Privacy Policy

Version of 2026-10-13.

Who is responsible for your data

Controller: IE Evgeny Gorshtein (Lyubarov) / ინდ. მეწარმე ევგენი გორშტეინ(ლიუბაროვი), individual entrepreneur (Georgia), Varkhani village, Adigeni Municipality, 0300. E-mail: hello@repeta.me, phone: +995 599 043 526.

What data we process

• Voice. The audio of your line is sent for speech recognition and is not stored by us after processing — neither in the database nor in files. We do not use your voice to identify you. Whether a recording contains speech is checked in your browser, on your device; a recording without speech is not sent at all.
• Conversation text. The recognised text of your lines and the counterpart's answers — only for the conversation and for preparing the feedback. After the feedback the text of your lines is deleted (conversations without feedback — within a day at the latest).
• Feedback on mistakes. Sentences with mistakes, the corrected version and an explanation — to show the feedback, let you repeat the sentence and see your progress.
• Questionnaire answers. Language of explanations, level, form of address (female/male), difficult situation, interest in free conversation.
• E-mail — if you gave it: to send the feedback, a login link for another device, purchase and withdrawal confirmations.
• Consents. What you confirmed and when (age 18+, voice processing, the terms and the request to start immediately at payment, newsletters, cookies), the text version, the time and a hash of the IP address. When you withdraw a consent we mark it as withdrawn instead of erasing it, so that we can prove the consent existed and when it was withdrawn.
• Technical data. Account and device identifiers in cookies, a hash of the IP address, the traffic source (UTM tags). The IP address itself and browser data (User-Agent) are stored only with your consent to advertising cookies — for Meta (see below).
• Payment. Payment data is processed by Paddle. We receive only the e-mail, plan, amount, order number and payment status.
• Activity dates. On which days you had conversations and for how many minutes — to count the streak, the task of the day and badges (game mode) and to show your progress. Deleted together with the account.
• Feedback after a conversation (optional). A rating 1–5, what you liked and what got in the way, whether we may e-mail you with follow-up questions, the language and the situation. This is private product research, not a public review: we do not publish it or use it in advertising. For a submitted form we give 10 conversation minutes once — whether the rating is good or bad.
• Invitations. Who invited whom through a personal link, when, whether reward minutes were granted or cancelled, and for which payment, plus a hash of the friend's IP address — so the bonus is not given from the same network as the inviter's.

Purposes and legal bases

• Providing the service: conversation, feedback, limits, account, purchase and withdrawal confirmations — performance of the contract (Art. 6(1)(b) GDPR).
• Voice processing — your separate consent (Art. 6(1)(a)). You can withdraw it in the account; text mode remains available.
• Abuse prevention (limits on free conversations) and keeping proof of consents — legitimate interest (Art. 6(1)(f)).
• Feedback after a conversation — to improve the trainer, legitimate interest (Art. 6(1)(f)); an e-mail to you with follow-up questions — only if you ticked the box (consent, Art. 6(1)(a)).
• Referral programme — performing its terms (Art. 6(1)(b)) and preventing abuse (legitimate interest, Art. 6(1)(f)).
• Payment records — legal obligation (Art. 6(1)(c)) to the extent required by law.
• Reminder and offer e-mails — your consent (Art. 6(1)(a)). We send them only after you confirm the address through the link in an e-mail from us (double opt-in), so nobody else's address ends up on the list. Unsubscribe in any e-mail.
• Analytics and advertising (Meta Pixel / Conversions API) — only with your consent to advertising cookies (Art. 6(1)(a)). The account identifier and e-mail are sent to Meta hashed — this is still personal data; the IP address, browser data (User-Agent) and Meta cookies (fbp/fbc) are sent in clear, as Meta requires for event matching. We keep this data only while the consent is valid; once it is withdrawn the data is deleted and no longer sent.
• Session recordings and heatmaps (Microsoft Clarity) — only with your cookie consent (Art. 6(1)(a)): how you scroll and where you tap, so we can find what is inconvenient. Typed text, your phrases in conversations, the feedback and the account area are masked and not sent to Microsoft. Microsoft Corporation (USA) processes this data as our processor.

Recipients

OpenAI (USA) — speech recognition, the counterpart's answers and their voice; Microsoft Azure (servers in Germany) — fallback voice synthesis; Hetzner (Germany) — server; Resend (USA) — sending e-mails. These are our processors, with data processing agreements in place. Transfers to the USA are based on the EU adequacy decision on the Data Privacy Framework and/or the EU standard contractual clauses.

Paddle is an independent seller (Merchant of Record) and is itself responsible for payment data, see Paddle's privacy policy.

Meta Platforms Ireland is jointly responsible with us for the collection and transmission of Pixel/Conversions API data (joint controllers, Art. 26 GDPR); Meta then processes the data under its own policy.

Retention by providers

OpenAI may retain request data (including audio) for up to 30 days for abuse monitoring and does not use it to train models.

How long we keep data

• Audio — not stored. Text of your lines — until the feedback is ready (no longer than a day).
• Feedback and progress — as long as the account exists.
• Inactive accounts are deleted after 24 months without use (no conversations and no active plan).
• IP address and User-Agent for Meta — while the advertising-cookie consent is valid.
• Feedback — texts for 24 months, then deleted (only the rating and the fact of the bonus remain, without text); immediately when the account is deleted.
• Invitations — 24 months (to check the reward limit and abuse), then deleted; when the account is deleted, the personal link stops working at once.
• Records of consents — also after the account is deleted, as long as they are needed to prove the consent in a dispute.
• Payment records — as long as tax law requires.

Age

The service is for persons aged 18 and over.

Do not use real data

Do not mention real data about your health, documents or other people in the conversation. This is practice — use made-up details.

Is providing data mandatory

Providing data is not mandatory, but the service does not work without it: without voice consent text mode is available; without an e-mail everything works except e-mails and logging in from another device.

Your rights

Rights (access, copy, rectification, erasure, restriction, portability, objection, withdrawal of consent) — write to hello@repeta.me; we reply within one month. You can delete your account immediately in the account settings. You may lodge a complaint with a supervisory authority (in Poland: UODO, Prezes Urzędu Ochrony Danych Osobowych).