Privacy Policy

This policy explains what personal data AptSpeak collects, why, and what rights you have over it. We’ve tried to write it in plain English rather than dense legal language.

1. Who we are

AptSpeak is operated by [COMPANY LEGAL NAME], a company registered in [STATE], United States, at [REGISTERED ADDRESS]. The company is the “data controller” of the personal data described in this policy.

You can reach us about any privacy question or request at lekai.aptspeak@gmail.com.

2. What data we collect

We collect data in three ways: what you give us directly, what we receive from Google if you sign in that way, and what is generated automatically as you use the site.

Account data. When you create an account, we (via our authentication provider, Supabase) store your email address and an encrypted password. We never see or store your password in plain text.

Google sign-in data. If you sign in with Google instead, Google shares your email address, name, and avatar URL with us. We store these to create and display your account.

Server logs. Our hosting provider, Vercel, automatically processes standard server logs for every request to the site, including your IP address, as part of running the infrastructure.

Analytics. We use Vercel Web Analytics, a privacy-friendly analytics tool that does not use cookies and does not track you across other websites. It gives us aggregate information, like which pages are popular, not individual profiles. We also use Vercel Speed Insights, which measures page performance — things like load speed and responsiveness — from real visits, also without cookies and without tracking visitors across other websites.

Google Analytics (optional). With your permission — given through the cookie banner — we also use Google Analytics to understand how the site is used. This one does use cookies. It’s off by default: nothing is measured or stored, and nothing is even requested from Google, until you actively accept it. You can withdraw your acceptance at any time from “Cookie settings” in the footer. We never send Google Analytics your name, email address, or account ID.

3. Why we process your data, and on what legal basis

We only process personal data where we have a valid legal basis to do so under the GDPR:

• Contract performance: account data (email, authentication details, Google profile data) is processed so we can create your account, let you log in, and provide the coaching and content you sign up for.
• Legitimate interest: server logs are processed to keep the site secure, prevent abuse, and diagnose technical problems. Vercel Web Analytics and Speed Insights data is processed to understand how the site is used and performing so we can improve it. We’ve judged that this limited processing doesn’t override your own privacy interests.
• Consent: Google Analytics is only used if you accept it in the cookie banner. This processing relies on your consent under GDPR Article 6(1)(a), which you can withdraw at any time via “Cookie settings” in the footer, without affecting the lawfulness of processing before you withdrew it.

4. Who we share data with

We don’t sell your personal data, and we don’t use it for advertising. We do share it with a small number of service providers (“processors”) who help us run the site:

• Supabase — our database, file storage, and authentication provider. Supabase stores your account data and any files (like downloadable learning materials) associated with the site.
• Vercel — our hosting provider. Vercel processes server logs and privacy-friendly analytics (Web Analytics and Speed Insights) as described above.
• Google — if you choose to sign in with Google, Google processes your sign-in and shares the profile data described above with us, under Google’s own privacy policy. Separately, if you accept the Analytics cookie, Google also processes Google Analytics data about how you use the site — see “Cookies” below.
• Calendly — session bookings happen on Calendly, which opens in a new tab. Any information you give Calendly to book a session (like your name and email) is collected and processed by Calendly directly, under its own privacy policy, not by us.
• YouTube and Spotify — podcast episodes are embedded from YouTube or Spotify. Neither loads until you click play on the embed, and once you do, that platform processes your interaction under its own privacy policy, not ours.

We do not currently process payments on this site, so no payment processor is listed here — this policy will be updated if that changes.

5. International data transfers

AptSpeak and the service providers listed above — Google, Vercel, and Supabase — are based in, or may process data in, the United States. Where this involves transferring personal data out of the EU/EEA, we rely on recognized legal transfer mechanisms, such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses, to make sure your data continues to receive an equivalent level of protection.

6. How long we keep your data

We keep your account data for as long as your account is active. If you ask us to delete your account, we delete or anonymize your account data, except where we’re required to keep something for a legitimate reason (like resolving a dispute). Server logs and Vercel analytics data are kept only for as long as needed for security, debugging, and understanding site usage, and are not kept indefinitely. Google Analytics data (where you’ve accepted it) is retained for [14] months.

7. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• correct (rectify) inaccurate or incomplete data;
• delete (erase) your data, in certain circumstances;
• receive a copy of your data in a portable format (“data portability”);
• object to processing that’s based on our legitimate interest; and
• lodge a complaint with the data protection authority in your EU/EEA country of residence.

To exercise any of these rights, email us at lekai.aptspeak@gmail.com.

8. Cookies

We use two categories of cookies, shown in the cookie banner when you first visit:

• Necessary (always on). Required to keep you signed in. The site can’t work without these, so they aren’t optional.
• Analytics (opt-in). Google Analytics cookies. These are only set if you accept — before you make a choice, they’re blocked entirely, and nothing is requested from Google at all. If you reject them, or later change your mind, we delete them and reload the page.

Here’s exactly what each cookie does:

We never use advertising cookies, and we don’t use cookies for cross-site tracking. You can change your choice at any time using “Cookie settings” in the footer.

Embedded podcast players (YouTube and Spotify) only load when you click play — before that, no request is made to either platform. Once you click play, YouTube or Spotify may set their own cookies, under their own privacy policies, not this one.

9. Children’s privacy

This service is not directed at, or intended for, children under the age of 16, and we do not knowingly collect personal data from children under 16.

10. Changes to this policy

If we make changes to this policy, we’ll update it on this page and update the “Last updated” date at the top.

11. Contact us

If you have any questions about this policy or how we handle your data, email lekai.aptspeak@gmail.com.