PrivacyPolicy
What Vibe Labs s.r.o. collects when you practise with Mluvím, why, who else sees it, and how to get rid of it. The short version: your voice is never recorded, the text of what you said is kept for 90 days, your data lives in the EU, and the delete button in Settings really deletes.
Last updated 24 August 2026
1.Who is responsible for your data
Vibe Labs s.r.o. is the data controller for the personal data processed in Mluvím. That means we decide what is collected and why, and we are who you hold responsible for it.
- Controller
- Vibe Labs s.r.o.
- Registered office
- Čs. armády 369/7, Bubeneč, 160 00 Praha 6, Česká republika
- Company no. (IČO)
- 23452617
- Register
- Registered in the Commercial Register kept by the Municipal Court in Prague, file no. C 427276
- Privacy contact
- admin@thevibelabs.com
We are not required to appoint a data protection officer and have not appointed one. Privacy questions go to the address above and are answered by the people who run the company.
This notice is written in English and also published in Czech. English is the original and the Czech is a translation of it. Where the two differ, the reading more favourable to you applies.
2.What we collect
We collect what the product needs to work and limited cookieless measurement about how people find and use it. Account-linked measurement is sent only if you allow it. Nothing is sold to anyone.
- Your account. Email address, the name you want to be addressed by, and a password we never see in readable form. Optionally your interface language and time zone.
- Your settings and progress. Chosen voices, playback speed, hints on or off, where you have got to in the learning path.
- Sessions. When a session started and ended, how long it ran, which task and content it used, how many turns were taken, and what it cost us to serve.
- Transcripts. The text of what was said — your turns and the tutor’s — for each session. See the next section, which is about this specifically.
- Written answers. What you typed or chose in a reading, writing or listening task, when you submitted it, the mark it was given and the report that came back — including, in Psaní, the text of the e-mail or form you wrote.
- Feedback. The written report produced after a session or a marked task, and the corrections in it.
- Billing. Which plan you are on, its status and renewal date, your balance of minutes, and a reference to your customer record at Stripe. Card numbers never reach us.
- Technical data. IP address, browser and device information, and server logs, generated whenever anything on the internet is asked for a page.
- Product analytics. Pseudonymous records of which screens are opened and which actions are taken — see section 5.
Your vocabulary list is the exception to all of this: the Czech words you have met, and the sentences they appeared in, stay in your own browser. They are never sent to us, we cannot read them, and clearing your browser data removes them.
We do not ask for and do not want special categories of data — health, beliefs, biometrics, anything of that kind. Please do not volunteer them in a session.
3.Your voice, and what happens to it
We do not record your voice
While a session is running your microphone audio streams directly from your browser to the model that answers you, over an encrypted connection. It is processed to produce a reply and it is not saved — not by us, not to a file, not to a bucket. There is nowhere in this product where a recording of you exists, and there is no column in the database that could hold one.
What is kept is the text. Completed turns — the words you said, and the words the tutor said back — are written to your account so that a session can be marked, a vocabulary list built, and a complaint about a bad correction actually looked into. Voice is not biometric data here: we transcribe what you said, we do not analyse who is saying it, and nothing in the system identifies a person by their voice.
Transcript text is deleted 90 days after the session. The only thing that extends that is an open complaint or quality investigation about the session itself, which holds the whole conversation until it is closed.
You can delete a transcript sooner by closing your account, which removes all of them at once. There is no way for us to un-say something in a transcript while keeping the rest, so treat a session as written down from the moment it is spoken.
4.Why we process it, and on what legal basis
| What | Why | Legal basis |
|---|---|---|
| Account, settings, progress | To give you an account and keep your place in it | Performance of a contract — Art. 6(1)(b) GDPR |
| Sessions and transcripts | To run the conversation, mark it, and build your vocabulary list | Performance of a contract — Art. 6(1)(b) |
| Transcript retention for 90 days | To investigate a complaint about a session or a wrong correction | Legitimate interest — Art. 6(1)(f) |
| Billing and payment records | To take payment, credit minutes and keep the books | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Account email | Sign-up confirmation, password reset, notice of changes | Performance of a contract — Art. 6(1)(b) |
| Product news to your account email | To tell you about features and offers on Mluvím itself — you can stop it in one press, from any such message | Legitimate interest — Art. 6(1)(f); Act No. 480/2004 Coll. § 7 |
| Server logs and security | To keep the service up and to catch abuse | Legitimate interest — Art. 6(1)(f) |
| Product analytics | To see which parts of the product are used and where people get stuck | Consent — Art. 6(1)(a) |
Where we rely on legitimate interest, the interest is running a product that works and can be supported, and we have weighed it against what a learner would reasonably expect. You can object to any of it — see section 9.
About the product news
Because you gave us your address when you created a Mluvím account, we may write to you occasionally about Mluvím itself — a new feature, or an offer on the plans. Czech law allows this without asking first, for our own similar products, as long as we tell you plainly (this paragraph) and make refusing easy. So every one of those emails carries an unsubscribe link, one press ends it for good, and we never pass your address to anyone else to market to you.
Saying no to product news does not affect the emails your account needs — password resets, receipts, and notice of anything that changes about the service. Those are part of running your account rather than marketing, and they continue for as long as the account is open.
6.Who else sees it
The companies below run parts of the product for us. Each is bound by a data processing agreement, may use the data only on our instructions, and may not use it for anything of their own — with one deliberate exception, marked in the table.
| Company | What it does | What it gets | Where | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Accounts, database, authentication | Email, name, settings, progress, transcripts, billing records | EU — Ireland (eu-west-1) | Stays in the EU |
| Vercel | Hosting and delivery of the website and app | Requests, IP address, technical logs | EU and USA | Standard Contractual Clauses |
| OpenAI | The voice conversation, and the written feedback on a finished session or a marked task | Live audio, transcript text, written answers submitted for marking | USA | EU–US Data Privacy Framework and Standard Contractual Clauses |
| StripeOwn controller | Payment, invoicing and VAT, as merchant of record | Email, name, payment details, purchase history | EU and USA | Standard Contractual Clauses |
| Cookieless website and conversion measurement; full analytics after consent | Page and conversion events; after consent, account and conversion identifiers | EU and USA | EU–US Data Privacy Framework and Standard Contractual Clauses | |
| Resend | Account email — welcome, password reset, confirmation | Email address, name | USA | Standard Contractual Clauses |
Stripe is the exception. Because it acts as merchant of record — it is the seller on your purchase, not our payment plumbing — it decides its own purposes for the payment data and is an independent controller of it. Its own privacy policy governs what it does with your card and your invoice; ours governs everything else.
Beyond that list, personal data leaves us only where the law requires it — a lawful request from an authority — or where a professional adviser (an accountant, a lawyer) needs it under a duty of confidence. We do not sell data and have no interest in a business model that would want us to.
7.AI, and the promise that it is not trained on you
The conversation and the written feedback are produced by models run by OpenAI under a business agreement. Under that agreement, what is sent through the API is not used to train or improve their models. That is the default for API customers and we have not opted out of it.
OpenAI retains API content for up to 30 days for abuse monitoring, then deletes it. We do not use your sessions to train anything of our own either — not a model, not a dataset, not a fine-tune.
No decision with legal effect is made about you by a machine. The score at the end of a mock exam is practice output, not a decision: it does not affect your account, your billing, your access, or anything at all outside the screen it is printed on. The real exam is marked by a human examiner who has never heard of us.
8.Where your data is kept
Your account, your progress and your transcripts live in a database hosted in Ireland, inside the EU. That is a deliberate choice rather than a default, and it is where the data that describes you sits at rest.
Two things leave the EU. The live conversation goes to OpenAI in the United States, because that is where the model runs — there is no European alternative for this particular capability today. Account email is sent through a US provider. Both transfers are covered by the safeguards named in the table above: OpenAI is certified under the EU–US Data Privacy Framework and both are additionally covered by the European Commission’s Standard Contractual Clauses.
Product analytics is hosted in the EU. Hosting is served from the region nearest you, which for a Czech learner means Europe.
9.How long we keep it
- Account and progress
- Until you close the account
- Transcripts
- 90 days after the session, then deleted automatically
- Written answers and feedback
- Until you delete them, or until the account is closed
- Vocabulary
- Kept in your browser, never on our servers
- Session and usage records
- Until the account is closed
- Invoices and accounting records
- Up to 10 years, as Czech tax and accounting law requires
- Server logs
- Up to 30 days
- Product analytics
- Up to 12 months
- Support email
- Up to 3 years, in case the same question comes back as a complaint
Closing your account deletes it and everything hanging off it — sessions, transcripts, written answers, reports, corrections and any unused minutes — in one operation, immediately, without anyone at this company reviewing it first. Your vocabulary list goes with it, cleared from the browser you closed the account in.
One thing survives: the record that a purchase happened, with the link to you removed. Czech accounting and tax law requires records of completed transactions to outlive the customer relationship, and Art. 17(3)(b) GDPR permits exactly that. What is left names nobody; the identity of the payer is held by Stripe, under its own retention rules.
10.Your rights
Under the GDPR you have the following rights over your personal data. Write to admin@thevibelabs.com from the address on your account and we will answer within one month. Exercising them is free.
- Access — a copy of what we hold about you, and an explanation of what we do with it.
- Rectification — correction of anything wrong. Your name and settings you can change yourself, in Settings.
- Erasure — deletion. You do not have to ask us for this one: the button is in Settings and it works immediately.
- Restriction — a freeze on processing while a dispute about accuracy or legitimate interest is sorted out.
- Portability — your data in a machine-readable file, for you or for another provider.
- Objection — to anything we do on the basis of legitimate interest, including the 90-day transcript retention.
- Withdrawal of consent — for analytics, at any time. It does not affect what was processed before you withdrew.
We will ask you to confirm you are who you say you are before acting on a request about an account — usually by requiring the request to come from that account’s email address. That is not obstruction; handing an account’s data to whoever asks for it is the failure this prevents.
11.How it is protected
Every connection is encrypted in transit, and data is encrypted at rest by our hosting provider. Passwords are stored as salted hashes and are not readable by us or by anyone else.
Access to your rows is enforced by the database itself, per row, keyed on who is signed in — not by application code that could be got wrong. In practice that means there is no administrative screen where an employee browses learners’ transcripts, because there is no key in the product that would open one.
If a breach ever puts your rights at risk, we will tell the Czech supervisory authority within 72 hours and tell you without undue delay, in plain language, including what we are doing about it.
12.Children
Mluvím is for adults preparing for a residency exam and is not directed at children. We do not knowingly collect data from anyone under 15, which is the age of digital consent in the Czech Republic.
If you believe a child has created an account, write to admin@thevibelabs.com and we will delete it.
13.Changes to this policy
When what we do with data changes, this page changes with it, and the date at the top moves. For a change that materially affects you — a new purpose, a new recipient, a longer retention period — we will email the address on your account before it takes effect.
Where a change needs your consent, we will ask for it rather than assume it from your continued use.
14.Complaining about how we handle your data
Please come to us first — most of it is something we can fix the same day. If you are not satisfied, you have the right to complain to the Czech supervisory authority:
- Authority
- Úřad pro ochranu osobních údajů
- Address
- Pplk. Sochora 27, 170 00 Praha 7, Česká republika
- posta@uoou.gov.cz
- Web
- uoou.gov.cz
If you live in another EU member state, you may complain to the supervisory authority there instead.
Get in touch