1. Introduction & Privacy Commitment
Welcome to Foxalo(“Foxalo”, “we”, “us”, or “our”), the intelligent English learning platform developed to empower learners worldwide through Dictation, Shadowing, Spaced Repetition Vocabulary (SRS), Translation, and Speaking Reflex.
We hold your privacy in the highest regard. This Privacy Policy outlines how Foxalo collects, uses, protects, and discloses your personal data when you interact with our web applications, APIs, and associated services. We adhere strictly to international data protection benchmarks, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and Vietnam’s Decree No. 13/2023/ND-CP on Personal Data Protection.
2. Information We Collect
We gather specific information to ensure seamless functionality and personalized educational experiences:
- Full name, display name, and avatar image.
- Email address and encrypted authentication credentials.
- Account identifier from Google or Facebook when you sign in with them.
- Subscription tier (Free vs. Foxalo Pro) and billing receipts.
- User-recorded audio for Shadowing & Speaking Reflex modules.
- Phonetic breakdowns, pronunciation accuracy scores, and timestamps.
- Recordings are processed in memory for scoring and never shared publicly.
- Lesson progress, exercise accuracy, and completion status.
- Spaced Repetition System (SRS) intervals and flashcard memory levels.
- Experience Points (XP), Gems, Streak counter, and quest milestones.
- Translation drafts and AI evaluation feedback logs.
- Browser user-agent, operating system, and screen resolution.
- Anonymized IP address for geographical CDN routing and fraud prevention.
- Crash diagnostics and performance telemetry (via Sentry).
3. How We Use Your Information
Foxalo processes your data strictly for legitimate educational, operational, and customer support purposes:
4. AI Processing & Third-Party Partners
Foxalo utilizes state-of-the-art Generative AI and Speech Recognition models to evaluate translation nuances and speaking reflexes in real time. We maintain stringent enterprise-grade privacy contracts with our API vendors:
| Partner / Technology | Primary Function | Privacy Protection Guarantee |
|---|---|---|
| Google Cloud (Gemini Flash APIs) | Semantic translation analysis and grammar feedback | Enterprise Privacy terms: Customer prompts are never retained or used to train Google models. |
| Groq Cloud Infrastructure | Ultra-low-latency fallback inference | Zero-data retention agreements with strict SLA compliance. |
| OpenAI Whisper / STT Engine | Audio transcription for pronunciation grading | Transitory memory buffer; ephemeral audio tokens discarded after scoring. |
| SePay (bank transfer confirmation) | Foxalo Pro payment: you pay by VietQR bank transfer and SePay tells Foxalo that the transfer arrived | Foxalo receives the transfer amount, transfer content and transaction reference. Foxalo does not ask for or store card numbers. |
5. Data Storage & Security Measures
We implement comprehensive technical, administrative, and physical safeguards to prevent unauthorized access, alteration, disclosure, or destruction of your information:
- Transmission Encryption: All communications between your browser and our servers are encrypted using modern Transport Layer Security (TLS 1.3 / SSL 256-bit).
- At-Rest Encryption: Databases and backups are protected by AES-256 encryption. Sensitive authentication tokens are hashed using salted cryptographic algorithms (Bcrypt/Argon2).
- Access Control: Foxalo engineers and operators access production databases solely via role-based access control (RBAC), multi-factor authentication (MFA), and audit logging.
- Penetration Testing: Routine automated vulnerability assessments and code audits are conducted prior to deploying feature releases.
7. Your Privacy Rights
Depending on your jurisdiction (including GDPR, CCPA, and Vietnam Decree 13/2023), you hold the following rights regarding your personal information:
8. Children’s Privacy
Foxalo is designed for learners of diverse ages. However, we do not knowingly collect personal information from children under 13 (or under 16 in the European Union) without verified parental or legal guardian consent. If you discover that a child has provided us with personal data without proper authorization, please reach out to privacy@pingra.com, and we will take immediate measures to delete that data.
9. Policy Updates & DPO Contact
We may periodically update this Privacy Policy to reflect technical innovations, service enhancements, or statutory adjustments. If material revisions are made, we will notify you via a banner notification in the app or via email before the changes take effect.
Data Protection Officer (DPO) Contact
For inquiries, data requests, or compliance questions, please contact our dedicated Data Protection team:
Organization: Pingra EdTech Inc.
Email: privacy@pingra.com / dpo@pingra.com
Support Hotline: support@pingra.com
Response Timeframe: Within 48 business hours.