← YoluBand

Privacy Policy

Effective date: 31 July 2026 · Version 2026-07-31

This Privacy Policy explains what personal data YoluBand collects, why, who we share it with, where it is stored, how long we keep it, and the choices and rights you have. We aim to keep it readable. If anything is unclear, write to privacy@yoluband.az.

YoluBand is an English-learning service for Azerbaijani and Russian speakers, with a particular focus on IELTS preparation, offered through yoluband.az and our mobile app.

YoluBand is operated from the Republic of Azerbaijan. A limited liability company (MMC) is in the process of being registered; this policy will be updated with the company's legal name, tax number (VÖEN), and registered address as soon as registration completes. Until then, "YoluBand", "we", and "us" mean the operator of the service, reachable at privacy@yoluband.az (data and privacy matters) and hello@yoluband.az (everything else). Within the meaning of the Law of the Republic of Azerbaijan "On Personal Data" No. 998-IIIQ, the operator of YoluBand acts as the owner (controller) of your personal data.

We collect only what we need to run the product:

  • Account data: your email address, display name, a unique user ID, and your date of birth (used once to confirm you meet our minimum age; see §10). Sign-in is handled by Clerk; Clerk stores your credentials and we never see your password.
  • Learning progress: lessons started and completed, XP, streaks, hearts, gems, vocabulary under review, placement level and per-skill estimates, unit unlocks, daily goals, achievements, study plans (including an exam date if you set one).
  • Your essays (free text): the writing you submit for grading, plus the AI grade and feedback produced from it.
  • Your voice recordings and transcripts (biometric data; see §3): audio of your speaking responses and voice-journal entries, the text transcript produced from them, and the resulting grades and feedback.
  • AI tutor conversations: the messages you exchange with the in-app tutor.
  • Exam practice results: mock-test sessions and scores, reading/listening answers, diagnostic results.
  • Social data: your private friends list, friend requests, referral links you share, encouragements you send or receive, quiz-duel results with friends, and league standings. Your friends list is private; we do not run a public feed. Whether friends can see your band estimate is controlled by an off-by-default setting.
  • Self-reported exam results (optional): if you tell us your real IELTS/TOEFL/SAT result, the scores, exam date, exam centre, and country you enter. Used to calibrate our grader; shown as a testimonial only if you separately tick the testimonial consent box.
  • Feedback you send: if you use the in-app feedback form, the message you type and the email you optionally include.
  • Notification tokens: if you install the mobile app and grant permission, a push token so we can send streak reminders and nudges. Revocable in your device settings.
  • Analytics events: non-content product events such as "lesson started" or "mock test submitted", tagged with your user ID so we can debug per-account issues. These events do not include the text of your essays, your tutor chats, your audio, or your email address.
  • Technical data: standard request data (IP address, user-agent, the URL visited) is received by our hosting provider to serve the site and defend against abuse. We use IP addresses transiently for rate limiting and do not store them in our database.

Under Azerbaijani law (Law of the Republic of Azerbaijan "On Personal Data" No. 998-IIIQ of 11 May 2010), voice fragments and their acoustic parameters are biometric personal data. When you use speaking practice or the voice journal, we record your voice and create a text transcript so your speaking can be transcribed, graded, and played back to you.

Because voice is biometric data, we:

  • ask for your explicit consent the first time you record, before any audio leaves your device, and keep a record of that consent; you can decline and still use the rest of the app;
  • use recordings only to provide the speaking-practice features: transcription, grading, feedback, and playback to you;
  • delete raw audio automatically after the retention period in §9 (transcripts remain as ordinary text attached to your results until you delete them or your account);
  • never use your recordings to build voice-identification profiles; and
  • never use your recordings to train our own or public AI models.

Transcription is performed by our speech-processing providers (see §5): primarily Groq (United States), whose API policy retains audio for at most 30 days for abuse monitoring (we request zero-data-retention processing where available). A fallback transcription provider (OpenAI Whisper) exists in our code behind an operator switch that is off as of this version; if we turn it on, we will update §5 first.

Purposes. We use your data:

  • To provide the service: sign you in, remember your progress, grade your essays and speaking responses, run the tutor, schedule your study plan, show the right next lessons, and send the notifications and emails described in §8.
  • To improve the product: understand which lessons help, debug issues, and develop better grading (using anonymised content where possible).
  • To keep the service healthy and safe: detect abuse, prevent automated scraping, enforce fair-use limits, and meet legal obligations.

Automated assessment (AI grading). Grades, band estimates, and feedback in YoluBand are produced by automated AI systems. They are practice estimates for your study, not official results, and they do not produce legal or similarly significant effects: no decision about you is made from them beyond what practice content the app suggests next. If you believe a grade is wrong, you can resubmit, request a human review where that feature is offered, or write to hello@yoluband.az.

An important disclosure about free-tier AI processing. Essay grading, speaking-transcript grading, and the AI tutor currently run on Google's Gemini API free tier. Under Google's terms for unpaid services, content submitted to these services (your essay text, speaking transcripts, and tutor messages, never your email or name) may be used by Google to improve its products and may be reviewed by human reviewers. Do not include personal details such as your full name, phone number, address, or other private facts in essays, recordings, or tutor chats. The app shows this reminder near the writing box. As YoluBand grows we intend to move AI processing to paid tiers that exclude provider-side training use; this policy will be updated when that happens.

No selling, no ads. We do not sell your personal data, and we run no third-party advertising on YoluBand today. If we introduce opt-in rewarded ads later, we will update this section and the consent flow first.

We rely on infrastructure providers to run YoluBand. Each processes data only to provide its service to us, under its own published terms and data-processing commitments:

  • Clerk (United States): authentication and session management. Receives your email address, display name, and sign-in credentials.
  • Neon (European Union, Frankfurt): our primary PostgreSQL database. Stores the data described in §2.
  • Vercel (a US company; our compute is pinned to Frankfurt, EU): hosting and serverless compute. Processes request data to serve the app.
  • Vercel Web Analytics and Speed Insights (Vercel, United States): traffic and performance measurement. Receive page-view and timing data; this measurement sets no cookies and stores no cross-site identifier.
  • Cloudflare R2 (global network, served from the EU): object storage. Holds your speaking and voice-journal audio and our database backups.
  • Google Gemini API, free tier (United States): AI grading of essays and speaking transcripts, the AI tutor, and content embeddings. Receives essay text, transcripts, and tutor messages; see the §4 disclosure.
  • Vercel AI Gateway (United States): routing layer for some AI requests. Passes the same content as the AI providers it routes to.
  • OpenRouter (United States): fallback AI routing for the free public tools on our site, used when our primary AI providers are unavailable. Receives only the text a visitor pastes into a public tool, never your account data.
  • Groq (United States): voice-to-text transcription. Receives your voice audio (biometric data, §3); provider-side retention is at most 30 days.
  • PostHog (European Union): product analytics. Receives event names and your user ID, with no content and no email.
  • Resend (United States): email delivery. Receives your email address and display name.
  • Sentry (European Union / United States): error monitoring. Receives technical diagnostics with identifiers scrubbed, so no email, no IP address, and no content.
  • Svix (United States): webhook delivery between Clerk and our servers. Relays the account events Clerk sends us, which carry your account ID, email address, and display name.
  • Upstash (European Union region): rate limiting. Receives transient counters keyed by user ID or IP address that are not persisted as profile data.
  • Expo, Apple, Google Firebase (United States): mobile push delivery. Receive your push token.

Held in our code behind operator switches that are off as of this version: OpenAI Whisper (transcription fallback), Microsoft Azure Speech (pronunciation scoring), and the payment providers M10 and Azercard (payments are not enabled; see the Refund Policy). If we turn any of these on, we will update this list first.

We keep this list current. When we add or replace a processor in a way that materially changes how your data is handled, we will tell you through an in-app notice before or at the time of the change (§13).

Our primary database and compute run in the European Union (Frankfurt, Germany), and your audio files and our backups are stored with Cloudflare. Some processing (in particular AI grading, voice transcription, authentication, email, and push delivery) happens on servers of the providers listed in §5, including in the United States.

This means your personal data is transferred across the borders of the Republic of Azerbaijan. We make these transfers on the following bases:

  • Your consent. When you create an account you accept this Privacy Policy, which names every destination country and provider above. This acceptance is your consent to the cross-border transfers described here, as provided for by the Law "On Personal Data" No. 998-IIIQ. You can withdraw consent at any time by deleting your account (§11); the service cannot run without these transfers, so continued use requires them.
  • Adequate protection of the EU leg. Our EU providers (Germany/Frankfurt) operate under the GDPR, and Germany, like Azerbaijan, is a party to the Council of Europe's Convention 108 on data protection, so the primary storage location gives your data a level of legal protection consistent with Azerbaijani law.
  • Minimisation and security in transit. Each provider receives only what it needs (§5), transfers are encrypted in transit (TLS), and analytics and error-monitoring streams are stripped of email addresses and content.

YoluBand uses strictly necessary cookies (sign-in session, language, theme), a small number of functional cookies, and first-party product analytics (PostHog, EU) that you can decline from the consent notice on your first visit. Our product analytics honours your browser's Do Not Track setting. Our hosting provider also measures traffic and page performance for us (Vercel Web Analytics and Speed Insights); this measurement sets no cookies and stores no cross-site identifier. We set no advertising cookies and use no third-party advertising trackers. The full inventory (every cookie and local-storage key, what it does, and how to change your choice) is in our Cookie Policy at /legal/cookies.

We send two kinds of email: account email (a welcome message when you join) and learning reminders (streak reminders, streak-loss notices, weekly recaps, and exam-countdown messages if you set an exam date). Every learning-reminder email contains an unsubscribe link that stops all such emails with one click, and the same switch is in Settings → Notifications (the "Reminder emails" toggle). We honour the one-click unsubscribe standard (RFC 8058), and we do not send third-party marketing.

  • Account record and learning progress: kept while your account is active, then erased within 30 days of account deletion.
  • Voice recordings (raw audio): deleted automatically within 90 days of submission, and immediately on account deletion. Transcripts, grades, and feedback remain attached to your results as ordinary text until you delete them or your account.
  • Essays, transcripts, tutor chats, practice results: kept while your account is active; deleted on account deletion.
  • AI-processing records (our cache of grading inputs and outputs, which may embed essay text or transcripts): deleted on account deletion.
  • Analytics events: retained in aggregated, non-content form to monitor product health.
  • Administrative audit log: records of administrative actions (for example, an account deletion event and the administrator email that performed it) are kept after account deletion as a minimal security record.
  • Disaster-recovery backups: deleted data also leaves our rotating database backups as old backups are purged, within approximately 35 days of deletion.
  • Records we must keep by law: kept for the period the law sets. Today this is a narrow category. Once payments launch, Azerbaijani tax and accounting law will require us to keep payment and billing records (order, amount, date, and the linked account identity) for the statutory bookkeeping period even after account deletion, and we will state the exact period here when payments activate.

YoluBand is intended for users aged 16 and over, and account creation requires confirming a date of birth that meets this floor. We do not knowingly create accounts for younger children, and if we discover an account belonging to a person under 16 we will delete it. If you are 16 or 17, we ask that your parent or guardian is aware of and permits your use of the service. If you believe a child under 16 has created an account, write to privacy@yoluband.az and we will delete it.

You have the right to know what personal data we hold about you, to access it, to correct it, to delete it, to export a copy, and to object to or restrict certain processing. To exercise these:

  • Export: use Export my data in Settings to receive a complete machine-readable copy of your account and learning data.
  • Delete: use Delete account in Settings, or write to privacy@yoluband.az from your account email. Deletion is permanent and covers the data in §9.
  • Anything else: write to privacy@yoluband.az.

To protect your data we may need to verify your identity (normally by checking that the request comes from your account email) before acting on a request. We respond within 7 business days, as the Law "On Personal Data" requires (extendable by a further 7 business days where a third party must be consulted), and we do not charge a fee in the normal case. If a request must be refused on grounds the law allows, we tell you the reasoned refusal within 5 business days. If you believe we have mishandled your personal data, you also have the right to complain to the supervisory authority for personal data in Azerbaijan (the Ministry of Digital Development and Transport) or to a court.

We use industry-standard measures: encryption in transit (TLS) everywhere, access controls and least-privilege service credentials, unguessable object keys for audio files, rate limiting, security monitoring, and PII-scrubbed error logging. No system is perfectly secure. If a personal-data breach materially affecting your rights occurs, we will inform affected users without undue delay and notify authorities where the law requires it.

We may update this policy as the product grows and our processor list changes. The date at the top is the effective date of the current version. Material changes are announced through an in-app notice, and where a change is significant we will ask you to accept the updated version before continuing.

Privacy questions or requests: privacy@yoluband.az. Everything else: hello@yoluband.az. We read every message. See also our Terms of Service, Cookie Policy, and Refund Policy. The Azerbaijani-language version of this policy is the governing version; the Russian and English versions are provided for convenience.