Privacy Policy
v2.1Last updated: July 31, 2026 · Effective: July 31, 2026
1. Scope
Voxlio ("we," "our," "us") operates an AI-powered IELTS Speaking, Writing & Reading practice platform at voxlio.space. This Privacy Policy explains what personal data we collect, why we collect it, how it is processed, stored, shared, and protected when you use our platform.
This policy applies to all Voxlio features including Speaking Practice, Writing Practice, Reading Practice, Writing Library, Reading Library, Smart Dashboard, Vocabulary, Study Timer, V-Coin system, Premium subscriptions, and the Leaderboard.
By creating an account or using the platform, you acknowledge the practices described in this policy. If you do not agree, please do not use the service.
2. Data We Collect
2.1 Information You Provide
Account Data
- Name
- Email address
- Password (bcrypt-hashed)
- Unique 8-digit User ID (voxlioId)
Speaking Practice Data
- Voice recordings (Parts 1, 2, 3)
- Speech transcripts
- AI band scores & feedback
- Part, topic, and question references
Writing Practice Data
- Written task responses (Academic T1, General T1, Task 2)
- AI band scores & criteria breakdown
- Word count analysis
- Writing task prompts
Vocabulary Data
- Saved words & definitions
- Flashcard reviews history
- AI vocabulary search queries
Payment Data
- Transaction ID from Click
- Amount & currency
- No card data ever collected
V-Coin Data
- V-Coin balance & transactions
- Writing reward transactions (1.04V per task)
- Shop purchases
2.2 Automatically Collected
Technical Data
- IP address (temporary)
- Browser type & version
- Operating system
- Referrer URL
Usage Data
- Pages visited & feature interactions
- Speaking/Writing assessment completion rates
- Dashboard tab interactions
- Error logs & performance metrics
3. Why We Collect It
Service Delivery
Manage accounts, process AI assessments for Speaking & Writing, display history and progress on the Dashboard, save vocabulary flashcards, award V-Coins.
Security & Abuse Prevention
Rate limiting, heartbeat monitoring, IP-based abuse detection, fraud prevention, admin authentication with 2FA OTP.
Service Improvement
Transcripts and scores help refine AI accuracy. Usage patterns guide UI/UX improvements across Speaking, Writing, and Dashboard features.
4. Where Data Is Stored
Database
Neon PostgreSQL (US/EU servers). Encrypted at rest (AES-256). Daily automated backups. Connection pooling for reliability.
Audio & Writing Processing
Voice recordings processed in-memory for transcription. Writing tasks sent as text. Both deleted immediately after processing. Max 30-day retention for debugging.
Server Logs
Render (hosting) retains logs with IPs for up to 7 days. Used for operational diagnostics only. No PII stored in logs beyond IP.
5. Third-Party Services
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Groq Inc. | AI band scoring (Speaking & Writing), feedback, vocabulary analysis | Transcripts, written responses, speech metrics, vocabulary words | USA |
| ElevenLabs | Text-to-Speech for practice questions | Question text only | USA |
| Click (Click.uz) | Payment processing (Premium subscriptions) | Amount, transaction ID (no card data) | Uzbekistan |
| Neon (Neon.tech) | Database hosting | All stored data (encrypted) | US / EU |
| Render (Render.com) | Web hosting & deployment | Server logs (IP, timestamps) | USA |
| Telegram | Bot, Mini App login, 2FA OTP delivery | Telegram user ID, chat ID, message commands | Global (Telegram CDN) |
All third parties process data under contractual agreements that comply with applicable data protection laws.
6. AI Data Processing
Voxlio uses Groq AI to analyze your speech, writing, and vocabulary queries. Understanding how this works is important:
Speaking Assessment
- Transcript sent to Groq for band scoring
- Audio transcribed via browser API (Web Speech API)
- Groq does not store transcripts by default
- Scores saved to your account for history
Writing Assessment
- Written response sent to Groq for band scoring
- AI evaluates Task Achievement, Coherence, Lexical Resource, Grammar
- Word count analysis included in feedback
- Scores saved with criteria breakdown
Vocabulary Analysis
- Search word sent to Groq for OALD-style analysis
- Results not stored server-side unless saved
- Recent searches saved locally in browser
- Definitions are AI-generated, not official OALD
We use 142 Groq API keys in round-robin with automatic fallback for reliability. All API calls are subject to Groq's privacy and security practices.
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Right to Access
Request a copy of all personal data we hold about you.
Right to Deletion
Delete your account anytime — all data removed within 30 days.
Right to Rectification
Update or correct your name, email, and profile information.
Right to Portability
Request your data in a machine-readable format (JSON).
Right to Restrict
Request limitation of processing in certain circumstances.
Right to Object
Object to processing based on legitimate interests.
To exercise any of these rights, email us at voxliouz@gmail.com. We respond within 30 days as required by law.
8. Data Retention
9. Security Measures
Encryption
All traffic encrypted via HTTPS (TLS 1.3). Database encrypted at rest (AES-256). Passwords hashed with bcrypt.
Authentication
Session-based auth with CSRF protection. Admin panel secured with password + Telegram 2FA OTP.
Rate Limiting
API endpoints protected against brute force and DDoS. IP-based rate limiting on auth, assessment, and writing routes.
10. International Data Transfers
Your data may be transferred to and processed in countries other than your own, including the United States and the European Union. When we transfer data, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data Processing Agreements (DPAs) with all sub-processors
- Compliance with applicable local laws in all operating jurisdictions
11. Children's Privacy
Voxlio is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete it immediately. If you believe a child has provided us with personal data, please email us at voxliouz@gmail.com.
12. Policy Changes
We reserve the right to modify this Privacy Policy at any time. Changes will be posted on this page with an updated effective date. Material changes will be notified via email or platform notification. We encourage you to review this policy periodically.
This policy was last materially revised on July 31, 2026 to reflect Voxlio v2.1: full IELTS Reading practice (Cambridge Books 10–20), Reading Library, and an expanded Writing Library. No new personal data is collected by these features beyond what this policy already describes.