We record your voice and store transcripts so Dara can teach you, remember your progress, and improve over time. We use that data to train our own AI tutoring models. We do not sell your data to anyone. You can delete everything at any time by messaging us.
Contents
1. Who we are
Dara is an AI-powered English language tutor (the "Service"). Today the Service is primarily available as a Telegram bot and Mini App, with native mobile apps and a web interface in development. This policy applies to all of these channels. It explains what personal data we collect when you use the Service, how we use it, and the choices you have.
The data controller is Dara ("we", "us", "our"). You can reach us at hello@daratutor.app.
2. What we collect
When you use Dara, we collect the following categories of data:
2.1 Account data
- An account identifier (your Telegram user ID, first name and username when you access the Service through Telegram; an email or sign-up identifier when you access future web or mobile apps)
- Your chosen native (lesson) language and study language
- Your country, derived from your client locale or IP at the moment you open the Service
2.2 Lesson data
- Voice recordings of your side of the conversation, captured while you are on a call with Dara
- Transcripts of both your speech and Dara's responses
- Your progress through exercises, the mistakes you make, and which corrections Dara delivered
- A persistent "memory" Dara maintains about your strengths, weaknesses, interests, and recurring errors so she can teach you better over time
- Metadata about each lesson: duration, timestamps, level, topic
2.3 Payment data
- We do not store your full credit card details. Payments are processed by one of: Stripe (international card payments), YooKassa (card payments and local methods in Russia and CIS), or Telegram Payments / Telegram Stars (when paying inside the Telegram client). Each provider receives your card / payment-method information directly under their own privacy policy
- We store the subscription status, the amount paid, the period covered, the provider used, and a payment reference ID
2.4 Technical data
- Device type, operating system, and client version
- IP address (only at the moment you call a server endpoint — used for routing and abuse prevention, not stored long-term)
- Error logs and crash reports collected via our self-hosted error tracker (GlitchTip)
- Anonymous product analytics (which screens you open, which features you use)
3. How we use it
We process your data for the following purposes:
| Purpose | Legal basis (GDPR) |
|---|---|
| Delivering the lesson in real time — converting your speech to text, generating Dara's responses, generating Dara's voice | Performance of the contract |
| Remembering your progress, level, and weak points so subsequent lessons are personalized | Performance of the contract |
| Processing your subscription and managing refunds | Performance of the contract |
| Improving Dara — training and fine-tuning our own AI tutoring models (see Section 4 below) | Legitimate interest, with opt-out available |
| Sending you reminders, balance warnings, and product updates via the channel you signed up through (Telegram bot, email, or push) | Legitimate interest, with opt-out available |
| Detecting abuse, fraud, and policy violations | Legitimate interest |
| Complying with legal obligations (tax, accounting, regulators) | Legal obligation |
4. Training our models
This is important enough to spell out clearly:
- We do use the voice recordings, transcripts, and lesson data described in Section 2.2 to train, fine-tune, and evaluate our own AI tutoring models. This is what lets Dara catch the kind of mistakes real learners make, understand accented English, and get better over time.
- Before any data is used for training, we remove direct identifiers (your account ID, name, username, email) and aggregate it. Voice clips and transcripts may still contain personal context you mentioned during a lesson (your job, your family, where you live); we treat this data confidentially and never publish it.
- We do not sell, license, or otherwise share your raw voice recordings, transcripts, or any personally-identifiable training data with third parties.
- We do not use your data to train models for third parties.
- You can opt out of having your data used for model improvement at any time by emailing hello@daratutor.app. Opting out does not affect your ability to use the Service.
- If you delete your account (Section 7), your data is removed from future training runs. Data already incorporated into a deployed model cannot be retroactively removed from that model, but it is not re-used in subsequent training cycles.
5. Who we share data with
We use a small number of trusted infrastructure providers ("processors") to operate the Service. They process data on our behalf, under contract, only for the purposes described below, and cannot use it for their own purposes:
| Provider | What they receive | Purpose |
|---|---|---|
| Telegram (Telegram FZ-LLC) | Telegram user data; chat messages; payment information when you pay with Stars | Hosting the bot and Mini App; payments |
| Stripe, Inc. | Card details, billing address, payment metadata | Processing international card payments |
| NKO YooMoney LLC (YooKassa) | Card details, billing address, payment metadata | Processing card payments and local payment methods in Russia and CIS |
| Soniox, Inc. | Streaming audio from your call (not stored by them) | Speech-to-text transcription |
| Google LLC (Google Cloud / Vertex AI / Gemini) | Transcript text + lesson context | Generating Dara's responses (LLM) |
| Cartesia, Inc. | Text of Dara's responses | Generating Dara's voice (text-to-speech) |
| Supabase, Inc. | Account and lesson data at rest | Database and file storage |
| DigitalOcean, LLC | All server traffic and data in transit | Server hosting |
| GlitchTip (self-hosted) | Error logs, stack traces, occasional payload snippets | Debugging and crash monitoring |
We do not sell your personal data. We do not share it with advertisers, data brokers, or for any third-party marketing.
We may disclose data if required by law, court order, or to protect the rights, property, or safety of Dara, our users, or others.
6. Business transfers
If Dara is involved in a merger, acquisition, reorganization, sale of all or substantially all of its assets, financing event, or in the unlikely event of bankruptcy or insolvency, your personal information may be transferred to the successor entity as part of that transaction. This is standard practice — your data is part of what makes Dara what it is, and it travels with the company if the company changes hands.
This is not the same as selling your data to a third party (see Section 5 — we don't do that). In a business transfer, the buyer becomes the new operator of the same service, bound by the commitments in this Privacy Policy.
Specifically, if a business transfer happens:
- The successor entity automatically inherits all of our obligations under this Privacy Policy, including the limits on how your data can be used (for example, the prohibition on selling it to third parties for marketing).
- If the successor wants to use your data for any new purpose not described in this Policy, they must give you advance notice and a meaningful opportunity to opt out before any such use begins.
- We will notify you of the change in ownership through the Service (Telegram chat, email, or in-app notification depending on the channel you use) and on this site at least 30 days before the transfer completes (where legally possible), so you have time to delete your account beforehand if you prefer not to be part of the transition.
- Any voice recordings, transcripts, and trained models built on your data continue to be governed by the protections in Sections 4 and 5.
7. Retention
We keep your data for as long as your account is active. Specifically:
- Account data, lesson memory, transcripts and voice recordings — kept indefinitely while your account is active, so Dara can remember you, improve over time, and rebuild any feature using historical data later.
- Payment records — at least 7 years, where required by tax and accounting law.
- Error and analytics logs — 90 days.
We do not auto-delete your data on a schedule. You are in control: at any time you can ask us to delete your account and the associated data, or to delete a specific subset (a particular lesson, recording, or transcript). See Section 9 (Your rights) for how to request this. We action deletion requests within 30 days, except for data we are required to keep by law (e.g. payment records).
8. Cookies and tracking
This marketing site, the payment checkout, the Telegram Mini App, and our future web and mobile apps use a small number of cookies and similar technologies:
- Strictly necessary cookies — set by Stripe or YooKassa when you start a checkout, to maintain the secure payment session and prevent fraud. Required for payments to work.
- Session storage — when you open the Mini App or a web/mobile app, your authentication token is stored in in-app session storage so you don't need to re-authenticate inside one lesson. Cleared when you close the app.
- Anonymous product analytics — we count page visits and which sections of this site or app you see, in an anonymized form, so we can improve the product. We do not use cross-site tracking, behavioral advertising cookies, or third-party ad pixels (no Facebook Pixel, no Google Ads, no TikTok pixel, no AdRoll).
Do Not Track. Some browsers transmit a "Do Not Track" (DNT) signal. There is currently no industry consensus on how to honor this signal, and we do not change our behavior based on it. We do not engage in cross-site tracking regardless.
9. Your rights
If you are in the EU/EEA, the UK, or another jurisdiction with similar laws, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectify — ask us to correct inaccurate data
- Delete — ask us to delete your data ("right to be forgotten")
- Restrict — limit how we process your data
- Object — object to processing based on legitimate interest, including training use
- Portability — receive your data in a portable format
- Withdraw consent — where we rely on consent, you can withdraw it at any time
- Complain — lodge a complaint with your local data protection authority
To exercise any of these rights, email hello@daratutor.app. We respond within 30 days.
10. California Privacy Rights (CCPA / CPRA)
If you are a California resident, the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA") gives you the following rights:
- Right to know — what categories of personal information we collect about you, the sources, the business purposes, and the third parties we share it with. Sections 2 and 5 above already disclose this.
- Right to access — request a copy of the specific pieces of personal information we hold about you.
- Right to delete — request deletion of your personal information, subject to certain legal exceptions (e.g. transaction records we must keep for tax purposes).
- Right to correct — request correction of inaccurate personal information.
- Right to opt out of sale or sharing — not applicable. We do not sell personal information, and we do not share it for cross-context behavioral advertising.
- Right to limit use of sensitive personal information — voice recordings qualify as sensitive personal information. We use them only to provide the Service and to train our own tutoring models (as described in Section 4); you can opt out of the training use at any time by emailing us.
- Right to non-discrimination — we will not deny service, charge different prices, or provide a lower quality of service because you exercised any of these rights.
To exercise a California right, email hello@daratutor.app from the address associated with your account or include your account identifier (Telegram username, email, etc.) so we can verify your identity. Authorized agents may submit requests on your behalf with written authorization.
In the last 12 months, we have not sold personal information, and not shared personal information for cross-context behavioral advertising.
11. AI processing, human review, and voice protection
Dara is an AI service. Some disclosures here are specific to that, and worth spelling out.
11.1 Voice as elevated-protection data
Your voice carries more than just words — it can reveal your accent, mood, age, and other personal characteristics. Under GDPR and similar regimes, voice processed in this way is treated with extra care. We apply the following safeguards to all voice data, regardless of where you live:
- Access to raw audio inside our team is restricted to a small number of authorized engineers and requires multi-factor authentication.
- Voice data is never combined with advertising profiles.
- Voice data is never shared with data brokers, analytics partners, or any third party outside the technical subprocessors listed in Section 5.
11.2 We do not clone or synthesize your voice
We do not use your voice recordings to train, generate, or operate a synthetic voice that sounds like you. Dara's voice is a single fixed voice produced by our text-to-speech provider (see Section 5) — it is not derived from your voice and does not get personalized to sound like any user. Voice cloning is not part of our Service.
11.3 Automated processing and human review
Because Dara is an AI tutor, almost everything she does is automated — she chooses what to ask next, judges whether your answer was correct, picks the next exercise, and updates her memory of your progress. This is required for the Service to work; you cannot meaningfully use Dara without consenting to this automated processing (GDPR Art. 22(2)(a) — necessary for the contract).
None of Dara's automated decisions produce legal effects on you or significantly affect you in legally meaningful ways. She does not assign certificates, qualifications, or grades that carry weight outside our Service.
If you ever disagree with something Dara did — a correction that you believe is wrong, a level she assigned, an exercise she chose — you can request a human review by emailing hello@daratutor.app. A member of our team will look at the relevant lesson and respond.
11.4 Dara can be wrong
Dara is an AI; her responses are generated automatically. Despite our care, she may occasionally produce incorrect, outdated, or surprising answers. Do not rely on Dara as a substitute for professional advice (educational, legal, medical, financial, or otherwise).
11.5 Content moderation
To enforce the rules in our Terms of Service and to keep the Service safe, we reserve the right to review specific voice recordings, transcripts, or other content when there is a credible signal of misuse (for example, repeated attempts to elicit prohibited content, or automated traffic suggesting abuse). These reviews are targeted, not routine, and we do not screen normal lessons.
11.6 EU AI Act posture
Under the EU AI Act, Dara is a general-purpose interactive AI system in the limited-risk category. The Service is not used for biometric identification, social scoring, employment or credit decisions, or any of the prohibited or high-risk practices listed in Articles 5 and 6 of the AI Act. We comply with the Act's transparency obligations: you are notified up front that you are interacting with an AI (this Policy is one such notice), and you can always ask to speak with a human at hello@daratutor.app.
12. Security
We take reasonable measures to protect your data:
- All data in transit is encrypted with TLS 1.2+
- Data at rest is encrypted on disk by our infrastructure providers
- Access to production systems is restricted to a small number of authorized personnel and requires multi-factor authentication
- Payment data is handled by Stripe, YooKassa and Telegram under their own PCI-compliant infrastructure — we never see your raw card number
No system is 100% secure. If we become aware of a personal data breach, we will notify affected users and relevant authorities within 72 hours, where required by law.
13. Children
Dara is not directed at children under 13. We do not knowingly collect personal data — and specifically, do not knowingly collect voice recordings — from children under 13.
You are strictly prohibited from using the Service to capture, transmit, or otherwise make available to Dara the voice of any child under 13, including a child who is not the account holder (for example, a child speaking in the background while you are on a call with Dara). If we detect or are notified that such data has been collected, we will delete it without prior notice.
Users between 13 and 18 (or the age of majority in their country) should obtain a parent or guardian's permission before using the Service. If you are a parent or guardian and believe a child has provided us with personal data without your consent, please contact hello@daratutor.app and we will delete the data.
14. International transfers
Dara is operated from servers in the European Union. Our processors may operate in other jurisdictions, including the United States. When personal data is transferred outside your home country, we rely on the safeguards required by applicable law (such as the European Commission's Standard Contractual Clauses) to ensure your data is protected.
15. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the Service before the change takes effect, and update the "Last updated" date at the top of this page. Your continued use of the Service after the change indicates your acceptance of the new policy.
16. Contact
Questions or requests about this Privacy Policy:
- Email — hello@daratutor.app
- Telegram — @DaraTutorBot