Privacy Policy

WiseBear ("we", "us") is an AI language school for English and Chinese learners (IELTS, VSTEP, TOEIC, HSK and more), available at wisebear.online and as the WiseBear app for iOS and Android. It is built and operated by WiseBear, an education technology startup based in Hanoi, Vietnam, founded in April 2026. Contact: [email protected].

When you use the Service we collect:

• Account data — email address, hashed password (if you set one), the Google or Apple account identifier if you sign in with Google or Apple, timezone, and optionally your birth year and preferred form of address.
• Your learning content — essays and answers you write, your speaking turns as text, chats with the Lumi assistant, flashcards, and the feedback, scores and model answers generated for them.
• Voice recordings — when you practise speaking, the recording of each answer is sent to our server only to turn it into text. The audio is not stored after transcription; the text is kept with your session.
• Learning progress — courses, skill levels, estimated scores, lesson and practice history, weekly usage counts.
• Usage and diagnostics — first-party analytics we run ourselves: pages opened, buttons used, time spent, error messages, device type and a one-way hash of your IP address. We do not use third-party trackers or advertising SDKs and we do not track you across other apps or websites.
• Payment data — for plans bought on the website by bank transfer: the transfer amount, its reference text and the bank transaction id. We never see card or bank login details. The mobile apps do not sell anything.
• Device push token — in the mobile apps, only if you allow notifications, so we can send you reminders and results.

• To provide the Service: marking and feedback, speaking practice, lessons, progress tracking and reminders.
• To pitch examples and tone to your age and preferences, if you give them.
• To send transactional emails (email verification, important account notices).
• To keep the Service working and improve it (analytics and error reports).

We do not sell your data, we do not show ads, and we do not use your content to train AI models.

To produce feedback, some of your content is processed by these providers under their API terms:

• DeepSeek — essays, answers, speaking text and chats are sent for marking, feedback and lesson generation.
• OpenAI — speech-to-text (Whisper) for speaking practice when our own transcription server is unavailable, and some illustration images.
• Google (Gemini) — turns the AI partner's lines into speech. Only the AI's text is sent, not your data.
• Google / Apple sign-in — if you choose them, they confirm your identity and email to us.
• Resend — delivers our emails; it receives your email address.
• Cloudflare — network delivery and protection for wisebear.online.
• SePay — notifies us of incoming bank transfers for website purchases.
• Firebase Cloud Messaging / Apple Push Notification service — deliver push notifications in the mobile apps.
• OpenAI (ChatGPT Ads measurement pixel) — tells us whether our ads in ChatGPT lead to sign-ups and purchases. It receives which step happened (pricing viewed, account created, checkout started, plan bought, with the plan and price) and a first-party cookie from the ad click. It never receives your essays, speech, chat or email address.

We keep your account data and content while your account exists. Analytics events are deleted automatically after a limited period.

You can delete your account at any time in Account → Delete account (website and apps). Deletion is immediate and permanent: your profile, courses, essays, speaking sessions, flashcards, progress, notifications, device tokens and analytics are erased. Records of website payments are kept without any link to you, as required for accounting. You can also email us to request deletion.

You may at any time:

• Request a copy of your personal data.
• Request correction of inaccurate data.
• Delete your account and data (in the app, or by email).

To exercise any of these rights, email [email protected].

Passwords are hashed using bcrypt. Data is transmitted over HTTPS. We take reasonable technical measures to protect your data, but no system is perfectly secure.

The Service is not directed at children under 13. We do not knowingly collect data from children under 13.

We may update this policy from time to time. Material changes will be communicated by email. Continued use after the effective date constitutes acceptance.

For privacy questions, contact [email protected].