Privacy Policy

Last Updated: 2026-10-21 · PitchGlobal (the "Service") · Effective: 2026-10-21 (corrective disclosures and safeguards); 2026-11-05 23:59 PST (2026-11-06 16:59 Japan/Korea time) for the revised retention and deletion terms marked "[Effective from …]" in Sections 7 and 13 only.

What changed in this version. This version corrects our previous Policy (dated 2026-10-17), which misstated provider model training, account-linked analysis, the payment data we receive, and deletion and retention. The corrections and the following safeguards apply from 2026-10-21: new requests to Deepgram opt out of Deepgram's model-improvement program, and our product-improvement analysis uses aggregated statistics only. Clauses marked "[Effective from …]" describe revised retention and deletion terms that apply prospectively from that time, subject to applicable law. Until then, where our 2026-10-17 Policy gave you a stronger retention or deletion commitment, we continue to apply it automatically, without any request from you (for example, deleting an account creates a tracked Operator task to delete that account's support emails, and retained billing records keep a deadline no later than seven years after the last billing activity), except for copies we cannot erase on demand: database backup copies and provider-held logs (for example, OpenAI abuse-monitoring logs of up to 30 days) expire on their own schedules rather than immediately. This update does not retroactively authorize past processing and does not limit your existing rights.

We are committed to protecting your privacy. This Policy explains how we collect, use, store, and share your personal information when you use the Service, and the rights available to you.

1. Data Controller

The Service is operated by Dayuan "Frank" Zeng, an individual sole proprietor based in California, United States (the "Operator"), who is responsible for your personal information. Privacy contact: support@kivelu.com. The Operator's postal address will be provided without delay upon request to support@kivelu.com.

2. Personal Information We Collect

Information you provide directly:

Account info: your email address (used for password-less sign-in codes and links) and an internal account identifier (user ID). The iOS app stores your user ID in local app preferences and, when available, passes it to Apple as the App Store "appAccountToken" so purchases can be associated with your account.
Personal-library entries: expressions, meanings, examples, context and sentence-pattern slots you enter are stored with your account until you delete the entry or your account.
Voice input and transcripts of your practice sessions, used to correct errors and build your review queue. Voice audio is sent to providers during real-time conversation or after you submit a recorded utterance (Section 5); we currently do not store audio files on our own servers. Transcripts are stored with your account. If we start storing audio recordings, we will update this Policy before doing so.
Payment info for purchases in the iOS app: purchases are sold and billed by Apple (In-App Purchase). We receive from Apple the purchased product, transaction identifiers (including the original transaction ID), subscription period and expiry, and subscription status (active, cancelled, refunded or revoked).
Payment info for purchases on our website (when web checkout is offered): we do not receive full card numbers; for website purchases, Waffo webhooks may include buyer email, product and subscription information, payment references, amounts, currency, tax and billing details, and limited payment-method information such as method type and last four digits.
Feedback and support communications you send us: the feedback widget stores category, message, page path without query strings or fragments, a browser user-agent string of up to 300 characters, timestamps, review status, replies and reward decisions; signed-in submissions are also linked to your user ID and email address, while the current signed-out widget does not request an email address. Feedback is reviewed by the Operator; a reply may be shown to you, and accepted feedback may earn bonus practice time. Support emails are routed via Cloudflare.
Recording consent records: the version and language of the recording notice, and the time consent was granted or withdrawn.

Information collected automatically: usage data (practice sessions, feature usage), request logs, and basic device/network data needed to operate the Service.

3. How We Use Your Information

Delivering the Service: transcription, correction, review queues (contract performance).
Billing and subscription management via our payment processor (contract performance).
Personalizing your practice: we use practice outcomes, recorded mistakes, personal-library entries and saved difficulty settings to select review items and adapt later practice (contract performance).
Security, fraud prevention, and abuse prevention (legitimate interests).
Service notifications such as billing and security notices (legitimate interests).
Product improvement: our Operator-only dashboard shows aggregated statistics only (counts of mistakes by type and by scenario, numbers of sessions, completion rate and total practice minutes). For this purpose it does not read or display transcripts and does not show results for individual users. We do not build a profile to advertise to you, and we do not use third-party analytics or advertising cookies (legitimate interests). You may object to this use by contacting support@kivelu.com.
Service troubleshooting and support (not product improvement): the same dashboard lists recently completed sessions whose automated feedback is missing or incomplete, showing practice mode, duration, start time and feedback status, and using an internal session ID to locate the record, without transcripts or account details, so we can repair them; it also shows feedback you submit, including whether it was sent while signed in, so we can reply and review rewards. These are individual operational records, not anonymized analytics (contract performance and legitimate interests).
Legal compliance (legal obligation).

We do not sell your personal information. We do not use your voice audio or transcripts to train AI models, and our requests to OpenAI and Deepgram are not used to train their models (see Section 5, which also describes provider retention).

4. Payment Processing

Purchases in the iOS app are sold and billed by Apple (In-App Purchase) under the App Store terms. We receive from Apple (signed transaction data and App Store Server Notifications) the purchased product, transaction identifiers (including the original transaction ID), subscription period and expiry, and subscription status (active, cancelled, refunded or revoked), so we can match purchases to your account. We never receive card numbers or other payment-method details for App Store purchases.

Payments made on our website (when web checkout is offered) are processed by Waffo Pancake as merchant of record; Waffo Pancake is not involved in in-app purchases in the iOS app. Your payment card data is entered on Waffo Pancake's hosted checkout, processed by Waffo Pancake as the PCI-DSS certified processor, and is not stored on our servers. We do not receive full card numbers; for website purchases, Waffo webhooks may include buyer email, product and subscription information, payment references, amounts, currency, tax and billing details, and limited payment-method information such as method type and last four digits.

5. Service Providers (Processors)

We entrust personal information to the following providers, only to the extent needed to operate the Service. They process it on our behalf under their respective terms and are not permitted to use it for advertising. Where we describe a provider's retention, it is stated below; otherwise data is held by the provider as needed to perform its service:

OpenAI (United States): real-time voice conversation, speech-to-text transcription, written feedback and corrections, and synthesized voice output. Data: voice audio, transcripts, practice text. According to OpenAI's published API data-controls documentation, data sent to the OpenAI API is not used to train OpenAI's models unless the customer opts in; OpenAI may retain API inputs and outputs (which can include audio and transcripts) in abuse-monitoring logs for up to 30 days by default, and longer where required by law.
Deepgram (United States): verbatim speech-to-text transcription and word timings for practice feedback. Data: voice audio. Every request we send to Deepgram opts out of Deepgram's Model Improvement Program (mip_opt_out=true): according to Deepgram's published documentation, opted-out audio and transcripts are not used to train Deepgram's models and are not retained after the response is returned (Deepgram still records request metadata and usage logs). Requests sent before this safeguard was deployed on 2026-10-21 did not set this opt-out and may have been included in Deepgram's model-improvement program under Deepgram's terms.
Vercel (United States; application servers in the Washington, D.C. area): website and application hosting. Data: all data handled by the Service in transit and request logs.
Neon (managed PostgreSQL database): storage of account, subscription status, consent, and practice records.
Resend (United States): delivery of sign-in code and service emails. Data: email address, email content.
Cloudflare (United States): routing of emails sent to our support address. Data: your email address and message content.
Waffo Pancake: web checkout and payment processing as merchant of record for website purchases only (not used for in-app purchases in the iOS app) (see Section 4). Data: email address, payment and billing details you enter at checkout.
Apple (United States): in-app purchases in the iOS app are sold and billed by Apple under the App Store terms. Our internal user ID is stored in the iOS app's local preferences and, when available, sent to Apple as the App Store "appAccountToken" with purchases so they can be associated with your account. We receive from Apple the purchased product, transaction identifiers (including the original transaction ID), and subscription status and period.

6. Cookies & Similar Technologies

We use a login-session cookie, first-party language and time-zone preference cookies, and session storage to prevent repeated refreshes; sign-in links carry tokens in their URLs. We do not use advertising or third-party analytics cookies.

7. Data Retention

Voice audio: not currently stored on our servers after processing (see Section 2); processor retention is described in Section 5.
[Effective from 2026-11-05 23:59 PST] Feedback linked to your account is deleted with that account; unlinked feedback has no automatic deletion schedule, and account deletion does not automatically delete emails held in our support mailbox.
Recording consent records: kept while your account exists, and deleted with the account.
Text records (transcripts, error records, personal-library entries): kept while your account is active, so the Service can re-test you on past mistakes and show your saved expressions; erased when your account is deleted.
[Effective from 2026-11-05 23:59 PST] Account deletion: deleting your account immediately removes your live account and linked practice records; any failed stored-audio deletions are queued for retry, while provider-held data and backup copies are handled separately.
[Effective from 2026-11-05 23:59 PST] Transaction records: by default, minimal billing records are retained for seven years after account deletion, including a keyed account pseudonym and payment-platform reference but no direct user ID or email address.
[Effective from 2026-11-05 23:59 PST] Application cleanup is scheduled daily to remove sign-in-code and usage-metering records older than 90 days and authentication-session records 90 days after they were created; hosting request logs have separate provider-controlled retention.
Daily usage and cost totals containing no user identifiers are retained without a scheduled deletion date.

8. Your Data Rights

You can delete your whole account from the account page or by emailing support@kivelu.com. You may also request access, correction, export, restriction, or objection by emailing support@kivelu.com; we respond within 30 calendar days. You may lodge a complaint with your local data protection authority.

9. International Data Transfers

The Operator is located in the United States, and the providers listed in Section 5 process data outside your country, mainly in the United States. Transfers happen when you use the relevant feature (for example, voice audio is sent to OpenAI during real-time conversation, or to Deepgram after you submit a recorded utterance), over encrypted connections, and the data is kept for the periods in Section 7 or as needed by the provider to perform its service. The United States has no comprehensive federal data-protection law equivalent to Japan's Act on the Protection of Personal Information or Korea's Personal Information Protection Act; information about foreign systems is published by Japan's Personal Information Protection Commission. We rely on providers that commit under their terms to protect personal information; provider retention is described in Section 5, and our requests to OpenAI and Deepgram are not used to train their models. Transfers to these providers are necessary to provide the Service; if you do not want your information transferred, you can stop using the relevant feature (for example, by withdrawing recording consent) or delete your account, in which case we cannot provide that part of the Service.

10. Children's Privacy

The Service is intended for users aged 18 and above. We do not knowingly collect information from children below that age.

11. Security

Data is encrypted in transit (TLS). We do not use passwords; sign-in uses emailed one-time codes or links, whose server-side verifiers are stored as hashes. Access to production data is limited to the Operator. Before storing data abroad (mainly in the United States), we review the data-protection system of that country. On request, we will explain our security measures in more detail.

12. Additional Information for Users in Japan

The business operator handling your personal information is Dayuan "Frank" Zeng (an individual; no representative director). The address will be provided without delay upon request to support@kivelu.com. Requests for notification of purposes of use, disclosure (including records of provision to third parties), correction, addition, deletion, suspension of use, or suspension of provision of your retained personal data can be sent to support@kivelu.com from your registered email address; we may ask you to confirm your identity and do not charge a fee. Complaints about our handling of personal information: support@kivelu.com. We are not a member of an accredited personal information protection organization.

13. Additional Information for Users in Korea

Privacy officer (개인정보 보호책임자): Dayuan "Frank" Zeng, support@kivelu.com. Purposes, items, and retention periods are described in Sections 2, 3, and 7; entrusted processors and overseas transfers (recipient, country, timing and method, items, purpose, retention, and how to refuse) are described in Sections 5 and 9. We do not provide personal information to third parties other than these processors, except where required by law. [Effective from 2026-11-05 23:59 PST] Applicable records are deleted from the live application database subject to Section 7's retention exceptions; backup copies are not necessarily erased at the same time. You may exercise your rights (access, correction, deletion, suspension of processing, withdrawal of consent) by emailing support@kivelu.com. We do not currently meet the thresholds that require designating a domestic representative in Korea under Article 31-2 of the Personal Information Protection Act; we will update this Policy if that changes. You may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr).

14. Policy Changes & Contact

Material changes to this Policy will be announced in the Service or by email at least 15 days before taking effect. This version was announced in the Service on 2026-10-21; the clauses marked "[Effective from …]" take effect at 2026-11-05 23:59 PST, more than 15 days after that announcement. Questions or requests: support@kivelu.com.