Privacy Policy

Part 1: General information

1. Who is responsible for data processing?

The controller within the meaning of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other data protection provisions is:

Thorge Mrowinski
Project “Avorate AI”
Gerhart-Hauptmann-Ring 7j
21629 Neu Wulmstorf
Germany
Email: support@avorate.app

Avorate is currently in a closed, non-commercial test phase (private beta). Access is only possible via a personal invite code, and no paid services are offered. A business will be duly registered before the official public launch.

What this means for data protection: During this phase we are continuously building out the service and its safeguards. The processing described here reflects the actual state of implementation, and we update this policy whenever something changes. Before the public launch we will additionally carry out a formal data protection impact assessment under Art. 35 GDPR, in which the risks of the AI-assisted evaluation of voice recordings — in particular for users who are minors — are fully assessed and the necessary remedial measures are determined. We welcome comments and concerns at any time at support@avorate.app and will follow up on them.

This policy applies to the website www.avorate.app, to the web app at web.avorate.app, to the help and documentation site docs.avorate.app and to the mobile app “Avorate AI - Coach”.

2. Data protection officer

We have not appointed a data protection officer because there is no legal obligation to do so:

• Avorate is operated by a single individual. We do not, as a rule, permanently employ at least twenty people in the automated processing of personal data (Section 38(1) sentence 1 BDSG).
• Our core activity consists neither of regular and systematic monitoring of data subjects on a large scale nor of large-scale processing of special categories of personal data (Art. 37(1)(b) and (c) GDPR).
• Should that change — in particular with the public launch and growing user numbers — we will appoint a data protection officer and name them here.

For any data protection question and to exercise your rights, contact us at support@avorate.app.

3. Use by children and young people (Art. 8 GDPR)

Avorate is expressly aimed at pupils. A significant share of our users is therefore a minor. This creates specific obligations for us, which we disclose here:

• Age threshold for consent: Under Art. 8(1) GDPR, a child's consent to information society services is only valid from the age of 16. Germany has not made use of the opening clause to lower that threshold, so the limit of 16 applies. Where we process data on the basis of your consent (voice recordings, push notifications, error diagnostics), that consent must be given or authorised by the holder of parental responsibility for anyone under 16.
• Contractual side: Independently of this, the user agreement itself requires the consent of the legal guardians for minors with limited legal capacity (aged 7 to 17) under Sections 106 et seq. of the German Civil Code (BGB). Our terms of use set out the details.
• Date of birth instead of an age check: When an account is set up we ask for the date of birth — day, month and year. We do not verify the answer and require no proof: a real age verification would need additional and particularly sensitive data about minors and would run counter to data minimisation. The answer decides whether advertising may be personalised and whether conversation training is available; if it is missing, we treat the account as that of someone under 16. Beyond that we still rely on the assurance given at registration and on the fact that access is only possible via a personally issued invite code. See Part 3, section 19.
• Advertising only on the free tier, no profiling by us: On the free tier, rewarded ads from Google appear before creating and before exporting a presentation. For users under 16 and for accounts with no age given we request non-personalised ads only and cap the permitted ad content; in the web app those accounts see no advertising at all. We ourselves build no interest or behavioural profiles and disclose no data for advertising purposes. No processing takes place that aims at influencing children commercially. Details in Part 3, section 20.
• Parents' rights: Legal guardians may exercise the rights listed in section 5 on behalf of their child and can contact us at support@avorate.app. If we learn that an account was created without the required consent, we delete it without delay.

4. Our principles

• Data minimisation (Art. 5(1)(c) GDPR): We collect no postal address, no telephone number, no identity document data and no payment data. Of your age we collect the date of birth alone (day, month, year) — no proof, no identity document (Part 3, section 19).
• No tracking by us: We use no analytics service and create no cross-device identifiers. Neither analytics nor advertising services run on this website. Advertising exists only on the free tier of the web app and the mobile app; it is served by Google, and what Google collects in the process is set out in Part 3, section 20.
• No sale of data: We do not sell or rent personal data and transmit none to third parties for advertising purposes. What Google receives for the ads does not come from us but directly from your device (Part 3, section 20).
• No special categories: We do not ask for data within the meaning of Art. 9 GDPR. We process voice recordings solely to generate speaking feedback and expressly not for the purpose of uniquely identifying a person; they are therefore not biometric data within the meaning of Art. 9(1) GDPR. Even so, please do not record health, religious or comparably sensitive content in a practice session.

5. Your rights as a data subject

As a data subject you have the following rights vis-à-vis the controller at any time, free of charge, within the scope of the GDPR:

• Right of access (Art. 15 GDPR): You have the right to know whether and which personal data we process about you, for which purposes, to which recipients it is disclosed and how long it is stored.
• Right to rectification (Art. 16 GDPR): You may request the immediate correction of inaccurate personal data or the completion of personal data we hold about you. You can change your profile and school details yourself in the settings at any time.
• Right to erasure / right to be forgotten (Art. 17 GDPR): You may request the deletion of your personal data, provided no legal ground (e.g. statutory retention obligations) prevents this. You can trigger the deletion of your entire account yourself in the app (section 16 of Part 3).
• Right to restriction of processing (Art. 18 GDPR): Under certain conditions you may request that the processing of your data be restricted.
• Right to data portability (Art. 20 GDPR): You have the right to receive data that we process automatically on the basis of your consent or for the performance of a contract, in a common, machine-readable format — for yourself or for transmission to a third party.
• Right to object (Art. 21 GDPR): Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to the processing on grounds relating to your particular situation.
• Withdrawal of consent (Art. 7(3) GDPR): You may withdraw consent once given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to lodge a complaint (Art. 77 GDPR): Irrespective of the above, you have the right to lodge a complaint with a data protection supervisory authority — in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority competent for our seat is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
(State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5
30159 Hannover
Germany
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
Website: lfd.niedersachsen.de

6. Recipients and processors at a glance

We use the following service providers. A data processing agreement pursuant to Art. 28 GDPR is in place with all those acting as processors for us. Ad delivery is the exception: there Google acts for its own purposes and is a controller in its own right, so the processing rests on your consent rather than on a processing agreement. Where a transfer to a third country takes place, it is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified under it, by the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023).

• Supabase Inc., USA — database, authentication, file storage and server-side functions. The infrastructure we rent is physically located in Frankfurt am Main (region eu-central-1).
• Cloudflare, Inc., USA — hosting and delivery of the website avorate.app and of the web app web.avorate.app.
• Google (Vertex AI / Google Cloud) — AI analysis and generation via the regional EU endpoint.
• Google Ireland Limited, Ireland — delivery of push notifications to iOS and Android devices (Firebase Cloud Messaging).
• Google Ireland Limited, Ireland — sign-in with a Google account (“Continue with Google”), if you choose that route.
• Google Ireland Limited, Ireland — delivery of advertising on the free tier: Google AdSense in the web app, Google AdMob in the mobile app. For this Google is a controller in its own right, not our processor; it receives the data directly from your device (Part 3, section 20). For a rewarded ad in the mobile app, Google additionally reports the completed view back to us (Part 3, section 21).
• Cloudflare, Inc., USA — the Turnstile captcha protecting our sign-in and registration forms, the forwarding of emails addressed to our addresses (Email Routing), and the pass-through of the voice stream during a live practice conversation (section 9) — there purely as a relay, with no storage.
• Resend, USA — sending of transactional emails and receipt of incoming support emails; EU sending region (eu-west-1), sending domain mail.avorate.app.
• Pexels — a brand of Canva Germany GmbH, Pappelallee 78/79, 10437 Berlin — stock photo search in the image dialog of the editor. When you open that dialog, the preview images are delivered to your device directly from the servers of the service (images.pexels.com). In doing so, the service necessarily receives, for technical reasons, your IP address and the details of your browser or app. For more information see Part 3, section 18.
• Functional Software, Inc. dba Sentry, USA — error diagnostics, exclusively in the mobile app and exclusively after your explicit consent; reports are routed via the service's EU region.
• The push service of your browser vendor — for web push, the technically necessary delivery to your browser.

Beyond this we only disclose personal data where we are legally obliged to do so or where you have expressly consented.

7. Retention periods at a glance

• Account, profile and content — for as long as your account exists; after a deletion request, final deletion after 30 days (section 16 of Part 3).
• Presentations, talks and practice sessions — until you delete the respective entry, at the latest until your account is deleted.
• Practice recordings (audio files) — if retention is switched on, no more than twelve months from the exercise, less if you delete them earlier. The unencrypted working copy the assessment needs is deleted immediately after the assessment; only if the assessment fails does it remain for no more than twelve hours so that it can be retried (section 8 of Part 3).
• Transcripts and conversation logs — twelve months from the exercise. Assessment, score, metrics and tips remain beyond that until you delete the exercise or your account (section 8 of Part 3).
• Hashes of IP addresses (invite code pre-check) — deleted automatically after two hours.
• Attempt counters inside your account — deleted automatically after two days.
• Availability measurements of our systems — deleted automatically after 90 days; they contain no personal data.
• Log of administrative actions — deleted automatically after one year.
• Support messages — until your enquiry has been finally dealt with; afterwards we delete them unless a statutory retention obligation applies.
• Date of birth — for as long as your account exists; you can change it in the settings at any time.
• Confirmations of watched ads (mobile app only) — 400 days, then deleted automatically.
• Messages in your account (gifts) — 90 days after you have read them.
• The website's consent cookie — 12 months, after which we ask again.

Part 2: Data processing on our website (avorate.app)

1. Provision of the website and server log files (hosting via Cloudflare)

Our website is hosted and delivered via the Cloudflare Workers platform of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). When you visit our website, Cloudflare automatically processes general information and technical data (browser type, operating system, referrer URL, hostname, IP address, date and time). This processing is technically essential to ensure stable, performant and secure delivery.

Cloudflare operates a worldwide network of locations and delivers the site from a location near you. For requests from the European Union this is generally within the EU. Processing outside the EU is not technically excluded; it is covered by the safeguards named below.

• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error-free and secure provision).
• Data processing agreement: We have concluded a data processing agreement (Data Processing Addendum) with Cloudflare.
• Third-country transfer: Processing takes place on the basis of the EU Standard Contractual Clauses.

2. No web analytics, no tracking, no external fonts

We do not use any web analytics, tracking or advertising services on avorate.app. No analytics or advertising cookies are set, no visitor profiles are created and no usage data is transmitted to third parties for analysis purposes. This website shows no advertising either — that exists only on the free tier of the web app and the mobile app (Part 3, section 20). The typeface we use is bundled when the site is built and is not loaded from a Google server at runtime; visiting the site therefore creates no connection to Google.

• Language cookie: A technically necessary cookie is stored that remembers the language you selected and serves the correct language version.
• Appearance: Your choice between light and dark appearance is stored locally in your browser and is not transmitted to us.
• Legal basis: Section 25(2) no. 2 TDDDG for the storage on your terminal equipment (strictly necessary for the service you requested) and Art. 6(1)(f) GDPR for the subsequent processing. Beyond the server log files described in section 1, your visit is not evaluated.

3. Consent, the cookie banner and cookie settings

On your first visit a banner appears at the bottom asking for your consent. It does not lock the page: you can keep reading without deciding — until you agree, nothing that would require consent is loaded. We distinguish two categories.

• Necessary: the language choice (section 2 above) and your decision in this banner. This category cannot be switched off, because the site would otherwise not work as intended; a switch for it would be a sham choice.
• Analytics: anonymous reach measurement. We currently use no analytics tool. Your agreement therefore has no effect today; it only takes effect once we use one, and we will name the provider, purpose, place of processing and retention period here beforehand.

The consent cookie is called avorate_consent, is set on this domain and holds only your decision together with its timestamp and format version — no recognition feature, no identifier of your device. It lasts 12 months, after which we ask again. The web app at web.avorate.app sits on its own domain and keeps its own cookie; anyone using both therefore decides twice.

Changing or withdrawing: the Cookie settings link in the footer of every page reopens the banner. Withdrawal takes effect for the future and is as easy as giving consent (Art. 7(3) GDPR). If you clear your browser cookies, we ask again on your next visit.

• Legal basis: for the cookie itself Section 25(2) no. 2 TDDDG — it stores only your decision and is strictly necessary for that. For anything that requires consent, Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

4. Contacting us by email

If you write to one of the addresses given on the website, we process your sender address, the subject and the content of your message in order to deal with your enquiry. Details are set out in Part 3, section 13.

Part 3: Data processing in the app (Avorate AI - Coach, mobile and web)

1. Registration, authentication and user account (Supabase Auth)

A user account is required to use the app.

• Email registration: We process your email address and your password. The password is only ever stored as an irreversible hash; we never know it in clear text. In addition, the authentication system stores technical metadata such as the time of registration, the confirmation status of the email address and the time of the last sign-in.
• Third-party login (Google Sign-In): If you sign in with your Google account, Google provides us with the email address stored there, your name and a unique Google user ID. No password is set in that case.
• Processor and place of storage: For the user database and authentication we use Supabase Inc. (1111 Broadway, Suite 300, Oakland, CA 94607, USA). The infrastructure we rent is physically located on servers in Frankfurt am Main (Germany).
• Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).

2. Profile details in the app

Your account includes a profile that tailors the AI output to your situation. All details are voluntary and can be changed or deleted at any time.

• Scope of processing: a display name, your year group, your school type and your federal state, plus application settings (selected coach voice, appearance, notification preferences, status of the onboarding flow).
• Purpose: adapting the language level, assessment standard and examples to your year group and school type. No assignment to a specific school takes place; we do not collect a school name.
• Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement).
• Not here, but separately: your date of birth is part of the profile, but serves a different purpose and rests on a different legal basis. It is therefore covered in section 19.

3. Access via invite code (closed beta)

Avorate currently runs as a closed beta. A newly created account is initially not unlocked and is only activated by entering a valid, personal invite code.

• Scope of processing: We store with your account which invite code was redeemed and when, whether the account is unlocked, and whether it is designated for free full beta access. An invite code itself contains no personal data.
• Purpose: controlling access to the test phase, traceability of the unlock and limiting the repeated use of a code.
• Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement) and Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).
• Storage period: The record exists for as long as your user account exists and is removed when it is deleted.

4. Bot and abuse protection (Cloudflare Turnstile)

Registration, login, password reset and the pre-check of an invite code are protected by the captcha service Turnstile provided by Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA). Without this protection, these forms would be open to automated mass registrations, the testing of stolen credentials and the guessing of invite codes.

• Scope of processing: Your IP address, technical characteristics of your browser or device (including user agent and language setting) and a single-use verification token are transmitted to Cloudflare. Turnstile is a privacy-friendly captcha: it sets no tracking cookie, creates no user profiles and does not evaluate your behaviour beyond the check itself.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against automated attacks and abusive registrations).
• Recipient and third-country transfer: Cloudflare, Inc., USA, on the basis of a data processing agreement; the transfer to the USA is safeguarded by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

5. Our own abuse protection for the invite code pre-check

The pre-check of an invite code happens before you have an account. It is therefore the only function that can be reached without signing in and has to be protected against the automated guessing of codes. To do so we limit the number of attempts per internet connection and hour.

• Scope of processing: All we store is a SHA-256 hash of your IP address computed with a secret additional value (a “pepper”), the time of the attempt and whether the attempt was successful. The IP address itself is never stored; without the secret additional value the hash cannot be traced back to an IP address.
• Purpose: solely limiting the number of attempts. The data is not combined with your user account and no profiling takes place.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in defending against brute-force attacks).
• Storage period: The entries are deleted automatically after two hours.

After signing in we also limit the number of redemption attempts per account and hour. For this we store a counter against your user ID which is deleted automatically after two days (Art. 6(1)(f) GDPR).

6. Storage on your device

To keep the app usable, individual items are stored locally in your browser or on your device. This data does not leave your device unless it is transmitted to us anyway in order to provide the function.

• Sign-in session: a session token that keeps you signed in.
• Registration draft: the steps of the registration wizard you have already completed (invite code, year group, school type, federal state, email address) so that navigating away does not discard your input. Passwords are never stored.
• Cache: drafts of a presentation, a copy of your overview list and short-lived addresses for image files so the app does not have to reload everything on each visit. These entries are removed when you sign out.
• Settings: language, appearance and your decision about error diagnostics (section 14).
• Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary for the service you expressly requested) and Art. 6(1)(b) GDPR.

7. Presentations and talks you create

When you generate a presentation or a talk, we store the result in your account so that you can access, edit and export it later.

• Scope of processing: topic, subject, year group and the parameters you chose, the generated content (outline, slides, texts), the processing status, your change requests in the editing chat together with the changes made in response, and technical consumption figures for the AI calls.
• Files: uploaded images, AI-generated images and export files are held in a private storage area assigned exclusively to your account. It is not public; access is only possible via short-lived signed addresses.
• Legal basis: Art. 6(1)(b) GDPR.
• Storage period: until you delete the respective entry, at the latest until your account is deleted.

8. Practice sessions: voice recording, transcript and assessment

The core of the app is practising a talk. To do so you record your spoken talk via your device's microphone. Recording only ever starts on a deliberate action by you.

• Scope of processing: the audio recording itself, the verbatim transcript generated from it, the duration, an overall score, individual metrics (e.g. speaking pace, filler words, pauses), an indicative grade and concrete improvement tips, plus the topic, subject and year group of the exercise.
• Place of storage: The audio file is placed in the private storage area described in section 7 at Supabase in Frankfurt am Main; transcript and assessment are held in the associated database.
• Retained recordings are encrypted: If you have switched retention on, the audio file is encrypted on your device before it reaches us (AES-GCM, 256 bit). Your device derives the key from a recording password known only to you; we do not store that password, never see it and cannot restore it. We are therefore unable to listen to retained recordings. There is a flip side, and we name it plainly: if the recording password is forgotten, the recordings concerned are permanently unreadable — for us as well. Transcript, assessment and metrics are unaffected; they are produced during the assessment and are held unencrypted in the database.
• Conversation training from the age of 16 only: Practising job interviews and workplace conversations is available only to people aged 16 and over. The server checks this before every round against your date of birth (section 19) and otherwise refuses the request; if no date of birth is on file, the account counts as that of someone under 16. Practising a talk is not affected.
• Legal basis: Art. 6(1)(a) GDPR (consent, given by deliberately starting the recording and granting microphone access) and Art. 6(1)(b) GDPR for providing the assessment you requested. You can withdraw your consent at any time with effect for the future by making no further recordings; recordings already stored can be deleted by you.
• Please note: Do not record other people without their consent and do not speak particularly sensitive content into a recording.
• No voice recognition: We do not create a biometric profile from your voice and do not use it to recognise you. Every recording is evaluated on its own; no comparison with earlier recordings takes place at voice level. No processing of biometric data for the purpose of uniquely identifying you within the meaning of Art. 9 GDPR is therefore involved.
• You decide whether the recording is kept: In the settings you specify whether your practice recordings are retained. If retention is switched on, the encrypted audio file remains stored for up to twelve months from the day of the exercise and is then deleted automatically. It serves a single purpose: letting you listen to yourself again and improve. Recordings are never used to train AI models, neither by us nor by the providers we use (section 9). If retention is switched off, the recording serves the processing only: it is deleted immediately after a successful assessment, never appears in the overview of your practice sessions and cannot be played back; the transcript and the assessment are retained. Independently of this, you can use the “Delete recordings” function at any time to remove all retained audio files of your account at once.
• What the AI gets to hear, and for how long: For the single assessment call the AI interface needs the recording in clear text. Alongside the encrypted file an unencrypted working copy therefore sits on the server, and only for as long as the assessment takes: once it has completed successfully the copy is deleted immediately, not after some period. Only if the call fails — for instance because the service is temporarily unavailable — does the working copy remain for no more than twelve hours, and even then for exactly one purpose: retrying the assessment. Without it the exercise would be lost, your speaking time used up, and you would still not receive an assessment. The file is not used for any other purpose during that time.
• How the deletion works: Every unencrypted working copy left behind by a failed call carries a fixed expiry point twelve hours after upload. A clean-up job runs hourly and removes every expired file; up to one further hour may therefore pass between the expiry of the twelve hours and the actual deletion. This applies to a practised talk with its single recording just as it does to conversation training, where one separate recording is created per answer round: each individual file carries its own expiry point and is subject to the same period.
• Storage period: If retention is switched on, encrypted audio recordings remain stored for no more than twelve months from the exercise, less if you remove them earlier, and at the latest until your account is deleted. If retention is switched off, only the period described above for the unencrypted working copy applies. Transcript and conversation log are likewise deleted after twelve months. Beyond that only assessment, score, metrics and tips remain — until you delete the exercise or your account is deleted. For those we deliberately do not set an automatic period, because your practice history and the comparison with the most recent exercise (“What has improved?”) are based on this data; they contain neither your voice nor your wording. “Delete recordings” concerns the audio files only. You can delete any individual practice session yourself at any time — in the overview of your practice sessions. This removes the transcript and the assessment immediately; the associated audio files are permanently cleared from storage by a nightly clean-up run within 48 hours at the latest. The same applies to “Delete recordings”: access to them ends immediately, the files themselves are cleared by the nightly run.

9. AI processing (Google Vertex AI)

For generating content and for automated feedback we use the AI platform Vertex AI by Google Cloud. We use language models from Google's Gemini family; which model size handles your requests depends on your plan (currently Gemini 3.5 Flash Lite, and Gemini 3.8 Flash on the paid plans). The live practice conversation uses a dedicated speech-to-speech model (currently gemini-live-2.5-flash); for generating slide images an image model (Imagen) in the europe-west4 region is additionally called. The same applies to all of these models: the same processor, the same EU endpoint, the same transmitted data and the same deletion periods — your plan does not change which data is transmitted.

• What is transmitted: your input (topic, subject, year group, specifications, change requests), images you upload and — when a practice session is evaluated — the audio recording itself. For this, the recording is loaded server-side from private storage and passed to the model within the same call. The live practice conversation works differently: no recording is passed there, instead your voice is transmitted continuously for as long as the conversation lasts (see “Live practice conversation” below). Your email address, your name and your account identifier are not transmitted.
• Strict use of the EU endpoint: The calls go exclusively to the regional endpoint within the European Union. Processing therefore takes place on servers within the EU.
• No model training: It is contractually agreed that the transmitted data is not used to train or improve AI models. It is deleted after the processing operation.
• No inference of emotions: The assessment of your exercise is limited to observable, measurable features of speaking — speaking pace, loudness over time, pauses, intelligibility, filler words, sentence structure and pronunciation. There is expressly no recognition or inference of emotions, moods or personality traits. We do not use an emotion recognition system within the meaning of Art. 3(39) of Regulation (EU) 2024/1689 (AI Act). The same applies to the live practice conversation: there, the model's system instruction expressly prohibits any statement about emotional state, personality or suitability. That instruction sits in our relay service and not in the app; it cannot be swapped out from your device. Emotion recognition in the employment context is prohibited under Art. 5(1)(f) AI Act — and a job interview is exactly that context.
• Legal basis: Art. 6(1)(b) GDPR for the service you requested; for the transmission of the voice recording and for the live voice stream additionally Art. 6(1)(a) GDPR (consent, given by deliberately starting the recording or the conversation and by releasing the microphone). A data processing agreement is in place with Google.

Live practice conversation (interview practice): For practising job interviews we offer a conversation in real time. Unlike a practice session under section 8, you do not upload a recording: for as long as the conversation lasts, your voice is transmitted continuously in both directions. This is a processing operation of its own, which we therefore describe separately.

• Path of transmission: the app transmits the raw audio stream to a relay service operated by us (a Cloudflare Worker), which forwards it to the EU endpoint of Vertex AI and returns the model's reply. This does not change the strict use of the EU endpoint described above.
• The relay service keeps no copy: it stores neither the audio nor the transcript in a database, in a log or on a disk. Only the number of seconds we need in order to account for your speaking time (section 10) is returned to our own systems.
• Additional processor: Cloudflare, Inc. — solely for passing the voice stream through, not for storing it.
• No audio file is created: unlike a practice session under section 8, no audio file is created at any point during a live conversation. The voice stream is not stored; it ends with the connection. All that remains permanently is the transcript and the assessment — as an ordinary practice session in your account, which you can delete yourself at any time like any other (Art. 17 GDPR).
• Visible indication that this is an AI: throughout the conversation the practice screen visibly states that your counterpart is an AI (Art. 50(1) AI Act). With a voice that sounds human, this is not a formality to us but the substance of that duty.

Transparency under the AI Act: Avorate is an AI system within the meaning of Regulation (EU) 2024/1689 (AI Act). We therefore expressly inform you that you are interacting with an AI system and that the texts, outlines, slides and images generated are artificially generated content (Art. 50(1) and (2) AI Act). We label generated content in the interface and are working on fully implementing the machine-readable marking of synthetic content in export files. If you publish generated content or use it at school, at university or at work, please observe the labelling and disclosure obligations that apply there.

Limits of the AI and no automated decision: The outputs are computer-generated suggestions based on statistical probabilities. They may be factually wrong, incomplete or inappropriate and do not replace an assessment by a teacher. There is no automated individual decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR): the score and indicative grade shown are practice feedback for you and are transmitted neither to your school nor to any third party.

10. Usage credits and speaking time

The extent of the AI-assisted features is governed by internal usage credits and a quota of analysable speaking time.

• Scope of processing: a ledger with the time, amount and reason of every credit or debit, and the remaining speaking time. Users with beta access receive a one-off 50 credits and two hours of speaking time free of charge.
• Where a credit came from is recorded as the reason in the same line: an allocation by us, a rewarded ad watched in the mobile app (section 21) or a gifted plan (section 22).
• Purpose: correct allocation and accounting of the quotas and protection against abusive multiple use. No payment processing is associated with this (section 17).
• Legal basis: Art. 6(1)(b) GDPR.

11. Push notifications (Firebase Cloud Messaging & Web Push)

We offer optional push notifications to inform you about purely operational events — in particular that Avorate is available again after maintenance. No advertising messages are sent and no usage profiles are created.

• Mobile app (Firebase Cloud Messaging): For delivery on iOS and Android devices we use Firebase Cloud Messaging (FCM) by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Only a pseudonymous, device-related delivery token is processed and stored together with the platform information (iOS/Android) in our database in Frankfurt am Main. No names, email addresses, content or usage data are transmitted to Google.
• Web app (Web Push): In the browser we use the open Web Push standard with VAPID authentication via your browser vendor's push service. We store your browser's technical push address, the associated encryption keys and your browser identification; message contents are encrypted to your browser. No Firebase service is used on the web.
• Consent and withdrawal: Notifications are only activated after your explicit consent via the system permission dialog and can be disabled at any time in the system or browser settings. Upon sign-out or uninstallation the token becomes invalid and the associated record is removed.
• Legal basis: Art. 6(1)(a) GDPR (consent).

12. Sending of transactional emails (Resend)

For sending emails we use the delivery provider Resend (a provider based in the USA). Only transactional messages are sent — in particular the confirmation of your registration, the resetting of your password and our replies to support enquiries. We do not send advertising or newsletter emails.

• Scope of processing: your email address, the subject and content of the respective message and the technical delivery status (e.g. delivered, undeliverable). Mail is sent from our verified sending domain mail.avorate.app.
• Place of processing: Sending is configured for the EU region (eu-west-1).
• Legal basis: Art. 6(1)(b) GDPR for account and contract related messages and Art. 6(1)(f) GDPR for handling your support enquiries.
• Third-country transfer: safeguarded by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

13. Support enquiries

If you write to support@avorate.app, your message is taken into our support system so that we can process and answer it reliably.

• Scope of processing: sender address and name, subject, message text, processing status, internal handling notes and our replies. For account recovery requests we additionally process the details you provide in order to verify that you are entitled to the account. Where the address can be matched to an account, we record that match.
• Legal basis: Art. 6(1)(b) GDPR for contract-related matters, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries and in protection against unauthorised account takeovers).
• Storage period: until your enquiry has been finally dealt with; afterwards we delete the records unless a statutory retention obligation applies.

14. Error diagnostics in the mobile app (Sentry)

To ensure stability we use, exclusively in the mobile app, the error diagnostics service Sentry by Functional Software Inc. dba Sentry (45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA). Reports are routed via the service's EU region. Sentry is not used in the web app or on the website.

• Scope of processing: in the event of an error, the error message, the technical call stack, app version, device type and operating system version, and technical intermediate steps preceding the error. The transmission of standard personal attributes is expressly switched off: IP addresses, request headers and cookies are not transmitted, nor is any content of your presentations or talks.
• Consent-based use: Error diagnostics is off by default and is only activated after your explicit consent during onboarding. You can withdraw it at any time in the settings; the client is then shut down and nothing further leaves your device.
• Legal basis: Art. 6(1)(a) GDPR (consent); third-country transfer safeguarded by the EU Standard Contractual Clauses.

15. Security and operational logs

• Availability monitoring: We check automatically and at regular intervals whether our services are reachable and store the time, response time and status code. These measurements contain no personal data and are deleted automatically after 90 days.
• Log of administrative actions: Administrative interventions in accounts (e.g. blocking, unblocking, deleting, editing a support case) are logged with the time, the acting person and the account concerned. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in traceability and abuse prevention); the entries are deleted automatically after one year.
• Server-side logs: Technical logs arise at our infrastructure providers which serve troubleshooting and the defence against attacks (Art. 6(1)(f) GDPR).

16. Deletion of your account

You can trigger the deletion of your account yourself in the app at any time. The process is deliberately two-stage so that an accidental deletion is not immediately irreversible.

• Signing in again before the request: Before we accept a deletion we require a fresh sign-in — depending on the account, entering your password or signing in with Google again. It must be no more than ten minutes old, otherwise we ask once more. This protects you from someone deleting your account on an unattended or still signed-in device: once the grace period has elapsed a deletion is final, and an open tab is not enough for that.
• Grace period of 30 days: Your request marks the account for deletion. Within 30 days you can undo the deletion yourself.
• Final deletion: After the 30 days have elapsed, an automatic process running daily removes the account permanently. This irreversibly deletes every database record linked to the account — credentials, profile, presentations and talks you created, editing histories, practice sessions with transcripts and assessments, the credit ledger, the speaking time balance, push tokens and the redemption of the invite code.
• Files: Your files in the private storage area (voice recordings, uploaded and generated images, export files) are removed in the course of the account deletion. Should a file remain for technical reasons, we delete it without delay once you point it out.
• Exceptions: Independently of this, the log of administrative actions and support cases already closed remain for the periods stated above, insofar as they are necessary for traceability or statutory retention obligations apply.

17. Payments, subscriptions and in-app purchases (not currently in use)

Avorate is in a closed beta and is provided free of charge. No subscriptions, credit packages or in-app purchases are offered or concluded. No payment processing therefore takes place at present, and no payment data is collected or transmitted to any payment or billing provider.

• Prepared but disabled integrations: For a later paid version, the technical integration of the billing providers Stripe and RevenueCat exists in the source code. Neither is in operation, because the credentials required for them are not set; they receive and process no data.
• Before any activation: We will update this privacy policy accordingly beforehand and inform you about it. Paid services will only come about after your express and separate consent.

18. Image search via Pexels

In the image dialog of the editor you can search free stock photos of the Pexels service and add them to your presentation. The service is operated by Pexels, a brand of Canva Germany GmbH, Pappelallee 78/79, 10437 Berlin.

• Search query: Your search term — with automatic illustration, the topic of your presentation — is transmitted by our server to the interface of the service. Your IP address is not passed on in the process, because the request originates from us and not from your device.
• Preview images: The result images, by contrast, are delivered to your device directly from the servers of the service (images.pexels.com). In doing so, the service necessarily receives, for technical reasons, your IP address, the time of retrieval and the identifier of your browser or app. We have no influence over this transmission; it is a precondition for the images being able to be displayed.
• Images you adopt: If you decide on an image, our server downloads it and places it in our own private file storage. From that point on, the image is delivered from our storage and no longer by the service.
• Legal basis: Art. 6(1)(b) GDPR — the image search is part of the feature you requested. You can avoid the transmission entirely by not opening the image dialog and instead uploading your own images or having images generated.
• Third-country reference: The controller is a company established in Germany. We cannot rule out a transfer by the provider itself to group companies outside the EU; the details are governed by its privacy policy.

If you wish to upload an image of your own or a document as the basis of a presentation, the app opens your device's file picker. We receive only the file you select. No access to your photo library is requested.

19. Date of birth and age-appropriate use

When your account is set up we ask for your date of birth. We ask because three things depend on it that cannot be done properly without knowing the age: how the content is pitched, the rules that apply to advertising towards younger people, and access to conversation training.

• Scope of processing: the date of birth with day, month and year. No proof, no identity document, no verification — it remains your own statement.
• Why to the day and no longer the year alone: Until September 2026 we collected the year of birth only. At the edges that is wrong: someone turning sixteen in December would count as younger for almost a full year — and someone born in January as older almost a full year too early. The advertising setting and access to conversation training hang on the threshold of 16, so the day now decides rather than the year. The two extra details are the price of getting the rule right.
• Purpose: first, an age-appropriate language level and age-appropriate examples; second, compliance with the special requirements for advertising towards children and young people; third, access to conversation training, which is available from the age of 16 only (section 8). If, by your date of birth, you are not yet 16, or the detail is missing, we request non-personalised ads only, do not show the consent dialog for personalised advertising (section 20) and do not release conversation training.
• Unknown counts as under 16: that is the cautious direction. An error the other way would mean a personalised ad shown to a child — precisely the mistake this question is meant to prevent.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in age-appropriate results and in lawful advertising conduct). In so far as the answer serves to comply with the requirements of Art. 8 GDPR for information society services, we also rely on Art. 6(1)(c) GDPR in conjunction with Art. 8 GDPR.
• No verification, no disclosure: we compare the answer with nothing, show it to nobody and transmit it to no third party — not to Google either. All that reaches Google is the outcome, as a flag: personalised advertising permitted or not.
• Storage and change: in your profile, for as long as your account exists. You can change the date of birth in the settings at any time; the advertising setting and the age rules follow the change immediately.

20. Advertising on the free tier (Google AdSense and Google AdMob)

The free tier is funded by advertising. It appears in exactly two places: before creating and before exporting a presentation, in both cases as a rewarded ad. Beta access and the Plus and Pro plans carry no advertising; this website shows none at all. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — via Google AdSense in the web app and via Google AdMob in the mobile app.

• Google is a controller in its own right here, not our processor. It decides on the purposes and means of ad delivery itself and collects the data directly in your browser or on your device. None of it reaches our server.
• What Google processes in doing so: IP address, details of device and browser, in the mobile app the device's advertising ID, an approximate location (derived from the IP address), the page or screen called up, and your interaction with the ad and with the consent dialog. Details are set out in Google's privacy policy and under “How Google uses information from sites or apps that use our services”.
• Consent: whether your device may store advertising identifiers and whether ads are personalised is decided by you in Google's own consent platform, certified for the IAB Transparency and Consent Framework. It is served by the same tag as the ads; we build nothing of our own for it and can neither see nor override your decision.
• Withdrawal: via Ad settings in the web app and in the app. That reopens the same dialog; withdrawal takes effect for the future. In the mobile app you can additionally reset the advertising ID in the operating system or switch off personalised advertising device-wide.
• Under 16 and no age given: for these accounts we flag every ad request as directed at users below the age of consent. The consequences: no personalised advertising, no advertising identifier for advertising purposes, no consent dialog — there is then nothing to consent to — and a cap on ad content at the rating suitable for all audiences. In the web app these accounts receive no advertising at all for as long as the service used there offers no equivalent flag (section 19).
• Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent) for storing and reading information on your terminal equipment and for personalised advertising. If you refuse consent, or if the flag described in the previous point applies, at most non-personalised ads are shown.
• Third-country transfer: our counterparty is Google Ireland Limited in the EU. Processing in the USA by Google LLC cannot be ruled out; it is safeguarded by the adequacy decision on the EU-U.S. Data Privacy Framework (10 July 2023) and, in addition, by the EU Standard Contractual Clauses.
• Retention: at Google according to its own periods. No data arises on our side from the ad itself — with the single exception in section 21.
• Status: the integration is being switched on in stages. As long as it is inactive, no Google script is loaded and no connection to Google arises.

21. Credits for watched ads (mobile app only)

On the free tier of the mobile app you can voluntarily watch a rewarded ad and receive usage credits for it — 5 units per ad, at most two ads a day. So that a credit cannot be faked, Google confirms the completed view to us server-side instead of the app being asked afterwards.

• Scope of processing: after an ad has been watched in full, Google sends our server a transaction ID, the identifier of your account with us, a timestamp, the name of the ad placement and the size of the reward. The message is signed by Google; we verify the signature before crediting anything. It contains neither the content of the ad nor any details about you as a person.
• Purpose: to carry out the credit correctly and exactly once (the same transaction ID is never booked twice), to enforce the daily cap and to detect manipulation.
• Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement — without this message there would be no credit) and Art. 6(1)(f) GDPR (legitimate interest in preventing fraud and in accounting that can be traced).
• Retention: 400 days, then automatic deletion. The period follows the window in which a credit may be disputed or a pattern of abuse spanning several months can be spotted; the booking itself remains as a line in the credit ledger (section 10).
• The web has none of this. Google offers server-side verification for apps only. The web app therefore has no credit for ads and no return channel — there we do not learn whether an ad was watched.

22. Messages in your account (gifts)

We can give an account a plan for a set period. So that this does not happen unnoticed, we place a message in your account which you see the next time you open the app or the web app.

• Scope of processing: the type of message, the gifted plan, the number of months, the associated credits and speaking time, the end of the period, and the times of creation and of reading.
• Purpose: to inform you about a change to your plan that you did not bring about yourself.
• Legal basis: Art. 6(1)(b) GDPR.
• Retention: 90 days after you have read the message; at the latest when your account is deleted.
• Not an advertising channel: we send no advertising and no recommendations through it, only notices concerning your account.

23. Changes to this privacy policy

We adapt this policy when the processing changes — for instance because a feature is added or a service provider changes. The version published on this page always applies. In the event of material changes we will additionally inform you in the app or by email.

What changed most recently (15 September 2026): Practice recordings are now kept encrypted and deleted automatically after twelve months; the earlier statement that no automatic period applies to transcript and assessment is thereby superseded (section 8 of Part 3). The year of birth became the full date of birth so that the age threshold is correct to the day (section 19, Part 1 sections 3 and 4). Newly added were access to conversation training from the age of 16 only (section 8) and the fresh sign-in before account deletion (section 16).

Before that (September 2026): newly added were the age details (section 19), advertising on the free tier (section 20), credits for watched ads (section 21) and messages in your account (section 22). Part 2 gained the section on consent on this website (section 3). The earlier statements “no advertising” and “no age details” are thereby superseded and have been replaced.

This privacy policy was last updated on 15 September 2026.