Privacy Policy

We collect the following categories of information:

• Personal Data: Name, email address, username, age cohort (not raw date of birth), profile photo, encrypted password, language preferences, and educational progress.
• Voice and Audio Data: Voice and audio recordings you create when using speaking, pronunciation, dictation, or other voice-enabled features.
• Social Interaction Data: Posts (which may include pictures, videos, and audio), comments, likes, follows, private messages, and mentions.
• Technical Data: IP address, operating system, device model, time zone, app version, crash logs, and feature usage statistics.
• Payment Data: We do not store full card details. Payments are processed via PCI DSS-compliant providers (e.g., Stripe).

• Provide and personalise your learning experience
• Enable social and community features
• Track progress, generate reports, and display leaderboards
• Deliver support and troubleshoot issues
• Enhance security, detect fraud, and improve app stability
• Develop, train, evaluate, and improve our artificial-intelligence and machine-learning models (see Section 9)
• Send system alerts, reminders, and promotions (with consent)

We process your data based on:

• Contractual necessity (to deliver our services)
• Consent (e.g., marketing communications and, where required, use of your content for model training)
• Legitimate interests (e.g., improving the app, fraud prevention, and improving our models)
• Legal obligations (e.g., tax and compliance records)

We share personal data only when necessary:

• Service Providers: Hosting, analytics, payments, support tools, and AI/ML infrastructure or model providers (bound by Data Processing Agreements).
• Legal Requirements: Compliance with subpoenas, court orders, or to protect rights, users, or safety.
• Community Visibility: Content you post publicly is visible to others.
• We never sell personal data or your raw or original voice recordings, images, or videos for advertising purposes.

As a user, you have the following rights:

• Access, rectify, or erase your data
• Restrict or object to processing
• Withdraw consent (without affecting prior processing)
• Portability of your data
• Opt out of the use of your content for AI/ML model training (see Section 9)
• Opt out of "sale" or "sharing" (California CPRA)
• Limit the use of sensitive data (California CPRA)
• Appeal a decision (Virginia and other US state laws)
• Lodge complaints with a supervisory authority (e.g., EU Data Protection Authorities, UK ICO, Brazil ANPD, UAE Data Office)

To exercise your rights, contact privacy@malegado.com or use in-app settings. We may require identity verification.

We keep data only as long as needed for the purposes outlined or as required by law:

• Active accounts: data retained to maintain your learning history.
• Deleted accounts: personal data erased except for legal, fraud-prevention, or operational requirements.
• Training data: content already incorporated into a trained or de-identified model or dataset may not be retrievable or removable; see Section 9.
• Content shared publicly may remain unless removed by you before deletion.

• Malegado is for users aged 16 and older (or higher where required by law).
• Children aged 0–16 must have verifiable parental consent to use Malegado.
• We do not knowingly collect data from children under these ages without verifiable parental consent. If such data is collected inadvertently, we will delete it promptly. We do not use the voice recordings, images, or videos of children for model training.

We use cookies and similar tools:

• Essential Cookies: Authentication, security, and user preferences.
• Analytics Cookies: Anonymous usage and performance metrics.
• Do Not Sell/Share (US): California users can opt out of sale or sharing of data for analytics or personalised features.

You can adjust cookie settings via your browser or device.

We use content you provide—including voice and audio recordings, images, videos, and text—to develop, train, fine-tune, evaluate, and improve our artificial-intelligence and machine-learning models. These include, for example, speech-recognition (ASR), text-to-speech (TTS), pronunciation-assessment, translation, content-generation, and multimodal models that power the learning experience.

• Voice recordings: When you use speaking, pronunciation, dictation, or other voice features, your audio may be stored and used to train, fine-tune, and evaluate our speech and language models.
• Images and videos: Images and videos you upload (including to posts, profiles, or learning activities) may be used to train, fine-tune, and evaluate our computer-vision and multimodal models.
• Legal basis: We rely on your consent and/or our legitimate interest in improving the platform. Where a jurisdiction requires consent for this processing, we obtain it before using your content for training.
• De-identification: Wherever feasible, we anonymise, pseudonymise, or aggregate content before using it for training. Once data has been irreversibly anonymised, it may no longer be subject to certain data-subject rights.
• Opt-out: You can opt out of having your content used for model training at any time via in-app settings or by contacting privacy@malegado.com. Opting out does not affect models or datasets that were already trained before your request.
• Third-party AI providers: Where we use third-party AI or model providers, we contractually restrict their use of your data—in particular, we require that they do not use your content to train their own general-purpose models unless you have separately consented.
• No sale: We do not sell your raw or original voice recordings, images, or videos, and we do not use them for third-party advertising.

We employ technical and organisational measures:

• HTTPS/TLS encryption for data in transit
• Encrypted password storage
• Role-based access controls and staff training
• Firewalls and regular security audits

While no system is 100% secure, we continually enhance our safeguards.

Your data may be stored or processed in countries with different data-protection laws. We use safeguards such as:

• Standard Contractual Clauses (SCCs) for EU/UK transfers
• Adequacy decisions where available
• Transfer Impact Assessments (TIAs)
• PIPL security assessments for China
• LGPD contractual clauses for Brazil
• Appropriate safeguards under the UAE PDPL

All transfers are minimised and documented.

Our platform may contain links to external resources (e.g., YouTube, social media). We are not responsible for their privacy practices. Review their policies before engaging.

We may revise this Privacy Policy to reflect legal updates or improvements. We will notify you of material changes (e.g., via email or in-app). Continued use means you accept the updated terms.

If unresolved, you may contact your local regulator (e.g., EU DPA, UK ICO, ANPD Brazil, CPRA California Privacy Protection Agency, UAE Data Office).

• Data Protection Officer (DPO): privacy@malegado.com
• EU Representative: Available on request at privacy@malegado.com
• UK Representative: Available on request at privacy@malegado.com
• Operating Entity: Core Alpha Services FZ-LLC
• Registered Address: FDRK8541 Compass Building, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates