Parla Privacy Policy
Effective date: 19 October 2026 Last updated: 19 October 2026
This Privacy Policy explains how Parla ("Parla", "we", "us" or "our") collects, uses, shares and protects your personal data when you use the Parla mobile applications for iOS and Android, the Parla website at https://parla.poelys.com, and related services (together, the "Service").
Parla is an AI speaking coach for language learners. It lets you hold voice conversations with our AI coach, Echo, and provides speech-to-text, text-to-speech, pronunciation feedback, vocabulary practice, roleplay scenarios, news-based content and progress tracking.
We process personal data in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and its rules, and other laws that apply to us. Where you are located in a region with its own data protection laws (for example, the European Economic Area or the United Kingdom), we aim to honour the rights those laws give you, as described in Section 9.
By using the Service, you acknowledge that you have read this Policy. Where we rely on your consent, we will ask for it clearly, and you can withdraw it at any time (see Section 9).
Contents
- Who we are
- Personal data we collect
- How and why we use your data
- Voice and audio data
- AI processing and third-party service providers
- How we share data
- Where your data is stored and international transfers
- Data retention
- Your rights
- Security
- Children
- Cookies and similar technologies (website)
- Changes to this Policy
- Contact us and grievance redressal
1. Who we are
The Service is operated by the Parla team ("Data Fiduciary" under the DPDP Act, and "controller" under GDPR-style laws).
- Service name: Parla
- Website: https://parla.poelys.com
- Privacy contact: privacy@poelys.com
- General support: support@poelys.com
2. Personal data we collect
We collect only the data we need to provide and improve the Service.
2.1 Data you give us
| Category | Examples |
|---|---|
| Account information | Email address, name or display name, password (stored only in hashed form) or sign-in credentials from a third-party sign-in provider. |
| Learning profile | Target language(s), native language, proficiency level, learning goals and preferences you select. |
| Voice recordings | Audio you record when speaking to Echo, doing pronunciation exercises or taking part in roleplay scenarios. |
| Text content | Messages you type, and transcripts of your speech produced by speech-to-text processing. |
| Support communications | Information you include when you email us or submit feedback. |
2.2 Data generated when you use the Service
| Category | Examples |
|---|---|
| Learning progress | Completed lessons and scenarios, vocabulary saved and reviewed, streaks, scores, pronunciation feedback results, session history. |
| AI conversation data | Echo's responses, generated feedback, and the conversation context needed to keep a session coherent. |
| Device and app usage data | Device model, operating system and version, app version, language and time-zone settings, IP address, crash logs and diagnostic data, feature usage events and timestamps. |
| Website data | Browser type, pages visited, referring URL and cookie data (see Section 12). |
2.3 Device permissions
- Microphone: required for voice conversations and pronunciation feedback. We access the microphone only when you start a recording or a voice session. You can revoke this permission at any time in your device settings; voice features will then stop working, but text-based features remain available where offered.
- Notifications (optional): used for practice reminders if you enable them.
We do not collect your precise location, contacts, photos or other data unrelated to the Service.
3. How and why we use your data
| Purpose | Data used | Basis |
|---|---|---|
| Create and manage your account, and authenticate you | Account information | Your consent / performance of the Service you requested |
| Provide voice conversations, transcription, spoken replies and pronunciation feedback | Voice recordings, transcripts, text content, learning profile | Your consent |
| Personalise lessons, vocabulary and scenarios to your level and goals | Learning profile, learning progress | Your consent |
| Track and display your progress | Learning progress | Your consent |
| Keep the Service secure, prevent abuse and fraud, fix bugs | Device and usage data, account information | Legitimate uses permitted by law / our legitimate interests |
| Respond to support requests | Support communications, account information | Your consent / your request |
| Send service-related messages (e.g. security notices, changes to these terms) | Email address | Legitimate uses / legal obligation |
| Send optional reminders or product updates | Email address, notification token | Your consent (you can opt out at any time) |
| Comply with legal obligations and respond to lawful requests | Any relevant data | Legal obligation |
We do not sell your personal data. We do not show third-party advertising in the Service, and we do not share your data with advertisers or data brokers.
We do not use your voice recordings to identify you biometrically (for example, voiceprint identification or speaker verification).
4. Voice and audio data
Because voice is central to Parla, we want to be especially clear about how it is handled.
- When recording happens. Audio is captured only while you are actively in a voice session or recording an exercise, as indicated in the app.
- How it is processed. Your audio is sent over an encrypted connection to our servers and then to a speech-to-text provider to produce a transcript. The transcript (and, for pronunciation feedback, relevant audio features) is processed by an AI provider to generate Echo's reply and feedback. Echo's reply may be converted to audio by a text-to-speech provider.
- What we keep. We store transcripts and the feedback generated from them as part of your conversation and progress history so you can review them. Raw audio recordings are kept only as long as needed to process your request and, where applicable, to let you replay your own recordings, as described in Section 8.
- No training of third-party models by default. Where our providers offer the option, we configure our accounts so that data we send through their APIs is not used to train their general-purpose models. Providers may retain API data for a limited period for abuse monitoring under their own terms.
- Your control. You can delete individual conversations (where the feature is available) or your whole account at any time, which deletes associated recordings and transcripts as described in Section 8 and in our Account Deletion guide.
Please avoid sharing sensitive personal information (for example, health, financial or government ID details) in your conversations. The Service does not need it.
5. AI processing and third-party service providers
We use carefully selected service providers ("Data Processors") to run the Service. They process personal data only on our instructions and for the purposes described in this Policy. The specific providers we use may change over time; the current categories are:
| Category | Purpose | Examples of providers we may use |
|---|---|---|
| AI language model providers | Generating Echo's conversational replies, corrections, feedback, vocabulary and scenario content | Anthropic (Claude), OpenAI, Google (Gemini), or other OpenAI-compatible model providers |
| Speech providers | Speech-to-text transcription, text-to-speech audio, pronunciation assessment | Speech services offered by the AI providers above or by dedicated speech service providers |
| Authentication (optional) | Secure sign-in | Google Firebase Authentication |
| Cloud hosting and database | Running our servers and storing account and learning data | Amazon Web Services (AWS), Asia Pacific (Mumbai) region, India |
| App distribution | Delivering the app and updates | Apple App Store, Google Play |
| Email and support tools | Sending service emails and handling support requests | Email delivery providers |
| Diagnostics | Crash reporting and performance monitoring | Crash-reporting and analytics providers configured without advertising features |
Only the data necessary for each task is sent to each provider. For example, an AI provider receives the conversation text and context needed to produce a reply, not your password. Each provider is bound by contractual obligations of confidentiality and security, and is subject to its own privacy policy for any processing it performs as an independent controller.
AI-generated content. Echo's replies and feedback are generated automatically by AI models and may be inaccurate. We do not use automated processing to make decisions that produce legal or similarly significant effects about you.
You can request an up-to-date list of the providers we use by contacting privacy@poelys.com.
6. How we share data
We share personal data only:
- With service providers listed in Section 5, to operate the Service;
- When required by law, such as to comply with a court order, a lawful request from a government authority, or to meet obligations under applicable law;
- To protect rights and safety, where reasonably necessary to prevent fraud, abuse, security incidents or harm to users or others;
- In a business transfer, such as a merger, acquisition or sale of assets, in which case your data will remain subject to protections at least as strong as those in this Policy and we will notify you; and
- With your consent or at your direction.
7. Where your data is stored and international transfers
Our primary servers and database are hosted on Amazon Web Services in the Asia Pacific (Mumbai) region (ap-south-1), India.
Some of our service providers, including AI and speech providers, may process data in other countries, such as the United States or member states of the European Union. When data is transferred outside India, we do so in accordance with the DPDP Act and any restrictions notified by the Government of India, and we take reasonable steps (such as contractual safeguards and choosing providers with recognised security practices) to ensure your data remains protected. For users in the EEA or UK, transfers rely on appropriate safeguards such as Standard Contractual Clauses where required.
8. Data retention
We keep personal data only for as long as necessary for the purposes described in this Policy, unless a longer period is required by law.
| Data | Retention period |
|---|---|
| Account information | While your account is active. Deleted within 30 days of account deletion. |
| Learning profile and progress | While your account is active. Deleted within 30 days of account deletion. |
| Conversation transcripts and feedback | While your account is active, or until you delete them. Deleted within 30 days of account deletion. |
| Raw voice recordings | Processed transiently to generate transcripts and feedback. Any audio we store (for example, to let you replay your recordings) is kept for no longer than 30 days, or until you delete it or your account, whichever is sooner. |
| Copies held by AI and speech providers | Governed by each provider's API data-retention terms, typically limited periods for abuse and security monitoring (often up to 30 days). |
| Server logs and diagnostic data | Up to 90 days, unless needed longer to investigate a security incident. |
| Backups | Encrypted backups are overwritten on a rolling cycle; deleted data is removed from backups within 90 days. |
| Support communications | Up to 2 years after the request is resolved. |
| Records required by law (e.g. transaction records, if paid plans are offered) | For the period required by applicable law. |
If your account is inactive for an extended period, we may notify you and delete your data in line with the DPDP Act. Where we keep aggregated or de-identified data that can no longer reasonably identify you, we may retain it to understand and improve the Service.
9. Your rights
Subject to applicable law, you have the right to:
- Access — obtain a summary of the personal data we process about you and the processing activities, and the identities of those with whom it has been shared;
- Correction and updating — correct inaccurate or incomplete data and update your details (many fields can be edited directly in the app);
- Erasure — ask us to delete your personal data. You can delete your account in the app or by email; see How to Delete Your Account;
- Withdraw consent — withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already carried out, but some features (such as voice conversations) may no longer be available;
- Grievance redressal — have your complaints handled by us promptly (see Section 14);
- Nominate — nominate another individual to exercise your rights in the event of your death or incapacity, as provided by the DPDP Act.
If you are in the EEA, the UK or a similar jurisdiction, you may also have the right to data portability, to object to or restrict certain processing, and to lodge a complaint with your local data protection authority.
How to exercise your rights: email privacy@poelys.com from the email address linked to your account, or use the relevant in-app settings. We may need to verify your identity before acting on a request. We aim to respond within 30 days, and sooner where required by law.
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India in accordance with the DPDP Act, after first exhausting our grievance redressal process.
10. Security
We use reasonable technical and organisational safeguards to protect your data, including:
- encryption in transit (HTTPS/TLS) for all communication between the app, website and our servers;
- hashed passwords and token-based authentication;
- access controls limiting staff and system access to personal data on a need-to-know basis;
- hosting with an established cloud provider and restricted network access to our database; and
- monitoring and logging to detect and respond to misuse.
No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify affected users and the Data Protection Board of India as required by law.
You can help by using a strong, unique password and keeping your sign-in details private.
11. Children
The Service is not directed to children under 13, and children under 13 may not use it.
Under the DPDP Act, a "child" is anyone under 18. If you are between 13 and 18 (or under the age of digital consent where you live), you may use the Service only with the verifiable consent of your parent or lawful guardian. Where we process a child's data we:
- obtain verifiable parental consent as required by law;
- do not carry out tracking, behavioural monitoring or targeted advertising directed at children; and
- process the data only to provide the learning Service.
If you believe a child has provided us with personal data without appropriate consent, please contact privacy@poelys.com and we will delete it promptly.
12. Cookies and similar technologies (website)
The mobile apps do not use browser cookies, but may store data locally on your device (for example, sign-in tokens and preferences) so the app works correctly.
Our website at https://parla.poelys.com uses:
- Strictly necessary cookies and local storage — to keep you signed in, remember preferences and protect against security threats. These are required for the website to function.
- Analytics cookies (if used) — to understand how visitors use the site in aggregate. Where required by law, we will ask for your consent before setting them.
We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings; blocking strictly necessary cookies may stop parts of the website from working.
13. Changes to this Policy
We may update this Policy from time to time, for example to reflect changes to the Service, our providers or the law. When we do, we will update the "Last updated" date above. If changes are material, we will notify you in the app or by email before they take effect and, where required, ask for your consent again.
14. Contact us and grievance redressal
If you have questions, requests or complaints about this Policy or your personal data, please contact:
Parla — Privacy & Grievance Officer Email: privacy@poelys.com Website: https://parla.poelys.com
For general help with the app, email support@poelys.com.
We will acknowledge grievances promptly and aim to resolve them within 30 days, or within any shorter period required by law.