We at TOO Vox Learning ("Vox Learning", "we", "our", or "us") respect your privacy. This Privacy Notice describes how we collect, use, and share personal data when you use our website, browser extension, and related services (collectively, the "Services").

1. Data controller

TOO Vox Learning, a company incorporated in the Republic of Kazakhstan, registered office at Kazakhstan, city of Astana, district Yesil, prospekt Kabanbay Batyr, house 6/3, apt. 8, 010000, company number 250940001060, is the controller responsible for your personal data under this Privacy Notice. You can reach us at contact@vox-learning.com.

2. Personal data we collect

Account information. When you sign in with Google, we receive your name, email address, and profile picture.

Content. Words and sentences you save (including the surrounding audio clip and scene thumbnail, where captured by the extension), books or text you upload to read, your reading position, comments you add, and your flashcard review history.

Communication information. If you contact contact@vox-learning.com directly, the contents of that correspondence.

Technical information. Standard log data your browser sends when you use the Services (IP address, browser type, and the date and time of requests), which we use to keep the Services secure (for example, detecting unusual login activity) and to diagnose problems. We infer only a coarse, city/country-level location from your IP address for this purpose; we do not request or collect precise GPS location.

Cookies. We use a single, strictly necessary session cookie to keep you signed in. We do not currently use advertising, analytics, or preference cookies. If that changes, we will update this notice and add a consent mechanism where required.

Where you came from. The link that first brought you to the site, if it carried a source tag (a word such as “youtube”), or the word “extension” if you signed up from the extension. It is kept with your account so we know which of our own pages and posts are worth writing. It is a single word, it is recorded once when the account is created and never changed afterwards, and it is not shared with anyone.

Billing information. Once paid subscriptions launch, purchases will be handled by Paddle (see §5). Paddle collects your billing details (such as name, email, and payment method) directly. From Paddle, we receive your subscription plan, status, and renewal date, plus your payment history (transaction dates, amounts, and status) when you view it in your account, fetched fresh each time and not stored in our own systems. We do not receive or store your full payment card details.

3. The browser extension

The Vox Learning browser extension works on six video sites, which Chrome names on the permissions screen when you install it, and, only when you choose it from the right-click menu, on the web page you are reading. While reader mode is on, following a link within that same site keeps it on for the page you land on; a reload or a link to another site ends it, and you can turn that off in the reader's own settings. It has no access to any other page. Everything it sends goes to our own servers, apart from one call to Google to read the name and profile picture on your own account, which the extension shows in its popup. The extension contains no analytics or advertising code. What it sends, and when:

• When you sign in with Google: your email address and name, and a Google sign-in token we use once to create your session.
• When you are signed in: as a video or an article loads, we send a list of the words that appear in it, with how often each one occurs, so we can tell you which of them are already in your deck and highlight them for you. If you also turn on "Show difficulty", a second list of the same shape is used to rate how well the title fits your level, and this happens before you save anything. The sentences, their order, the title, and your place in the video stay on your computer, and nothing is sent when you are signed out. One exception: for a few languages whose words cannot be separated in the browser, the difficulty rating sends the subtitle text itself. We keep only word statistics (which words appear, and how often); any text is discarded and cannot be reconstructed from what we store.
• When you save a word: the word, the subtitle line or sentence it appeared in, a still image of the scene or page, a short audio clip of that line, the title, and, for a web page, the page's address. This is what your deck shows you when the word comes back, and it is visible only to your account.
• When you tap a word the built-in offline dictionary cannot answer: that word, sent to us to fetch a translation.
• When you ask for the line you just heard (pressing R twice while watching): a few seconds of that line's audio, sent to be transcribed and translated for you. The audio is not kept, and the written-out line is deleted from our servers within the hour.
• While you watch with the extension on: the minutes watched and the language you are learning, sent as running totals so the site can show you how much you have watched. We never keep the name of what you are watching or your position in it, and nothing is recorded for anything watched with the extension off.
• When you use the feedback button: the message you type and its category, the extension version, the name of the site you were on (never the page address), and the language the extension is displayed in.

While you watch, the extension keeps the last few seconds of the soundtrack in memory so that a word you save can carry the line that was just spoken. That buffer stays on your computer and is continuously discarded.

Two things can send audio from it, and only these two. If you save a word, a short clip of that line is stored with the word and played back to you when it comes round again; "Save audio clips with words" in the extension's settings turns that off. If you press R twice while watching, the line you just heard is sent to be written out and translated, because that is what the key asks for; we do not keep that audio at all, and the written-out line is deleted from our servers within the hour. Nothing else from the buffer leaves your computer, and nothing is sent while you are signed out.

The extension stores your settings and an offline dictionary for your language pair on your own computer, so that tapping a word answers even without a connection; none of that is sent to us. Uninstalling the extension removes all of it. Signed out, the extension still shows subtitles and still answers taps from the local dictionary, and its only requests to us are downloads that carry nothing about you.

4. How we use personal data

• To provide the Services, for example generating explanations, translations, and audio for the words you save.
• To maintain and improve the Services, including diagnosing bugs you report.
• To communicate with you about the Services, including changes to them.
• To prevent fraud, abuse, or illegal activity, and to protect the security of our systems.
• To comply with legal obligations.

We do not use your Content to train our own models, for advertising, or to develop other products, and we do not sell personal data.

Legal bases. We process account and Content data because it's necessary to perform our contract with you (providing the Services you signed up for); we process technical/security data on the basis of our legitimate interest in keeping the Services secure; and we process data where necessary to comply with a legal obligation.

5. Third-party service providers

To generate the explanations, translations, and audio that make up the Services, we send the relevant word, sentence, or phrase to these providers:

• OpenAI: word/sentence explanations, and text-to-speech for some audio.
• Google: translation.
• Paddle: payment processing and billing, once paid subscriptions launch.

We only send these providers what's needed to generate the relevant response: for example, the word and its surrounding sentence, not your full account or library. These providers do not use the data we send them to serve their own advertising. We require each provider we share personal data with to handle it under contractual terms consistent with GDPR; we are in the process of formalizing data processing agreements with our current providers.

We also use Hetzner, a European cloud hosting provider, to host the Services and store your data, and we keep encrypted off-site backups that only we hold the keys to.

6. Data transfers

We and the providers listed above process personal data on servers located outside the EEA, Switzerland, and the UK, including in the United States. Where we transfer personal data outside the EEA, Switzerland, or the UK, we rely on the European Commission's adequacy decisions where available, and otherwise on Standard Contractual Clauses and the UK Data Transfer Addendum. Contact contact@vox-learning.com for more information about these safeguards.

7. Retention

We retain your account and Content for as long as your account is active. You can request deletion at any time from Account → Your data. When you do, we immediately end your active session so no further processing of your account occurs, and we permanently erase your account, saved words, and books after a 7-day grace period, unless you log back in during that window, which cancels the deletion request. Requesting deletion also cancels any active subscription, and logging back in does not reinstate it; you can resume it from Account → Subscription. You can also download a copy of your account data, Content, and activity at any time from the same page.

When a saved word is retired from study, its audio clip and scene image are permanently deleted after a 30-day grace period; the word and its text remain in your deck history. Data erased from our systems can persist for a limited time in encrypted backups before backup rotation removes it.

8. Your rights

Subject to applicable law, you have the right to:

• Access your personal data and information about how it's processed.
• Delete your personal data; see §7 above.
• Rectify or update your personal data.
• Receive a copy of your personal data in a portable format (data portability); see §7 above.
• Restrict or object to how we process your personal data.
• Withdraw consent, where we rely on consent as the legal basis for processing.
• Lodge a complaint with your local data protection supervisory authority.

Most of these you can exercise directly from your account. For anything else, contact contact@vox-learning.com.

A note on accuracy. Explanations and translations are generated using third-party machine-translation and language-analysis tools and may not always be factually accurate. If output contains inaccurate information about you and you'd like to request a correction, contact contact@vox-learning.com.

9. Children

The Services are not directed to, or intended for, children under 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided personal data to us, contact contact@vox-learning.com and we will investigate and, if appropriate, delete it. Users under 18 must have permission from a parent or guardian to use the Services.

10. Security

We implement reasonable technical, administrative, and organizational measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. No internet transmission or storage system is ever fully secure, so we can't guarantee absolute security.

11. Disclosure of personal data

Beyond the service providers in §5, we may disclose personal data:

• In connection with a business transfer, reorganization, or similar transaction, in which case data may be disclosed to counterparties and transferred to a successor as part of that transaction.
• To government authorities or other third parties where required by law, to protect our rights or property, to investigate fraud or illegal activity, or to protect the safety of our users or the public.

12. Changes to this notice

We may update this Privacy Notice from time to time. When we do, we'll publish an updated version and effective date on this page.

13. Contact us

Questions or concerns about this Privacy Notice? Contact us at contact@vox-learning.com.