Privacy Policy

This Privacy Policy explains how Tukera ("we", "us", "our") collects, uses, stores, shares, and protects personal data when you use our website, applications, and related services (the "Service"). Tukera is an AI-powered Chinese learning platform offering conversation practice, adaptive exercises, flashcards, speech scoring, writing evaluation, courses, and related tools.

By using the Service you acknowledge the practices described here. This Policy should be read together with our Terms of Service.

We collect the minimum data needed to operate the Service:

• Account data — email address, name, password (stored only as a salted hash), interface-language preference, timezone, and profile settings you choose to provide;
• Learning data — courses, lessons, practice sessions, answers, scores, flashcards, vocabulary items, review history, and progress statistics generated as you learn;
• Voice and audio data — recordings you submit for speech transcription and pronunciation scoring, and the transcripts and scores produced from them;
• AI interaction data — the messages, prompts, and text you enter in AI chat, practice, and writing features, and the AI responses returned to you;
• Payment data — subscription tier, billing history, and transaction status. Card and payment details are handled directly by our payment processor (Creem); we do not store full card numbers;
• Usage & device data — log data such as IP address, browser type, device identifiers, pages visited, feature usage, crash diagnostics, and approximate locale information;
• Communications — support requests, feedback, and survey responses you send us.

We use personal data only for these purposes:

• Providing the Service — operating accounts, generating and scoring exercises, powering spaced-repetition review, and synchronizing progress across devices;
• Personalization — adapting content difficulty, recommendations, weak-point review, and interface language;
• AI processing — sending your input to AI and speech providers to return translations, explanations, transcriptions, scores, and generated learning content;
• Billing — processing subscriptions, quota tracking, invoicing, and fraud prevention;
• Product improvement — analyzing aggregated usage to fix bugs, evaluate feature quality, and improve AI output (using de-identified or aggregated data where practicable);
• Safety & compliance — enforcing our Terms, detecting abuse, securing accounts, and meeting legal obligations;
• Communications — sending service notices, security alerts, and (where enabled) learning reminders you can turn off in settings.

To deliver AI features, relevant parts of your input are processed by third-party providers acting as our subprocessors, including cloud hosting, database, object storage, payment, email, speech synthesis and recognition, and large-language-model providers.

We share with each provider only the data needed for its function — for example, your text or audio input to speech/AI providers to produce transcriptions, scores, audio, and learning content. Providers are bound by their own data-protection terms, and we select providers that maintain industry-standard security practices.

We do not sell your personal data, and we do not use your personal data to train third-party foundation models.

We use cookies and similar technologies for session authentication, security, remembering preferences (such as locale and theme), and understanding aggregate usage. Essential cookies are required for the Service to function; you can control non-essential cookies through your browser settings, though disabling them may affect functionality.

We retain personal data for as long as your account is active and as needed to provide the Service. We also retain limited records as required for billing, tax, security, and legal-compliance purposes.

When you delete your account, we delete or de-identify your personal data within a reasonable period, except where retention is required by law or for legitimate security/backup needs. Encrypted database backups are retained for a limited period (up to 30 days) before automatic expiry.

We do not sell personal data. We may share data only with:

• Subprocessors described in Section 4, strictly as needed to operate the Service;
• Your organization administrator, where you use the Service under an organizational/tenant account — they may see membership and learning-progress data for their organization;
• Professional advisers, and parties in a merger, acquisition, or asset sale, subject to confidentiality;
• Authorities or other parties where required by law, legal process, or to protect the rights, safety, and security of users, the Service, or the public.

Our infrastructure and subprocessors may process data in multiple countries, which may differ from your own. Where required, we rely on appropriate safeguards (such as contractual protections) for cross-border transfers consistent with GDPR and similar frameworks.

We apply industry-standard technical and organizational measures to protect personal data, including encryption in transit (TLS), hashed credential storage, access controls, audit logging, and regular encrypted backups.

No method of transmission or storage is 100% secure. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authorities where required by law.

Depending on your jurisdiction (including GDPR and CCPA/CPRA), you may have the right to:

• Access — request a copy of the personal data we hold about you;
• Correction — update or fix inaccurate account information in your profile settings;
• Deletion — delete your account and associated personal data via account settings or by contacting us;
• Export — request an export of your data in a portable format;
• Restriction & objection — ask us to limit or stop certain processing;
• Consent withdrawal — withdraw consent where processing is based on it, without affecting prior lawful processing;
• Complaint — lodge a complaint with your local data-protection authority.

You can exercise most rights directly in your account settings, or by emailing privacy@tukera.com. We may need to verify your identity before acting on a request.

The Service is not directed to children under 13 (or the minimum age of digital consent in your jurisdiction), and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this Policy from time to time. We will post the updated version here and revise the "Last Updated" date. For material changes, we will provide additional notice (for example, in-app or by email) where required. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

For privacy questions, requests, or concerns, contact us at privacy@tukera.com or through the in-app feedback center.