Privacy Policy

At YoYo Technologies Ltd (“YoYo”, “we”, “us”, or “our”), we are committed to protecting the privacy of students and schools using our language learning platform. This Privacy Policy explains how we collect, use, store, and protect student data when our app is used as part of a school-led programme or pilot.

Our mission is to provide a safe and effective speaking practice tool that supports students’ language development without compromising their personal privacy. This policy applies to student users accessing the app using a YoYo-issued User_ID and one-time activation code provided via their school.

YoYo Technologies Ltd and the school each act as independent data controllers in respect of their own processing activities, within the meaning of UK GDPR. This is not a joint controller arrangement under Article 26 UK GDPR, and neither party acts as a data processor on behalf of the other. The formal data sharing arrangements between the parties are set out in Schedule 1 (Data Sharing Agreement).

The School's Role

The school is a data controller in its own right. The school independently determines the purpose of sharing student data with YoYo (to support students' GCSE/MFL learning outcomes) and decides which students' data to provide. The school is responsible for:

• Providing accurate student information (first names, first initial of surname, and class groupings);
• Informing parents/guardians about the use of YoYo and the sharing of data;
• Assigning appropriate practice activities;
• Notifying YoYo of any student withdrawals or data deletion requests.

YoYo's Role as Controller

Once student data is received, YoYo independently determines the means and methods of processing within its platform, including system design, sub-processor selection, data retention, and technical and organisational security measures. YoYo is responsible for:

• All data processing activities and decisions within the YoYo platform;
• Data security and storage;
• Responding to data subject rights requests (in respect of data held by YoYo);
• Compliance with UK GDPR and data protection law.

Contact

YoYo Technologies Ltd
Data Protection Officer: Pratik Sampat
pratik@yoyospeak.com

We collect only the minimum data necessary to support learning and evaluate progress:

• Student first name and first initial of surname, provided by the school and stored in our UK teacher dashboard environment so that teachers can see named progress for their own classes;
• A pseudonymised User_ID generated by YoYo for each student. The student-facing app stores and uses only the User_ID plus scores and usage data, not student names or email addresses;
• Teacher email (to provide secure access to the Teacher Dashboard);
• Pronunciation scores;
• Usage data such as: number of practice sessions completed, scores over time, engagement metrics (e.g. time spent on tasks), and device/browser metadata for performance optimisation.

We do not collect or store:

• Student email addresses or contact details of any kind;
• Voice recordings;
• Additional personal identifiers such as home address, date of birth, phone numbers, social profiles, bios, or images;
• Location data or behavioural profiling.

Voice Processing

When students practise pronunciation, their voice is temporarily processed in real-time to generate a score. This audio is:

• Processed immediately by SpeechSuper on UK-based servers (Alibaba Cloud, London) and never stored;
• Accompanied only by the pseudonymised User_ID and the reference phrase text – no student names, email addresses, or other identifiable information;
• Deleted from memory as soon as the score is generated (typically within seconds);
• Never used to create voiceprints or biometric identifiers.

We process this data to:

• Track student progress and learning outcomes;
• Provide feedback to teachers during pilot programmes;
• Improve the functionality and educational effectiveness of our app;
• Ensure the app performs reliably across devices.

All data is used exclusively to support educational aims and never for marketing, profiling, or commercial resale.

YoYo processes student data under the legal basis of Legitimate Interests (Article 6(1)(f) UK GDPR). The school relies on its own legal basis for disclosing student personal data to YoYo and is responsible for determining and documenting this basis in accordance with its own data protection policies.

YoYo's Legitimate Interests Assessment: We have conducted a thorough assessment balancing our interests against children's rights and freedoms. Our conclusion:

Purpose: Supporting students' language learning progress and providing teachers with insights to improve educational outcomes.

Necessity: The data collected (pronunciation scores, usage metrics) is the minimum necessary to provide meaningful feedback and track progress.

Balance: Children's interests are protected through:

• No storage of voice recordings;
• Minimal personal data — students are identified only by first name and surname initial, with no email addresses or contact details;
• Access to identifiable data restricted to the student's own school staff and, where required, YoYo technicians — students are identified within the app only by their pseudonymised User_ID and their name is never displayed to them or to other students;
• No social features or peer interaction;
• School-controlled access;
• Transparent processing;
• Easy data deletion.

A full copy of our Legitimate Interests Assessment is available on request to schools.

All student data is retained for one full academic year from the point of initial login, unless otherwise requested by the school. If the school chooses not to continue after the pilot, all data will be deleted within 14 days of the pilot end date, unless the school requests otherwise.

• Schools may request the deletion of individual or entire class datasets at any time.
• YoYo does not provide students or parents with direct access to their data; any such requests should be submitted via the school.
• Upon request, we will permanently delete all relevant records within 14 days.

We work only with GDPR-compliant third parties. All processing takes place within the United Kingdom.

• Web Hosting: Hostinger (UK-based servers);
• Database: Supabase (UK/EU regions, managed PostgreSQL).

Voice Processing: SpeechSuper

• Purpose: Real-time pronunciation analysis only;
• Processing Location: United Kingdom (Alibaba Cloud, London);
• Data Shared: Audio (immediately deleted after scoring), reference phrase text, and pseudonymised User_IDs only – no student names, emails, or identifiable information;
• Audio Retention: None – audio is deleted within seconds of processing;
• Operational Logs: SpeechSuper retains limited operational logs (timestamps, IP addresses, error logs) for 7 days on UK-based infrastructure for troubleshooting purposes only, after which they are automatically deleted. No audio, transcripts, scoring artefacts, or request IDs are retained;
• Secondary Use: No audio, metadata, or derived data from YoYo requests is used for model training, algorithm improvement, benchmarking, or any other secondary purpose;
• Safeguards: All data transmitted over HTTPS; AES-256 encryption at rest for retained logs; role-based access controls with audit logging; staff with production access undergo background checks; formal incident response plan with 72-hour breach notification. Alibaba Cloud London infrastructure is certified under the EU Cloud Code of Conduct (Verification-ID: 2020LVL02SCOPE013) and holds ISO 27001 certification;
• Sub-processor: Alibaba Cloud (Singapore) Private Limited, operating EU-certified infrastructure in London, UK;
• Change Notification: SpeechSuper has confirmed in writing that it will notify YoYo in advance of any changes to sub-processors, data retention practices, or processing locations.

All student data – including stored data (names, pseudonymised User_IDs, scores, and usage history) and transiently processed data (voice audio for pronunciation scoring) – is processed and stored exclusively within the United Kingdom.

There are no international data transfers.

YoYo's pronunciation scoring provider, SpeechSuper, processes voice data on UK-based servers (Alibaba Cloud, London). SpeechSuper has confirmed in writing that:

• All real-time audio processing for YoYo API requests occurs exclusively on UK-based servers, with no data routed to servers in any other country;
• Operational logs retained for 7 days are stored on UK-based infrastructure and do not leave the UK;
• YoYo will be notified in writing in advance of any change to the processing location or infrastructure that would result in data leaving UK infrastructure.

Additional safeguards applied to voice processing include pseudonymisation (only randomised User_IDs are sent, with no student names or identifiable information) and immediate deletion of audio after scoring.

YoYo is built to support a safe and closed learning environment:

• No open-ended input or free-text entry;
• No chat, messaging, avatars, or bios;
• No voice recordings stored;
• Only pre-approved school content is used;
• Students practise in isolation; there is no peer interaction;
• Students are identified within the app only by their pseudonymised User_ID — their name is never displayed to them or to other students;
• Teachers have full visibility of class-level engagement and progress.

As a data subject (or parent of a data subject), you may have the following rights under UK GDPR, exercisable via your school:

• Right to access data held about the student;
• Right to rectification of incorrect data;
• Right to erasure of data (upon request by the school);
• Right to object to processing based on legitimate interest. Parents/guardians may object to the processing of their child's data at any time by contacting the school or YoYo directly. We will cease processing and delete the student's data within 14 days;
• Right to lodge a complaint with the ICO (www.ico.org.uk).

For any questions about this policy or data protection concerns, please contact:

Pratik Sampat — pratik@yoyospeak.com
YoYo Technologies Ltd, United Kingdom