Privacy Policy

1. Scope of this Policy

This Policy applies to personal data we handle through:

• the iSpeak website (the landing page and its legal pages);
• the iSpeak Android application, including the APK file distributed from our website (the “App”); and
• any communication you have with us, such as emails or feedback.

It does not apply to third-party websites or services that we may link to. Please read their own privacy notices before using them.

2. Who We Are

iSpeak is a public speaking practice application developed by Allan Eduard Alibo Jr., Aprille Bermoy, John Laurence Salinas and Maverick J-Ceale Reapor as an academic thesis project of the Bachelor of Science in Computer Science program, STI College-General Santos, Inc. (the “Institution”). In this Policy, “we”, “us” and “our” refer to the iSpeak project team.

For purposes of the Data Privacy Act, the project team acts as the Personal Information Controller (the party that decides how and why your personal data is processed). The Institution is not a joint or separate controller of your personal data, and we have not designated a Data Protection Officer. Privacy questions and requests go to the project team at the email address below.

You can reach us at: alibo.356750@gensan.sti.edu.ph

3. Personal Data We Collect

We collect only what we need to provide the practice and feedback experience. Depending on how you use iSpeak, this may include:

Sensitive personal information

The Data Privacy Act treats information about a person’s age and education as sensitive personal information. We process your age and grade level only with consent and only for the purposes in this Policy. Apart from these, we do not intentionally collect sensitive personal information, such as information about your health, ethnic origin, religious or political beliefs, government-issued identifiers, or sexual life. We do not collect your precise location, contacts, photos or videos. Please avoid mentioning such information in your practice recordings, since everything you say while recording is recorded and transcribed.

Record in a place where other people are not speaking. If someone else’s voice is captured by accident, we process it only as part of your recording, and it is deleted together with it.

We do not use your voice to create a “voiceprint” or to identify you biometrically.

4. How We Use Your Personal Data

Following the Data Privacy Act’s principles of transparency, legitimate purpose and proportionality, we use personal data only for the purposes below, and for each we rely on a lawful basis.

Where the basis is consent and you are under 18, your parent or legal guardian gives it for you.

We will not use your personal data for a purpose that is incompatible with the ones above without informing you and, where required, obtaining your consent first.

5. Consent and Withdrawing It

Where we rely on consent, we ask for it clearly and separately before your first recording: from you if you are 18 or older, or from your parent or legal guardian if you are under 18. The App shows a consent screen the first time you record, before any audio is captured. Consent must be freely given, specific and informed, and it can be withdrawn at any time by emailing alibo.356750@gensan.sti.edu.ph and asking us to delete your data. Withdrawing consent does not affect processing done before you withdrew, and it may mean that some features (such as recording and feedback) can no longer be provided to you.

6. Voice Recordings and Automated Analysis

Because iSpeak works with your voice, we want to be especially clear about how it is handled:

• Recording starts only when you start a take and stops when you end it. The App does not listen in the background.
• Your recordings are sent over the internet to our own backend server, where they are analyzed to produce the feedback you see. The same server also handles signing in (authentication) and decides what each account may access (authorization). It runs on a virtual private server (VPS) that we rent from the Railway cloud platform. Your recordings and transcripts are not sent to any outside speech-recognition, transcription or AI service. The server is temporary: we will shut it down and delete its data when the thesis project concludes, as explained in “How Long We Keep Your Data”, unless the Institution asks us to continue the project.
• Feedback is practice guidance, not an official assessment. Automated analysis can be inaccurate, particularly with accents, background noise, code-switching between English and Filipino, or low-quality microphones. No decision that has a legal or similarly significant effect on you is made solely by automated means.
• Your feedback is adjusted to you: the App uses your age and grade level to set your level (Beginner, Intermediate or Advanced) and the targets your speech is measured against. If your age or grade level is wrong, you can ask us to correct it.
• The App does not currently let you delete recordings yourself. You can ask us at any time to take down your recordings, transcripts and analysis history by emailing alibo.356750@gensan.sti.edu.ph, and we will act on your request within the time stated in “Your Rights”.
• Recordings are never published, and we do not share them with other users.
• We do not use your recordings or transcripts to train or fine-tune speech-recognition or other machine-learning models.

7. Academic Research and Service Improvement

Because iSpeak is a thesis project, the team may analyze how the App is used in order to evaluate and report on its effectiveness. When we do this:

• results in the thesis, presentations and publications are reported only in aggregated or anonymized form that cannot reasonably identify you;
• the age, grade level and sex in your profile are used for research only to report statistics about users as a group (for example, how many users are in each grade level), and your sex is never used to analyze your speech or to change your feedback;
• we will not use your identifiable recordings or transcripts for research, or share them with our adviser or panel, unless you gave a separate, specific and optional consent for it;
• for participants under 18, we ask for both a parent’s or guardian’s consent and the student’s own agreement (assent);
• if we invite you to answer an evaluation survey about the App, answering is optional, and your answers are used only for the thesis;
• declining research participation does not affect your ability to use the App; and
• the research follows the rules of the Institution.

8. Sharing and Disclosure

We do not sell your personal data, and we do not use it for advertising or for any profiling beyond generating the speech feedback you ask for. We share it only in these limited situations:

• Our hosting provider (a personal information processor). The backend that analyzes your recordings, signs you in and controls access to your data is our own. It runs on a virtual private server that we rent from Railway, so your data is stored on Railway’s infrastructure. Railway only provides the server: it may process data only to host and run it, and is bound by its own data protection terms. Our backend does not send emails, and we do not use any outside speech-recognition, transcription or AI service.
• The project team, adviser and Institution. Limited to what is necessary to operate, supervise and evaluate the project, and, for identifiable recordings, only if you gave the separate consent described in “Academic Research and Service Improvement”.
• Legal and safety reasons. Where required by law, a court order or a lawful request from a government authority, or to protect the rights, safety and security of users, the public or us.
• With your direction. For example, if you ask us to send you a copy of your data.

The professionals who review our scripts, guided tasks and challenges can only add learning materials. Our backend’s access controls keep them out of the admin and user sides of our system, where your account, recordings, transcripts and results are kept, so they never see your personal data.

9. Storage Location and International Transfers

Your data is stored on a virtual private server that we rent from Railway, located in Singapore. This means your data may be processed outside the Philippines. As Section 21 of the Data Privacy Act requires, we remain responsible for personal data under our control even when a provider processes it for us, and we rely on our hosting provider’s contractual and technical safeguards to protect it. We will update this Policy before moving your data to a different provider or region. For users in the European Economic Area or United Kingdom, we rely on the safeguards in our hosting provider’s data processing terms, such as standard contractual clauses, where data is transferred to a country without an adequacy decision.

10. How Long We Keep Your Data

We keep personal data only as long as necessary for the purposes described above, then delete or anonymize it.

When the thesis project concludes or the App is discontinued, we will shut down the temporary server and delete or anonymize all remaining personal data, including backups, within thirty (30) days, and inform users beforehand where practicable. When you ask us to delete your data, we delete it from the live system within the response time in “Your Rights”, and from any backups within the same thirty (30) days. If the Institution decides to continue the project, we will update this Policy, tell you what changes, and ask for your consent again where the law requires it.

11. Security and Data Breaches

As required by Section 20 of the Data Privacy Act, we use reasonable and appropriate organizational, physical and technical measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These include:

• encrypting data in transit using HTTPS/TLS, and encrypting stored recordings at rest;
• having our backend check every request: that you are signed in (authentication), and that your account is allowed to access the data requested (authorization), so each account can reach only its own recordings and results;
• storing passwords only in hashed form, never in plain text;
• limiting access to personal data to team members who need it, under confidentiality obligations;
• keeping our backend’s software and dependencies up to date, and reviewing the security of our hosting provider; and
• keeping a procedure for handling security incidents.

No system is completely secure. If a personal data breach occurs that is likely to result in a real risk of serious harm to you, we will notify the National Privacy Commission and affected individuals within seventy-two (72) hours of knowledge of or reasonable belief in the breach, as required by the NPC’s rules on personal data breach management, and we will tell you what happened, what data was involved, what we are doing about it and what you can do to protect yourself.

12. Your Rights

Under Sections 16 to 18 of the Data Privacy Act and its Implementing Rules and Regulations, you have the right to:

• Be informed whether and how your personal data is processed (this Policy is part of that);
• Access your personal data and obtain a copy of it;
• Object to processing, including where it is based on consent or legitimate interests;
• Rectify inaccurate or incomplete data;
• Erase or block your data when it is incomplete, outdated, false, unlawfully obtained or no longer necessary, or when you withdraw consent;
• Data portability — obtain your data in a commonly used electronic format, such as your recordings as audio files and your feedback history as a spreadsheet;
• Claim compensation for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your data; and
• Lodge a complaint with the National Privacy Commission.

If you pass away or become incapacitated, your lawful heirs and assigns may exercise these rights on your behalf. A parent or guardian may exercise them for a user under 18.

How to use your rights

Email alibo.356750@gensan.sti.edu.ph with the subject line “Privacy Request” and tell us which right you wish to use. We may ask you to verify your identity before acting. We aim to respond within fifteen (15) days and in any case within thirty (30) days. These rights are free of charge, though they may be limited where the law allows or requires, for example to protect the rights of others.

Visitors from the EEA, UK and other regions

If the GDPR or similar laws apply to you, you also have the right to restrict processing, to object to processing based on legitimate interests, to withdraw consent at any time, and to complain to your local data protection authority. We do not “sell” or “share” personal information for cross-context behavioral advertising, as those terms are used in California privacy law.

13. Children and Minors

iSpeak is made for students aged 12 and above (the usual age of Grade 7 students in the Philippine K to 12 system), so many of our users are minors. The App is not intended for children under 12.

If you are under 18, a parent or legal guardian must give consent before you create an account (the App cannot be used without one), and we keep a record of that consent. Outside of testing, consent is given through a confirmation step in the App, which the user completes before the first recording. During supervised user acceptance testing (UAT) run by the project team, we instead collect a signed printed consent form in person, and keep that copy as the record of consent. A parent or guardian may contact us at any time to see the student’s data, to have it corrected or deleted, or to withdraw consent.

Because many users are young, the App has no ads, no public profiles, no leaderboards and no way for users to message each other. We never use students’ data for advertising, and we never publish recordings or show them to other users.

If we learn that we have collected personal data from a child under 12, or from a student under 18 without a parent’s or guardian’s consent, we will delete it promptly. If you believe this has happened, please contact us at alibo.356750@gensan.sti.edu.ph.

14. App Permissions

On Android, the App uses only these permissions:

• Microphone — to record your practice takes. Android asks for it the first time you record, and depending on your Android version you can allow it only while using the App, or only this time. The App uses the microphone only during a take, and on Android 12 and later a green microphone indicator appears at the top of the screen whenever an app is using it. Without this permission, you cannot record.
• Internet access — to send recordings to our server for analysis, and to load your results and learning resources. Android grants this automatically when the App is installed, without asking.

The App does not ask for access to your contacts, photos, files, location or notifications.

You can review or turn off the microphone permission at any time in your phone’s Settings → Apps → iSpeak → Permissions (menu names vary by phone brand).

15. Cookies and Similar Technologies

Our website does not use cookies, analytics or advertising trackers. Like any website, our hosting provider may keep basic server logs for security and troubleshooting.

All fonts and images are served from our own website, so your browser does not contact third-party font or analytics services when you visit. The QR code the website shows on computers is drawn by your own browser, so showing it sends nothing to us or to anyone else. If we add analytics or any non-essential cookies in the future, we will update this section and, where required, ask for your consent first.

16. Third-Party Links and Services

The website or App may link to third-party websites, app stores or learning materials. We do not control them and are not responsible for their privacy practices. Downloading the App through a third-party platform, such as an app store, is also subject to that platform’s own terms and privacy policy.

17. Changes to this Policy

We may update this Policy to reflect changes in the App, our practices or the law. When we do, we will update the “Last updated” date above and, for material changes, notify you in the App or by email before they take effect, and ask for your consent again where the law requires it.

18. Contact Us and Complaints

For questions, requests or concerns about this Policy or your personal data, contact the iSpeak team:

• Email: alibo.356750@gensan.sti.edu.ph
• Institution: STI College-General Santos, Inc.

We would like the chance to resolve your concern first. You also have the right to file a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph).