Privacy Policy

溫言有限公司 (GentleSpeak Co., Ltd.) (“GentleSpeak,” “we,” “us,” or “our”) is the data controller responsible for the personal data collected through the GentleSpeak website and online class platform (the “Service”). We are established in Taiwan and are responsible for the handling of your personal data in accordance with the Personal Data Protection Act of Taiwan (“PDPA” / 《個人資料保護法》).

To contact us about your personal data or this policy, please email contact@gentlespeak.com.

We collect the following categories of personal data, depending on your relationship with us:

• Students & families. Student name, age, parent or guardian name, email address, phone number, English level, assigned class day and time, access code, enrollment status, package type and dates, number of classes completed and remaining, credits, and payment and balance information.
• Teachers. Name, email address, access code, area of speciality, photograph, class load, and pay information.
• Account & activity records. Login and authentication records, including email address, user role, event type (sign-up, sign-in, sign-out), timestamp, IP address, device, browser, operating system, and approximate location (country and city) derived from the connection.
• Class & learning records. Attendance, class reports (books, pages, topics, notes, homework), quiz attempts and scores, and per-class student updates shared by teachers with families.
• Payment records. Transaction amount, type, status, and date processed through our payment provider.
• Communications. In-app notifications and the contents of messages you send to us, such as support or data-request emails.

We use the personal data described above for the following purposes:

• To enroll students in classes, assign levels, schedule sessions, and manage class rosters.
• To deliver the Service, including attendance tracking, progress reports, quizzes, and communication between teachers and families.
• To process payments, issue receipts, and maintain billing and balance records.
• To create and manage user accounts, verify identity, and secure access to the Service.
• To respond to your inquiries, provide support, and send Service-related notifications.
• To meet our legal, accounting, and tax record-keeping obligations under Taiwanese law.

We collect and process your personal data on the following lawful bases under the PDPA:

• Consent. You or your child’s parent or guardian has consented to the collection, processing, and use of the personal data for the purposes described above.
• Performance of a contract. Processing is necessary to provide the classes and services you have enrolled in.
• Legal obligation. Processing is necessary to comply with our legal, accounting, or tax duties under Taiwanese law.
• Legitimate interests. Processing is necessary for the operation, security, and improvement of the Service, to the extent permitted by the PDPA and balanced against your rights.

The Service is designed for children and adolescents learning English. We do not knowingly collect personal data directly from children. A student’s personal data is provided by, and collected from, a parent or legal guardian who enrolls the student and creates the account.

By enrolling your child, you confirm that you are the parent or legal guardian and that you consent to the collection and use of your child’s personal data as described in this policy. You may withdraw your consent or request deletion of your child’s data at any time by contacting us at contact@gentlespeak.com. Our approach to keeping children safe in class — including how class recordings are handled — is set out in our Child Safety & Safeguarding Policy. How we may use your child’s photo, video, or work for marketing, and how to opt out, is set out in Section 13 (Photo, Video & Recording Consent) below.

We retain student and parent personal data for three (3) years after a student leaves the program. We retain records for longer where a longer period is required to comply with our legal, accounting, or tax obligations under Taiwanese law (for example, certain financial and tax records may be retained for the period mandated by the relevant authorities).

When personal data is no longer needed and no legal requirement applies, we will delete it or anonymize it so that it can no longer be associated with you.

The Service is built on third-party cloud infrastructure (Base44) whose servers may be located outside of Taiwan. This means your personal data may be transferred to, stored in, and processed in countries or regions outside Taiwan.

Where we transfer personal data outside Taiwan, we take measures to ensure the transfer is carried out in accordance with the PDPA, including by working with processors that provide appropriate safeguards for the protection of personal data.

We use the following categories of third-party service providers to operate the Service:

• Cloud hosting & platform. Base44, which hosts the application, database, and file storage.
• Payments. Stripe, which processes payments on our behalf. Payment data is handled by Stripe in accordance with its own policies and applicable payment regulations.
• Email delivery. Providers that transmit Service-related emails and notifications to you.

These providers act as processors on our behalf and are bound to protect your personal data. We do not sell your personal data to third parties.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include access controls, authentication, encryption of data in transit, and regular review of access permissions.

No method of transmission or electronic storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

Under the PDPA, you have the following rights regarding your personal data:

• Access & copy. Request access to, or a copy of, the personal data we hold about you.
• Correction. Request that we correct inaccurate or incomplete personal data.
• Deletion. Request that we delete your personal data, subject to legal retention requirements.
• Cessation of processing & use. Request that we stop processing or using your personal data for certain purposes.
• Withdrawal of consent. Withdraw your consent to the collection, processing, or use of your personal data at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at contact@gentlespeak.com. We will respond in accordance with the timelines required by the PDPA.

To submit a data access, correction, deletion, or consent-withdrawal request, or to ask any question about this policy or your personal data, please email contact@gentlespeak.com. Please include enough information for us to identify you and your request.

We may update this privacy policy from time to time to reflect changes in our practices, the Service, or applicable law. When we do, we will revise the “Effective Date” below and, where the changes are material, provide notice through the Service. We encourage you to review this page periodically.

GentleSpeak sometimes uses photos, videos, class recordings, student artwork, testimonials, and quotes to show families what our classes are like. This section explains what we may use, how we use it, and how you can say no at any time.

We do not assume automatic permission. Marketing use of your child’s image or work is optional, and you can withdraw it whenever you want — even after we have already started using something.

What we may use. With your consent, GentleSpeak may use the following for marketing, social media, and educational promotion:

• Photographs of your child taken during a class or event.
• Video clips from a class or a recording of a class.
• Class recordings — short excerpts only, never a full class.
• Student work — drawings, writing, or other artwork your child creates in class.
• Testimonials — written comments from you or your child about your experience.
• Student quotes — a short thing your child said in class that we think shows what GentleSpeak is about.

How we use it. We may use the content above on the GentleSpeak website and landing pages, GentleSpeak social media accounts (for example Instagram, Facebook, or YouTube), printed flyers, banners, and event materials, paid advertising, and internal training for our teachers — never shared outside GentleSpeak. We will never publish a child’s full name next to their photo or video. We use first names only, or no name at all, and never share a child’s personal details (such as age, school, or contact information) in any marketing material.

Class recordings. Class recordings exist first and foremost for child safety, as described in our Child Safety & Safeguarding Policy. Recordings are stored securely, kept for 90 days, and then deleted. They are not public and are not shared with other families. A recording may be used for marketing only if you have given consent under this section, and even then only as a short, edited excerpt — never a full class. If you withdraw consent, we stop using any excerpt of your child and remove it from our marketing channels.

How consent works. By default, consent is on unless you say no. When your child is enrolled, GentleSpeak may use their photo, video, artwork, or testimonial for marketing. This keeps things simple for families who are happy to be featured. But it is always your choice. You can opt out at any time, for any reason, and you do not need to explain why. If you opt out, we will stop using your child’s image and work in marketing and will remove anything already published where reasonably possible. Opting out of marketing use does not affect your child’s classes, enrollment, or the internal safety recordings described in our Child Safety policy. Those recordings continue regardless of marketing consent.

How to withdraw consent. To opt out or to change your mind later, email us at contact@gentlespeak.com with your child’s name (and the email on your GentleSpeak account, if different) and a short note saying you do not want your child’s photo, video, or work used for marketing. We will acknowledge your request within 3 business days and confirm once it has been actioned. After that, we stop using any new content of your child for marketing, remove already-published content from our website and social media where reasonably possible, and do not reuse already-printed content in future print runs. You can also re-give consent later if you change your mind again — just email us.

Testimonials & quotes. If you or your child writes a testimonial or says something we would like to quote, we will ask you before we publish it. We use first names only and never publish a child’s full name, age, school, or other identifying details next to a quote. You can ask us to remove a testimonial or quote at any time by emailing contact@gentlespeak.com.

Safeguards. Even with consent, we follow these rules: we never publish a child’s full name with their image; we never share a child’s personal details in marketing; we never use content that a parent or child is uncomfortable with, even if consent was given; we never sell or give student images or recordings to third parties; and any content we use is stored securely with access limited to GentleSpeak staff who need it.