gemini, OpenAI, Groq) under their enterprise data processing terms, which prohibit using input/output data for model training.

6. Data Storage and Security

• All data is transmitted over HTTPS/TLS encryption.
• Passwords are hashed using bcrypt and never stored in plaintext.
• Authentication uses JSON Web Tokens (JWT) with expiration limits.
• Our database is hosted on secure, managed infrastructure with access restricted to authorized services only.
• Speech audio is processed client-side via the browser's Web Speech API. No audio files are transmitted to or stored on our servers.
• We conduct regular security reviews of our codebase and dependencies.

7. Third-Party Services

We use the following third-party services to operate Verbalyft:

We do not share children's personal information with any other third parties.

8. Parental Rights

Under COPPA, parents and legal guardians have the right to:

• Review all personal information collected about their child
• Request correction of inaccurate data
• Request deletion of their child's data and account
• Refuse further collection or use of their child's information
• Access progress reports and learning analytics via the Parent Dashboard

To exercise any of these rights, contact us at hello@verbalyft.com or use the account settings in the Parent Dashboard. We will respond within 30 days.

9. Data Retention

• Active accounts: Data is retained for the duration of the account's active use.
• Inactive accounts: Accounts inactive for 12 consecutive months may be flagged for deletion with 30 days' notice to the parent's email.
• Deleted accounts: All associated data (child profiles, stories, chat history, progress data) is permanently deleted within 30 days of account deletion.
• Anonymized analytics: We may retain aggregated, fully anonymized usage statistics (e.g., total stories generated, average session duration) that cannot be linked to any individual user.

10. Therapist and Institutional Accounts

When a speech-language pathologist or institution uses Verbalyft on behalf of clients:

• The therapist or institution acts as the authorized party providing consent for children under their care, in accordance with COPPA's school/institutional exception where applicable.
• Therapists can access progress data and reports only for children assigned to them.
• Institutional data is segregated and not shared across organizations.

11. International Users

For users in the European Economic Area (EEA) and United Kingdom, we process data under legitimate interest for providing the educational service, and with explicit parental consent for children's data as required by GDPR Article 8. You have the right to access, rectify, erase, restrict processing, and port your data. Contact hello@verbalyft.com to exercise these rights.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes that affect children's data, we will notify parents via email at least 30 days before the changes take effect and obtain new consent where required by law. The “Last updated” date at the top reflects the most recent revision.

13. Contact Us

If you have questions about this Privacy Policy, your child's data, or wish to exercise your parental rights, contact us:

• Email: hello@verbalyft.com
• Website: verbalyft.com