Last Updated: April 7, 2026
At B4Speak("Company," "we," "us," or "our"), protecting the privacy and security of the educational institutions, administrators, teachers, and students who use our platform is our highest priority. This Policy explains how we collect, use, disclose, and safeguard Student Data and other Personal Information when your school limits the use of our services (the "Platform").
Our infrastructure is designed to comply with comprehensive global educational privacy standards, including the Family Educational Rights and Privacy Act (FERPA), the General Data Protection Regulation (GDPR) for educational entities, and the Children’s Online Privacy Protection Act (COPPA). We act purely as a data processor and service provider for School Authorities.
We strictly limit the data we collect solely to what is necessary for providing educational services:
All Student Data collected through the b4speak Platform remains the exclusive property of the contracting Educational Institution or Local Education Agency (LEA). We do not claim ownership of Student Data, and School Authorities retain full control over adding, modifying, or deleting records via the Admin Dashboards.
We unconditionally prohibit the use of Student Data for targeted advertising, marketing, or profiling for non-educational purposes. We never sell, rent, or trade student profiles or institutional data to any third-party brokers under any circumstances.
AI speaking practice, AI conversation and automated feedback are processed by third-party AI providers acting as our sub-processors: OpenAI (speech transcription, conversation and feedback) and Google (Gemini API) (feedback and content generation).
Only the data needed for the feature is sent: the student's voice recordings, their transcripts, written texts and English level (CEFR). Names, email addresses and school details are not sent. Providers process this data only on our behalf to deliver the feature, under their API terms, and may not use it for advertising.
Before a student first uses AI practice, the app explains this and asks for permission. Students and parents can withdraw this permission at any time in the app (Progress → Consents and data); AI practice is then turned off and stored audio is scheduled for deletion.
Our databases are safeguarded by enterprise-grade measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, regular third-party penetration testing, and role-based access control (RBAC). Data centers holding sensitive educational material are physically audited, SOC 2 compliant, and geographically aligned with institutional legal requirements (e.g., maintaining EU data inside the EU).
Upon termination of a School Contract, or directly upon a localized administrative request, all associated Student Data and curricular configurations will be permanently and securely wiped from our live environments within thirty (30) days. Authorized administrators may request a full cryptographic export of their historical metrics prior to deletion.
For legal inquiries, data processing addendums (DPA), or audits, please contact our privacy desk directly at: