Version 2.0 - Last updated: July 5, 2026
The data controller is Eloqa SAS, a French société par actions simplifiée registered with the Paris Trade and Companies Register under number 842 100 224, with registered office at 200 rue de la Croix Nivert, 75015 Paris, France.
Privacy contact: [email protected].
This policy applies to the Eloqa mobile application, the website eloqa.app and related services. Eloqa is an AI voice coaching and vocabulary learning application.
The service is intended for users aged 15 and over. If we learn that a user is under 15, we may suspend access and delete the relevant data unless the law requires otherwise.
| Purpose | Legal basis | Data involved | Retention | Recipients |
|---|---|---|---|---|
| Create and manage the user account | Performance of the contract | User ID, email address, Apple/Google or email login information, language, account preferences. | For the duration of the account, then deletion or limited archiving where needed for evidence. | Eloqa, Hetzner, Apple or Google depending on login method. |
| Provide the real-time AI voice coach | Explicit consent for voice processing | Microphone audio in transit, transcription, conversation messages, AI-generated responses, technical identifiers. | Raw audio is not retained by Eloqa. Transcripts, messages and AI responses are retained for the duration of the account because they form the conversation history available in the product. | Eloqa, Hetzner, ElevenLabs, Requesty, Mistral, Gradium. |
| Display history, progress and vocabulary features | Performance of the contract | Transcripts, past conversations, AI responses, progress, exercises, learning preferences. | For the duration of the account, unless deletion is requested or the account is deleted. | Eloqa, Hetzner, Requesty/Mistral when AI is used. |
| Manage subscriptions and premium access | Performance of the contract; legal accounting obligations where applicable | Subscription ID, subscription status, purchase date, renewal, expiration, trial period, RevenueCat identifiers, Apple/Google receipts. Eloqa does not receive your payment card numbers. | For the duration of the account for active status; 5 years after the end of the contractual relationship; 10 years for accounting records if Eloqa must retain them. | Eloqa, RevenueCat, Apple App Store, Google Play. |
| Measure product and website usage | Consent | Usage events, pages viewed, clicks, analytics identifiers, technical device information, session replay where enabled. | Until consent is withdrawn; analytics cookies up to 13 months; analytics events up to 24 months. | PostHog EU, Google Analytics, Google Tag Manager. |
| Measure install attribution | Consent | Install data, campaign source, technical device information, IP address, advertising identifiers only if authorized by the system and the user. | Up to 13 months, unless aggregated or required as evidence. | AppStack, PostHog. |
| Monitor errors, secure and maintain the service | Eloqa's legitimate interest in ensuring security and reliability | Technical logs, error traces, application version, device model, operating system, user ID where needed for diagnosis, IP address. | 90 days for standard logs; longer only where necessary for a security investigation or legal defense. | Eloqa, Hetzner, PostHog. |
| Send product or marketing emails | Consent for marketing communications; performance of the contract for service messages | Email address, preferences, language, subscription status, events needed for personalization, opens and clicks where authorized. | 3 years after the last active contact for marketing, or until unsubscribe. | Eloqa, PostHog. |
| Handle support requests and privacy rights requests | Legitimate interest; legal obligation for GDPR rights | Contact details, request content, supporting documents where needed, response history. | For the time needed to handle the request, then up to 5 years for evidence. | Eloqa, necessary technical providers. |
When you use the voice coach, your voice is sent in real time to our backend and then to ElevenLabs for speech-to-text transcription. The transcript is sent to our LLM gateway Requesty, which routes to Mistral, to generate an educational response. The text response is then converted into audio by Gradium.
The microphone permission granted in iOS or Android is a technical permission. It does not replace the GDPR consent requested in the app before the first voice use.
Eloqa does not retain raw audio files. However, transcripts, messages and AI responses are retained for the duration of the account because they allow users to review past conversations and are part of the service.
We do not create a user voice model, clone the user's voice or use the voice to identify the user biometrically. Eloqa does not train its own models on your conversations. Our processors handle data under their contractual terms and our instructions; no-training and no-retention options must be enabled or confirmed when available.
You are informed that you interact with artificial intelligence. Responses may be incomplete or inaccurate and do not constitute medical, legal, financial or professional advice.
We recommend that you do not share unnecessary sensitive data, such as health information, political opinions, religious beliefs, biometric data or information relating to third parties. If you spontaneously share such data in a conversation, it will be processed only to provide the service and with the same retention period as the conversation history.
| Provider | Role | Main location | Transfer outside the EU |
|---|---|---|---|
| Hetzner | Backend and database hosting | Germany | Not intended. |
| ElevenLabs | Speech-to-text transcription | United States and other regions depending on their infrastructure | Yes, covered by DPA, Data Privacy Framework for the US entity and Standard Contractual Clauses. |
| Gradium | Text-to-speech | France | Not intended. |
| Requesty | LLM gateway | European Union, including Frankfurt | Not intended for the target routing. |
| Mistral | Language model via Requesty | France / European Union depending on routing | Not intended for the target routing. |
| PostHog EU | Analytics, session replay, monitoring, error tracking, emails | European Union, Frankfurt | Not intended for EU hosting, subject to enabled features. |
| RevenueCat | In-app subscription and premium access management | United States, AWS US | Yes, covered by DPA and Standard Contractual Clauses. |
| AppStack | Install attribution | United States, Google Cloud US | Yes, covered by Standard Contractual Clauses. DPA to be archived. |
| Google Analytics / Google Tag Manager | Website analytics and tag management | European Union and United States depending on Google services | Possible, covered by Google's transfer mechanisms. |
| Apple / Google | Stores, in-app purchases, Sign-In | According to their own policies | They partly act as independent controllers for stores and payments. |
The website uses cookies and local storage to remember your preferences and measure traffic if you consent. Google Analytics and Google Tag Manager are not triggered before you agree. More information: Cookie Policy.
You have the following rights: information, access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right not to be subject to a fully automated decision producing legal or similarly significant effects.
You may also define instructions regarding what should happen to your personal data after your death, in accordance with French data protection law.
You can exercise your rights by writing to [email protected]. We respond within one month, unless the GDPR allows an extension for complex requests.
You can withdraw your consent to voice processing or analytics from the app settings or cookie preferences where available. Withdrawing voice consent prevents new voice processing; it does not automatically delete existing history, which you can delete by deleting your account or exercising your right to erasure.
You can lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr.
You can delete your account from the Eloqa app:
You can also request deletion at [email protected]. Some data may be retained if required by law or necessary to defend rights.
We implement technical and organizational measures to protect data: encryption in transit, access control, limited internal access, logging, backups and provider reviews. No system is infallible, and we adapt these measures to the risk and evolution of the service.
We may update this policy to reflect changes to the product, providers or law. The date and version at the top indicate the applicable version.
Version 2.0 - complete rewrite: new AI/voice stack, transcript retention for the duration of the account, 15+ service, RevenueCat, PostHog, AppStack, Google Analytics and Google Tag Manager.