Privacy policy

OralReady · Houssem Ben Salem

Effective November 8, 2026 · Last updated: November 8, 2026 · Version 1.0

This policy explains what personal information we collect when you use OralReady, why we collect it, who we entrust it to, how long we keep it and what your rights are. It is separate from our Terms of use.

1. In short

There is no account. You can practise without giving your name or email.
We record your voice only if you agree. You can withdraw your consent at any time.
We never keep your audio recordings.
The full text of your answers is not kept on our server: it is sent back to your browser.
Your result, which may quote short excerpts of your answers, stays on our server for 1 hour at most. Your history stays in your browser.
Our transcription, grading and hosting providers are in the United States.
Payment happens at Stripe. We never see your card number.
We don't sell your personal information.

2. Who is responsible

OralReady is run by Houssem Ben Salem, in Montréal, Québec.

Person in charge of the protection of personal information: Owner, OralReady

Email: [email protected]
Address: 2000, rue Saint-Marc, app. 905, Montréal (Québec) H3H 2N9
Phone: 263 688-4258

This person makes sure this policy is applied. They answer your questions, requests and complaints.

3. Applicable laws

We apply Québec's Act respecting the protection of personal information in the private sector, as amended by "Law 25". We also apply Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

4. How we collect your information

We use these technological means:

your device's microphone, through your browser, only during a mock and only after you consent;
our website and server, which receive, for example, your device's IP address;
your browser's storage, for example for your access code and your history;
Stripe's payment page;
email, when you write to us.

5. What we process, why, and for how long

Information	What it's for	Where it is	How long we keep it
1. Audio recording of your answers	Producing the text of your answers (transcription)	In transit only: our server passes it to the transcription provider without saving it	Us: none. OpenAI: none.
2. Transcripts (the text of your answers)	Showing them to you; estimating your level	Your browser; Anthropic, for grading	Our server: none. Anthropic: up to 30 days (section 9).
3. Result (estimated level and feedback, which may quote short excerpts of your answers)	Showing your result; retrying a failed grading without using another mock	Our server (Cloudflare KV storage), under a random key	1 hour at most, then deleted automatically
4. History of your results	Showing your progress	Your browser only	By default, the current session. If you tick "Keep my history on this device": your last 10 mocks, until you delete them.
5. Hashed IP address (a one-way code computed with a key that changes at least every 48 hours)	Applying the free-mock limit per network; blocking abuse	Our server (Cloudflare KV)	48 hours at most. We never keep your IP address in readable form.
6. Technical counters (mocks used today per pass, recording attempts, usage limits) and, for a pass, its number of paid mocks, its refund status and whether it was turned off	Applying usage limits; checking the conditions of the voluntary refund; blocking a refunded or turned-off pass	Our server (Cloudflare KV)	Counters: 48 hours at most. Number of paid mocks: 8 days after the first. Refund status: 24 hours, or until the pass would have ended if it was refunded. Turned off: 90 days. They contain no name, no email and nothing from your answers.
7. Technical logs	Fixing errors	Cloudflare	Not stored. They contain nothing from your answers, no name, email or IP address, and nothing that links them to your payment.
8. Pass and access code: the pass saved in your browser holds a random ID, an end date and a signature, with no name or email. The access code lets you restore it on another device.	Proving that your pass is valid; restoring it on another device	Your browser. The access code is also on your Stripe invoice.	Until the pass ends. On the invoice: like payment data (row 10).
9. Other data in your browser: your consent (version and date), a note that you used your free mock, your practice settings, where your visit came from and the steps of your visit already counted	Respecting your choices; running the service	Your browser only	Consent: until you withdraw it. Visit source and counted steps: the current session. The rest: until you delete it.
10. Payment data: name, email, billing address, amount, date, card details (handled by Stripe only)	Processing the payment; sending your receipt and contract copy; refunds; meeting our tax obligations	Stripe; our payment records (a monthly export kept in Canada)	Our records: 6 years after the end of the tax year they relate to, then destroyed within the following year. At Stripe: under its own policy (section 10).
11. Emails you send us (support, refund, access request, complaint)	Answering you; keeping a record of your request	Our mailbox, hosted by Zoho Mail	Until the file is closed, then 24 months

We ask only for what we need. At checkout, we ask for your name and billing address because Québec's Consumer Protection Act requires them on your contract.

During a mock, don't give your name, your department or details about other people. We don't need them.

6. Your consent

Before the first recording, a panel explains what will be recorded, why, who will receive it and how long it will be kept.
We record nothing until you click "Accept and start". No box is ticked in advance.
This consent is asked for separately. It is not tied to accepting the Terms of use.
To refuse, click "Refuse". Nothing is recorded. You won't be able to do a mock, but you can still browse the rest of the site and accept later.
If you don't provide payment details, you can't buy a pass.
If we add a provider or change how we use your answers, we will ask for your consent again before the next recording.

7. AI estimate: profiling and automated decision

The estimate of your level assesses a personal characteristic: your speaking proficiency. So we treat it as a profiling function.
This function is off by default. You turn it on yourself, for each mock, by clicking "Get my estimate".
The estimate is produced automatically by an AI system (Claude, by Anthropic), with no human involved. It is only for your practice. We share it with no one other than our service providers, and we don't use it for any decision about you.
The "Why this level?" section of your results page shows the information used (the transcripts of your answers) and the criteria applied.
On request, we tell you the information used, and the reasons and main factors behind the estimate. You can have that information corrected, for example a transcription error.
You can submit your comments to a person who can review the estimate. Click "Ask for a review" or write to [email protected]. We answer within 30 days.

8. Third parties that collect information for us

Stripe collects your payment details on its payment page (sections 9 and 10).
Cloudflare Web Analytics counts visits to our pages in aggregate, without cookies (section 11).

9. Our service providers and processing in the United States

We entrust some tasks to service providers. Each one is bound by a written agreement that limits the use of the information to the task given. Our hosting, transcription, grading and payment providers process your information in the United States, so outside Québec and Canada.

Provider	Role	What it receives	How long it keeps it	Training AI models with your data
Cloudflare, Inc.	Website hosting, server, temporary storage, audience measurement	Requests sent to our site, including your IP address; audio in transit; your result	Result: 1 hour. Hashed IP address and counters: 48 hours (a pass's data: section 5, row 6). Logs: not stored.	Not applicable
OpenAI	Transcribing your answers (gpt-transcribe model)	The audio of your answers	None	No, by default
Anthropic	Grading your answers (Claude)	The transcripts and the grading rubric. Never your name, email, IP address or access code.	Deleted within 30 days. Exception: content flagged for a possible breach of Anthropic's rules may be kept up to 2 years, and some safety scores up to 7 years.	No, by default
Stripe	Payment	Your payment details	Section 10	Section 10
Zoho Mail	Hosting our mailbox (Canada)	The emails you send us	Under our rule: 24 months after the file is closed	Only anonymized extracts, to improve its algorithms (Zoho's privacy policy)

Access abroad. Your personal information may be processed in the United States by our service providers. While there, it may be accessible to the courts, law enforcement agencies and national security authorities of that country, under its laws.

We remain responsible for your information when we entrust it to a provider. Before entrusting it to a provider outside Québec, we assess the privacy risks and sign a written agreement with that provider.

10. Stripe, an independent controller for its own purposes

Stripe processes your payment details on our behalf. Stripe also uses them for its own purposes, as an independent controller: fraud prevention and security, meeting its legal obligations, and improving its services, including training its own AI models.

Stripe may collect your name, email, phone number, address, payment method, device data and IP address. Stripe transfers Canadian data to the United States. It keeps the data for as long as it provides its services, then as its legal obligations require.

For those uses, Stripe's privacy policy applies: https://stripe.com/en-ca/privacy

On our side, we keep no card data. Apart from the payment records that tax law requires us to keep (section 5), we keep no customer list: we look things up at Stripe when needed, for example for a refund.

11. Audience measurement without cookies

To know whether the site works well, we count, in aggregate:

page views, with Cloudflare Web Analytics. According to Cloudflare, this tool sets no cookies and collects no personal information about visitors;
key steps, such as "mock started", "result shown" or "purchase", with counters on our server, without cookies or personal information.

If you arrive through a campaign link, its source (for example, the name of an ad) stays in your browser for the session only. It is attached to those counters. We don't do advertising profiling.

12. What we don't use

No advertising pixels, no tracking cookies, no retargeting.
No device fingerprinting, no session recording, no geolocation from your IP address.
No voice identification technology: we create no voiceprint and we don't verify your identity.
Our site sets no cookies. On the payment page, you are at Stripe, which applies its own policy.

13. Who has access to your information

At our end, only the operator (Owner) has access to personal information. Our providers have access only for the task we give them (section 9).

14. Security

The whole site uses an encrypted connection (HTTPS).
Our secret keys stay on the server.
Your IP address is kept only in hashed form, with a key that changes at least every 48 hours.
Your result is stored under a random key that can't be guessed.
Your access code contains no name or email. You need this code to restore a pass on another device.
No audio is written to disk or to logs, and the logs contain none of your answers, and no name, email or IP address.
Our providers are bound by written agreements.

No measure is perfect. If an incident creates a risk of serious injury, we will notify you (section 18).

15. Your rights and how to use them

You can:

ask for access to the personal information we hold about you, and get a copy;
have information corrected if it is wrong, incomplete or ambiguous;
ask that the computerized information you gave us be sent to you, or to a body authorized by law, in a structured and commonly used technological format. This right doesn't cover information we created or inferred, such as the estimated level, but you can still have access to it;
withdraw your consent (section 16);
submit your comments on an estimate and ask for a review by a person (section 7);
make a complaint (see below).

How to make a request

Write to [email protected], or by mail to the attention of the person in charge of the protection of personal information, 2000, rue Saint-Marc, app. 905, Montréal (Québec) H3H 2N9.
Say what you are asking for.
We may ask you to confirm your identity, for example by writing from the email address used for the purchase or by giving us your access code. This keeps your information from going to someone else.
We answer in writing within 30 days of receiving your request. We charge nothing to handle it.
If you have a disability, we adapt how we give you access, for example with an accessible format.

What we can find. Because there are no accounts, most of your information stays in your browser, where you can see it and delete it yourself. We can find your payment data, using your purchase email, and your emails. The result kept for 1 hour and the hashed IP address are not linked to your name, so we generally can't connect them to you.

Complaints. Write to the person in charge, at the same contact details. How we handle complaints is described in our Personal information governance policy. You can also contact the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

16. Withdrawing your consent

You can withdraw your consent at any time. Click "Withdraw my consent" on the practice page. Then:

we stop the microphone and record nothing more;
we delete your consent and your history from your browser;
your pass stays active.

What was already sent follows the periods in section 5: we don't keep the audio, your result is deleted from our server within 1 hour, and Anthropic deletes the transcripts within 30 days. Withdrawing doesn't affect the payment records that the law requires us to keep. To do another mock, you will need to accept again.

17. People under 14

OralReady is meant for people aged 14 and over. For a person under 14, consent must be given by their parent or tutor. If you believe a person under 14 used the service without that consent, write to us.

18. Confidentiality incidents

If a confidentiality incident creates a risk of serious injury to you, we notify you and the Commission d'accès à l'information. Where required, we also notify the Office of the Privacy Commissioner of Canada. We record every incident in a register.

19. Changes to this policy

We post a notice of every change on this page: the update date at the top, and a summary of the changes.
If a change is important, the notice also appears on the site at least 30 days before it takes effect.
If a change affects what you accepted in the consent panel, such as a new provider, we will ask for your consent again before the next recording.
Earlier versions are available on request.

20. Contact us

[email protected] · 2000, rue Saint-Marc, app. 905, Montréal (Québec) H3H 2N9 · 263 688-4258