Privacy Policy

1. Who we are

Sudamate is a Korean conversation-practice app operated by Dodamverse, based in Hong Kong (“Sudamate,” “we,” “us”). For data-protection purposes, Dodamverse is the data controller. This policy explains what we collect when you use the Sudamate web app at sudamate.com, the iOS app, or the Android app; how we use it; who we share it with; and the choices and rights you have. You can reach us any time at admin@sudamate.com.

2. What we collect, how we collect it, and why

This section lists the categories of personal data Sudamate collects, where each category comes from, and every purpose for which we use it. Some features are optional, so we collect the related data only when you use them.

• Account and authentication data. This includes your account ID, email address, display name, authentication provider and provider identifier, sign-in tokens, and account timestamps. We collect it when you create an account with an email and password or sign in through Google or Apple. Passwords are processed by our authentication provider; we do not store or have access to your plaintext password. We use this data to create and secure your account, sign you in, sync your data, prevent duplicate trial claims, provide support, and process account deletion and sign-in revocation.
• Profile and preference data. This includes information you choose to enter during onboarding, in Settings, or while configuring a roleplay: display name, pronouns, birthday, city or location, timezone, profession, industry, Korean level, learning motivations and topics, favorite artists, favorite esports teams and games, interface language, and roleplay details. We collect it directly from the fields and choices you submit. We use it to personalize conversation topics, tutor prompts, roleplays, difficulty, language, local time and optional weather context.
• Voice, transcript, and conversation data. With microphone permission, we collect audio only when you start a live conversation or record a pronunciation attempt. We also collect the words transcribed from your speech, tutor replies, translations, roleplay content, response hints, search queries generated during a session, and session recaps. We collect audio directly through the device microphone and generate the other data from the conversation. We use it to conduct the live conversation, recognize speech, create and translate transcripts, answer current-information questions, generate tutor responses and recaps, score pronunciation and fluency, provide grammar and vocabulary feedback, let you replay sessions, and evaluate the quality and reliability of those features.
• Learning results and personalization data.This includes pronunciation, fluency, rhythm and grammar results; corrections and suggested rewrites; practice history; summaries; and conversation memories or relationship preferences inferred from what you say. We generate it from your audio, transcripts, profile and app activity using automated systems and AI models. We use it to show feedback and progress, choose relevant review material, remember useful context between ordinary conversations, and adapt the tutor’s responses. Roleplay conversations are not added to cross-session memory.
• Session, schedule, and notification data. This includes session IDs, topics, modes, start and end times, duration, timezone, plan quota usage, selected call days and times, next and last call times, call delivery status, and, on supported iOS devices, the PushKit token and whether it belongs to the sandbox or production environment. We collect it when you start or finish a session, choose a call schedule, permit an incoming-call notification, or when the app records delivery. We use it to save your history, enforce plan limits, schedule local reminders on supported devices, and send the iOS server-initiated incoming call you requested through Apple Push Notification service and CallKit.
• Purchase, subscription, referral, and gift data.This includes your account ID, checkout email, product and plan, price and currency, store transaction identifier, purchase, renewal, cancellation, expiration and refund status, trial eligibility, entitlement status, and any referring partner. If you send a gift, it also includes the sender name, recipient email, gift message, gift code and delivery status. We receive purchase data from RevenueCat, Apple or Google and collect gift and checkout details from the fields you submit. We use it to complete and restore purchases, unlock and synchronize access, administer trials and refunds, prevent abuse, attribute and pay referral commissions, deliver gifts, provide purchase support, keep financial records, and measure checkout performance. We do not receive your full payment-card number.
• Usage analytics and diagnostics. This includes pages and screens viewed, buttons and features used, navigation, experiment and feature-flag assignments, session and checkout events, app lifecycle events, device and app version, and error, crash and stack-trace information. Where enabled, mobile session replay records a masked representation of the interface; text, images and native views are masked by default. Our analytics tools collect this automatically through app SDKs, browser cookies and similar technologies. After sign-in, analytics are linked to your account ID and email and are not anonymous. We use this data to diagnose failures, secure and stabilize the service, understand feature use, run product experiments, improve the user experience, and measure onboarding and purchase funnels.
• Technical and network data. This includes IP address, approximate country or region, device type, operating system, browser, app version, request headers, cookie or device identifiers, and connection and request timestamps. Your device, browser, hosting providers and app stores supply it automatically when you connect. We use it to deliver and route the service, select an available AI connection, maintain sessions, detect and investigate abuse or security incidents, troubleshoot problems, and comply with legal obligations. We do not collect precise GPS location.
• Communications and form data. This includes the email address, message, attachments and other information you choose to send when you contact us or submit a form. We collect it directly from you and use it to answer the request, provide support, operate the relevant program or promotion, resolve disputes, and keep appropriate business and legal records.

3. How we use it and our legal basis

In summary, we use personal data only to:

• Create and protect accounts and provide the features described in Section 2, including live conversations, speech recognition, translation, feedback, replay, roleplay, memory and session history.
• Personalize the tutor with your settings, profile, local context, past sessions and learning results.
• Save and carry out the call schedule you request, including local reminders and server-sent iOS incoming calls, and let you manage notification choices.
• Process purchases, subscriptions, trials, referrals, gifts, refunds and related support and financial records.
• Respond to support requests and other communications.
• Analyze use, run feature experiments, monitor AI quality, fix errors, and improve usability, performance and reliability.
• Authenticate requests, enforce quotas and terms, prevent fraud and abuse, protect users and the service, investigate incidents, establish or defend legal claims, and comply with law.

For users in the EU/UK, our legal bases are: performance of our contract with you (creating your account, running the tutor, saving sessions and processing purchases); our legitimate interests (securing and improving the service, understanding usage, providing support and preventing abuse); compliance with legal obligations; and your consent where we ask for it (for example, microphone, notifications or non-essential cookies where applicable). Where we rely on consent, you can withdraw it at any time.

We do not sell your data, show third-party ads, use your voice for biometric identification or advertising, or allow service providers to use your voice recordings to train their general-purpose models for their own benefit.

4. When we share data and who receives it

We share personal data only as needed to provide the service, at your direction, or where law requires it. Our direct service providers and the data and purpose relevant to each are:

• Supabase: account and authentication data, profile data, sessions, transcripts, learning results, schedules, push tokens, purchase status and privately stored audio, for authentication, database and file storage.
• Vercel: technical and network data and requests sent to our web and backend services, for hosting, request routing, security and operational logs.
• Google: sign-in data for Google Sign-In; audio, transcripts, prompts, profile or roleplay context and search queries for Gemini, Vertex AI and Google Search grounding; transcript text for Cloud Translation; technical and checkout events for Google Tag Manager and Google Analytics; and purchase data for Google Play Billing.
• Apple: sign-in data for Sign in with Apple; purchase data for App Store and StoreKit transactions; and iOS PushKit tokens and call payloads for delivering scheduled calls through Apple Push Notification service and CallKit.
• RevenueCat: account ID, checkout email, product, transaction, subscription, trial, entitlement, refund, referral and gift-purchase data, for web and in-app billing and keeping access synchronized across platforms.
• PostHog: account ID and email, device and usage events, experiment assignments, masked session replay and error diagnostics, for analytics, feature flags, error tracking and product improvement.
• Soniox: voice clips and limited transcript or roleplay context, for Korean speech-to-text transcription.
• SpeechSuper, Microsoft Azure Speech, and NAVER CLOVA Speech: voice clips and reference transcript text, for pronunciation, fluency and speech scoring. Microsoft Azure and Google may also receive transcript text for on-demand translation.
• Mem0: account and session IDs and ordinary conversation transcripts, for extracting and recalling useful cross-session memories.
• Braintrust: account and session IDs, prompts, transcripts, model outputs, tool calls, errors and token-usage metadata, for AI performance monitoring and evaluation.
• Cloudflare: short-lived connection credentials and real-time audio, prompt and transcript traffic in transit, only when its relay is needed to connect a supported user to Google Vertex AI.
• Open-Meteo: a city name or coordinates and timezone, without your account ID, to provide optional local weather context to the tutor.
• Resend: gift recipient email, sender name, message, gift code and redemption link, when you ask us to send a gift by email.

If you joined through a partner, teacher or creator referral, the referring partner may receive your masked email, registration, trial and subscription status, and commissionable payment amounts so we can attribute and pay the referral. Partners do not receive your conversations, recordings, profile, full email address or payment details. If you send a gift, the intended recipient receives the sender name, message, gift code and redemption link you asked us to provide. We may also disclose data to authorities or professional advisers when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or establish or defend legal claims.

We confirm that every service provider or partner with whom we share personal data must provide the same or equivalent privacy protection described in this policy. We impose this through contracts, data-processing terms, platform agreements and vendor controls as applicable, including limits on purpose and access, confidentiality, appropriate security, breach response, retention and deletion, and equivalent obligations for subprocessors. We remain responsible for overseeing processing on our behalf. We do not share personal data with third parties for their own marketing.

5. International transfers

We and our service providers operate globally, so your data — including audio, transcripts, and analytics — may be processed in countries outside where you live, including the United States, the EU, and Asia. Where data leaves a region with data-transfer rules (such as the EU/UK), we rely on appropriate safeguards, such as standard contractual clauses, to protect it.

6. Cookies and similar technologies

Our web app uses essential cookies to keep you signed in; these cannot be turned off without breaking sign-in. Our website and web app use PostHog cookies and Google Tag Manager or Google Analytics technologies to understand usage and checkout performance. The mobile app uses equivalent SDK and device identifiers and may use masked session replay and error reporting as described above. Where required by law, we ask for your consent before using non-essential technologies. You can block or delete browser cookies in your browser settings.

7. Where data lives and how long we keep it

Account, profile, session, transcript, score, and audio data is generally retained while your account is active so your history and learning features remain available. When you delete your account in Settings, we immediately delete your account-linked records from our primary database and request removal of your private audio from storage; your Apple sign-in grant is also revoked where available. Service-provider copies, cached data and backups are deleted or expire under our instructions and the provider’s applicable retention cycle. Analytics, diagnostic and AI-evaluation records are retained for limited periods under our provider settings. We may retain transaction, tax, fraud-prevention, security, dispute, consent and deletion records for as long as reasonably necessary or legally required. Trial-abuse controls may retain a one-way hash of an email or sign-in identifier after account deletion; this does not contain the original value and is used only to prevent repeated trial claims.

8. Your rights

Depending on where you live, you have rights over your personal data. You can exercise most of them directly in the Settings tab, or by emailing admin@sudamate.com. We will not discriminate against you for exercising them.

• Hong Kong (PDPO). You may request access to, and correction of, the personal data we hold about you.
• Taiwan (PDPA). You may inquire about, review, copy, correct, or delete your data, and ask us to stop collecting, processing, or using it.
• United States (incl. California).You may request to know, delete, or correct your personal information, and opt out of any “sale” or “sharing” — though we do not sell or share your personal information.
• EU/UK (GDPR). You have rights of access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent, and the right to lodge a complaint with your local supervisory authority (in the UK, the ICO).

9. Your choices

• Access and edit. Open the Settings tab to view or change any profile field.
• Delete your account. Settings tab → Delete account. This is immediate and permanent.
• Disable notifications. In iOS or Android system settings, open Sudamate → Notifications. You can also edit or remove scheduled calls in Sudamate Settings.
• Email us. Privacy questions: admin@sudamate.com.

10. Voice data

We process your voice recordings only for the uses listed in Section 2: to power the conversation, transcribe speech, generate pronunciation and fluency feedback, support retakes, and let you replay your own sessions. Audio is disclosed only to the voice, AI, hosting and scoring providers identified in Section 4 when needed for those functions. We do not use your voice for biometric identification, build a voiceprint, recognize you across services, use it for advertising, or sell it.

11. Security

We protect your data with encryption in transit, access controls, and row-level security so that you can only access your own recordings and sessions. No system is perfectly secure, but we work to keep your data safe and will notify you and the relevant authorities of a breach where the law requires.

12. Children

Sudamate is not directed to children under 13, and we do not knowingly collect data from them. In some regions a higher minimum age applies for consent to data processing. If you believe a child has created an account, contact us and we will delete it.

13. Changes

When we update this policy we will revise the effective date above. Material changes will be highlighted on the page for at least 30 days.

14. Contact

Dodamverse, the operator of Sudamate, can be reached at admin@sudamate.com. If you are in Hong Kong and are not satisfied with our response, you may also contact the Office of the Privacy Commissioner for Personal Data (PCPD).