Privacy Policy

1. Data Controller

The data controller responsible for personal data processed on this website is:

SESSILE STUDIO LTD
71-75 Shelton Street, Covent Garden
London, WC2H 9JQ
United Kingdom
Represented by: Alper Yoruk
Email: info@hallokit.com

2. Data We Collect and Why

Account (Supabase)

To create and use your account we process your email address and a hashed password. The legal basis is performance of a contract (UK GDPR Art. 6(1)(b)). Data is stored with Supabase Inc. (USA), which processes the data under its data-processing terms. International transfers are governed by the transfer mechanism applicable to the recipient and processing, which may include UK adequacy regulations or contractual safeguards.

If you create an appointment plan, we also store the appointment type and date, your selected language level and practice mode, checklist completion, readiness, and mission progress. If you explicitly save a coached phrase, we store the improved phrase, its translation, source scenario, and review schedule. We do not save unrestricted practice responses or microphone recordings to your HalloKit account.

Payment Processing (Paddle)

Payments are handled by Paddle.com Market Ltd., acting as Merchant of Record. Paddle processes your payment details under Paddle's privacy policy. We receive the checkout email, Paddle transaction and customer identifiers, price, payment status, purchase timestamps, and limited campaign attribution used to fulfil and reconcile the purchase. We do not receive full card or bank-account details. Legal basis: performance of a contract (UK GDPR Art. 6(1)(b)).

Hosting (Vercel)

This website is hosted on Vercel Inc. (USA). Vercel processes your IP address and technical metadata (browser, operating system, referrer URL) for operational and security purposes. Legal basis: legitimate interest in stable service operation (UK GDPR Art. 6(1)(f)).

Text-to-Speech (OpenAI and Microsoft)

When you play German audio in a scenario, native-reviewed authored phrase text is sent to our server and, when configured, forwarded to OpenAI's speech synthesis service. If you explicitly save a coached phrase for review, that saved phrase can also be sent when you press Listen. Microsoft's speech synthesis service is used as a recoverable fallback. We do not send learner transcripts or recordings with speech-synthesis requests. Saved phrases are checked against your account and are not placed in public URLs or shared caches. Legal basis: performance of a contract when you use paid or free scenario features (UK GDPR Art. 6(1)(b)), or legitimate interest in delivering the service (UK GDPR Art. 6(1)(f)) for guest use.

Speech Recognition and Language Coaching (OpenAI and Your Browser)

If you use speak-aloud practice, your browser's built-in speech recognition may provide an interim transcript. Depending on the browser, this may occur on your device or through the browser vendor's speech service. When server transcription is available, the temporary microphone recording is sent through our server to OpenAI for transcription. The recording is processed for that request and is not stored by HalloKit.

After you inspect and, if needed, edit the transcript, the response text and limited mission context may be sent through our server to OpenAI for bounded language interpretation and coaching. Requests are made with API response storage disabled. HalloKit does not use the model to provide appointment facts or decide mission progression. OpenAI may retain API data according to the data controls enabled for our production account and its then-current service policies; we do not claim Zero Data Retention unless it is enabled for that account. See OpenAI's privacy policy. Legal basis: performance of a contract when you choose to use these features (UK GDPR Art. 6(1)(b)). You can always type or use a guided response instead.

Product Analytics (Supabase)

We store product usage events (for example scenario starts, completions, and checkout steps) in our Supabase database to understand how the service is used and improve it. These events may include your account ID when signed in, an anonymous session identifier when browsing as a guest, and your browser user-agent string. For acquisition measurement, we also record the referring hostname, broad channel, and shortened UTM campaign labels, but not the full referring page URL. Practice analytics may include bounded outcome, latency, cost, and fallback fields, but never learner text or audio. Legal basis: legitimate interest in operating and improving the service (UK GDPR Art. 6(1)(f)).

Marketing & Reminder Emails (Resend)

If you opt in, we process your email address to send practical German tips, follow-up learning emails, or appointment prep reminders. These are sent only with your explicit consent at the point of signup. We store your email address, consent status, and (for prep reminders) the scenario and appointment date you provide in our Supabase database. Outbound emails are delivered via Resend (Resend, Inc., USA), which processes your email address as our email service provider under their own privacy policy. Legal basis: consent (UK GDPR Art. 6(1)(a)). You can withdraw consent at any time by using the unsubscribe link in any marketing email or by contacting us at info@hallokit.com.

Partner inquiries

If you submit the written partner inquiry form, we store your organization name, contact name, work email, organization type, approximate annual learner count, optional notes, consent timestamp, and shortened campaign labels in a private database table. This table is not exposed through the public API. We use the details only to assess fit and reply in writing. Legal basis: steps prior to a contract (UK GDPR Art. 6(1)(b)) and legitimate interest in answering organizational inquiries (UK GDPR Art. 6(1)(f)).

3. Cookies and Local Storage

We use first-party cookies for authentication and an anonymous product-analytics session identifier. We do not set third-party advertising cookies or use cross-site advertising trackers.

We also store small preference values in your browser's local storage (for example cookie-notice acceptance, practice settings, guest scenario progress, dismissed tips, and first-touch campaign labels used to attribute a later checkout). This data stays on your device and is not sent to us unless you take an action that syncs it to your account (for example saving progress while signed in or opening checkout). Guest appointment plans may also be kept in local storage and imported after you sign in, so you do not have to repeat onboarding.

4. Retention

Account data, appointment plans, mission progress, and saved phrases are retained for as long as your account remains active, unless you delete an item earlier. Practice audio is not stored by HalloKit and unrestricted transcripts are not retained in your account. Marketing email data is retained until you unsubscribe or ask us to delete it. Prep reminder data is deleted after the reminder is sent or the appointment date has passed. Upon account deletion request, personal data is removed within 30 days, unless we are required by law to retain it for longer (e.g. financial records may be kept for up to 6 years under UK tax law). To request deletion, contact info@hallokit.com.

5. Your Rights

Under UK GDPR you have the right to: access your data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object (Art. 21). To exercise any of these rights, please contact us at: info@hallokit.com.

6. Complaints

You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk.