Privacy Policy

Effective: August 19, 2026

Who We Are

BonMotz is a French language learning platform operated from Montreal, Quebec, Canada. When we say "we", "us", or "BonMotz", we mean the team behind the product.

What We Collect

When you create an account or use BonMotz, we may collect:

• Account information — name, email address, and password (stored securely using industry-standard authentication)
• Learning data — lesson progress, exercise results, XP, streaks, and study history
• Writing and conversation content — the text you submit for writing feedback, and your messages to the AI tutor
• Voice recordings — audio you record for pronunciation practice, interview exercises, or spoken conversation practice
• Payment information — processed securely by Stripe. We never see or store your full card number
• Usage data — pages visited, features used, device type, and browser. This helps us improve the product

How We Use Your Data

• To provide and personalize your learning experience, including your AI tutor conversations
• To track your progress across lessons and levels
• To grade writing submissions and transcribe voice recordings
• To process payments and manage your subscription
• To send you important account notifications (never spam)
• To improve BonMotz based on how learners use the platform

What We Don't Do

• We don't sell your personal data. Ever.
• We don't share your data with advertisers

Third-Party Services We Use

We rely on a small number of specialized providers to run BonMotz. We name every one of them here, by category, because a vague description like “a few trusted partners” doesn't let you make an informed decision:

• AI tutoring, writing feedback & placement scoring — DeepSeek, a company headquartered in Hangzhou, China. Your tutor conversations, writing submissions, and placement-test answers are sent to DeepSeek for processing, which means this content is processed in China.
• Speech-to-text (voice transcription) — Deepgram (including live, real-time transcription) and Google Cloud Speech-to-Text. When you record your voice, the audio recording itself — not just a transcript — is sent to one of these providers.
• Speech synthesis (text-to-voice) — ElevenLabs, Deepgram (Aura-2), and Azure Neural TTS (Microsoft). These convert lesson narration, and some tutor replies, into spoken audio.
• Payments — Stripe.
• Email delivery — Resend.
• Media storage — Cloudflare R2, for lesson audio files.
• Hosting — Railway (application and database hosting) and Cloudflare (landing-site hosting and content delivery).

This list reflects who actually receives data today, not who we might use in the future — we keep it current, and we update it before any new provider goes live.

What We Send These Providers

We traced exactly what leaves BonMotz on every call to the providers above. None of these requests carry your name, email address, account ID, or session ID — we don't attach an identifying label to what we send. But that doesn't mean what we send is anonymous. It still includes:

• the text you write — your tutor messages, writing submissions, and placement answers, sent in full;
• a summary of your learning progress (level, streak, XP, lesson history, and similar) that we use to personalize your AI tutor;
• your recent tutor conversation history, replayed on each new message so the tutor has context; and
• your voice recordings, sent in full, whenever speech-to-text is used.

All of this remains your personal information. Text you write can include your name, city, or other personal details if you choose to write about them, and a voice recording is inherently identifying on its own, regardless of what you say.

Cross-Border Data Transfers

Because of the providers above, your personal information leaves Quebec and Canada. Depending on the feature you use, it may be processed in the United States (Stripe, Resend, Cloudflare, Railway, ElevenLabs, Google, Azure) or in China (DeepSeek, for tutor conversations, writing feedback, and placement scoring). Before communicating personal information outside Quebec, we complete a privacy impact assessment under Quebec's Law 25 (Article 17), and we revisit it whenever our provider lineup changes. That assessment records this transfer's risk rather than eliminating it — in particular, we do not currently have a contractual guarantee from our AI or speech providers about how long they retain what we send them, or whether it's used to improve their own models.

Data Storage & Security

Your data is stored on secure, encrypted servers. We use industry-standard practices to protect your information, including HTTPS everywhere, encrypted passwords, and role-based access controls.

Data Retention

We keep your personal data while your account is active. Most of it — your profile, learning progress, tutor conversations, writing submissions, and test results — is deleted when you request account deletion (see Your Rights, below). We don't yet run this on an automatic timer, so today it happens on request rather than on a fixed schedule.

We do not keep your voice recordings. When you speak to BonMotz, the audio is sent to a speech-to-text provider (listed above), transcribed, and discarded. We keep the transcription; we do not keep the recording. The audio is held in memory for the moments it takes to process — apart from a short-lived working file written during audio format conversion and deleted immediately afterwards — and no BonMotz database or file store holds it.

The one exception, and it is time-limited: the placement test's speaking section. That section is scored from the original audio rather than from a transcript, so your recordings are stored with your attempt from the moment you submit the speaking section until the attempt is graded — usually a few minutes. They are erased as soon as your result is produced, and also if you abandon the attempt without finishing it. After that the attempt keeps only the questions you were asked and the scores you were given. Nothing else in BonMotz stores a recording at any point.

Two categories work differently:

• Billing and invoice records survive account deletion, with your identity intact, because tax and accounting law requires us to keep them. See “Billing Records After Deletion,” below.
• Our internal AI-usage ledger (which provider, how much was used, and its cost) isn't simply deleted on request. Because a raw per-event record can sometimes be traced back to a single learner even without a name attached, our policy is to strip its link to your account and combine it into a broader time-period total instead of deleting it outright. This runs automatically as part of erasing your account; it is no longer a manual commitment.

Removing your data from our live systems doesn't immediately remove it from routine backups. We commit to never restoring a backup in a way that would bring back a learner's data after they've asked us to delete it.

Your Rights

You can ask us to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete information
• Delete your account and the personal data associated with it
• Export your learning data in a structured, commonly used format

Contact our privacy officer (below) to make any of these requests. We respond within 30 days.

How deletion works: once we receive your request, we deactivate your account immediately — you can't log in or keep using BonMotz from that moment on. Your account and its associated personal data are then permanently deleted 14 days later. If you change your mind, you can cancel during those 14 days using the link in the confirmation email we send you — it works without logging in, so a deactivated account is no obstacle. If you no longer have that email, write to us at info@bonmotz.com and we will cancel it for you once we have confirmed the request comes from you. This grace period protects against mistaken or malicious deletion requests (for example, from someone who gained unauthorized access to your account); it doesn't mean we keep using your data during that window, since your account is already deactivated the moment we receive your request.

Decisions Made by Automated Processing

Some decisions about you are made by our systems, with no person reviewing them first. You have the right to know that, and the right to ask a person to review them.

Two automated decisions have a real consequence for your learning:

• Advancing to the next sub-level — the system checks whether you have met every required threshold (lessons completed, exercise average, grammar drills, review tests passed, XP earned). Until one is met, you cannot advance to the next sub-level of your CEFR level.
• The placement test — its result sets your starting level and sub-level, meaning your entire initial curriculum.

Both of those rest in turn on assessments that are themselves automated: the grading of your exercise answers, the grading of your grammar drills, and our AI system's evaluation of your writing. A review test result is an automated decision as well.

What you are shown. Wherever one of these decisions is presented to you — on the gate control's requirements popover, on the placement result screen, and on a review test result — the app states that the determination was automated and lists the factors behind it, with the values measured for you. Where a factor could not be measured, it is shown as undetermined rather than as a number.

A single graded answer. Since 19 August 2026, an individual exercise answer and a piece of writing you submit each also show you the criteria behind the score — every criterion named, with the band or value you were given, and any criterion that was not assessed stated as not assessed rather than shown as a zero. Grammar drills do not show this yet. It is an explanation, not an appeal route: as stated below, a single answer is not contestable on its own.

Asking a person to review a decision. From each of those same screens you can submit your observations and ask a person on our team to review the decision. You can also do this by writing to our privacy officer (below). A person then considers the decision on its merits, not merely whether the rule was applied correctly. We commit to answering within 30 days — that deadline is ours; no law sets one. You receive the reasons for the conclusion, not just the conclusion. If the decision is overturned, the change is applied to your account.

What is not covered. There is no appeal route for a single graded answer or a single grammar drill on its own. If you believe one specific answer was graded wrongly, contest the gate or the review test it feeds and describe it in your observations.

We do not use any of these decisions for advertising or profiling, and none of them has a legal effect on you: they concern only your progress through the course.

Billing Records After Deletion

When your account is deleted, we keep your Stripe customer record, invoices, and subscription-billing history, with your identity intact, because Canadian and Quebec tax and accounting-record law requires it. This is the one category of personal data we don't delete on request.

Legal Bases for Processing Your Data

• Delivering lessons, tracking progress, and running your account — performance of our contract with you
• Personalizing your AI tutor and grading your submissions — performance of our contract with you, since these are features of the service you signed up for
• Billing and invoice records — a legal obligation (tax and accounting law)
• Keeping the platform secure and accounting for AI usage costs — our legitimate interest, balanced against your rights and, for AI usage records specifically, against the risk of re-identifying you from raw usage records (see Data Retention, above)

Privacy Officer & Complaints

BonMotz's privacy officer is Carolina Acosta. Reach her directly at info@bonmotz.com for any question, rights request, or complaint about how we handle your personal information. We aim to give you a substantive response, not just an acknowledgement.

If you're not satisfied with our response, you can escalate your complaint to the regulator for your situation:

• Quebec residents, or complaints about Quebec-governed processing: the Commission d'accès à l'information du Québec (CAI)
• Canadian residents outside Quebec: the Office of the Privacy Commissioner of Canada (OPC)
• EU residents, or complaints about GDPR-governed processing: your national data protection authority

Cookies & Tracking

BonMotz loads no third-party analytics, advertising, or tracking scripts — anywhere on this site or in the app. No Google Analytics, no ad pixels, no session-recording tools. We verified this directly in our code, and it's why you don't see a cookie-consent banner here: showing one would suggest we're doing something we're not. We use only essential cookies, needed to keep you logged in and remember basic preferences like your theme.

Changes to This Policy

If we make meaningful changes, we'll update this page and notify you via email or in-app notification. The date at the top always reflects the latest version.

Contact

Questions about your privacy? Reach us at info@bonmotz.com or use our contact form.