Saam: Learn & Speak Thai · Last updated: 2026-11-02
Saam is operated by Daniel Roca, an individual developer ("we", "us"; the operating company will replace this once it is formed). We are the controller of your personal data. Contact: hola@saamfluent.com.
| Data | Why we use it | Legal basis (GDPR/UK GDPR/PDPA) |
|---|---|---|
| Account: email address, password (stored hashed by our auth provider), account ID, or the identifier and basic profile from Apple or Google if you sign in with them | Create and secure your account | Contract |
| Learning profile: your known and target languages, goals and interests you pick, level estimate, settings, reminder choices | Personalise lessons | Contract |
| Learning activity: answers, review results, session plans and reports, progress and mastery estimates | Run the learning engine and show your progress | Contract |
| Imports: word lists you paste or upload, and words found in images you scan | Add your own vocabulary | Contract |
| Voice and AI lessons: live audio, AI requests, and (only if you choose) text transcripts | Provide the AI tutor | Contract |
| Purchases: subscription status, product, renewal and expiry dates, store transaction references (no card details) | Unlock paid features, enforce usage limits | Contract; legal obligation for records |
| Usage counts: AI requests, voice minutes, scans, costs and timing per session | Fair-use limits, abuse prevention, service quality | Legitimate interests |
| Technical data: a random installation ID, IP address, device and app version, error codes, request IDs | Security, sync, troubleshooting | Legitimate interests |
| Optional analytics: fixed-category events such as "lesson completed", counts, and how you found the app | Improve Saam | Consent |
We do not ask for your name, birth date, location, contacts or payment card details. Our legitimate interests are keeping the service secure, reliable and affordable to run; you can object to this processing (section 9).
When you start a voice lesson or record yourself, the app asks for microphone access and uses the microphone only then. Recordings you make to compare your voice stay on your device, are never uploaded, and are deleted when you move to the next step. During a voice lesson, your audio travels from your device to OpenAI over an encrypted connection; it does not pass through our servers and we never store your audio. Our server gives OpenAI the lesson plan and the vocabulary you are practising, plus a salted, one-way pseudonymous identifier for abuse prevention (never your email).
OpenAI converts your speech to text to run the conversation. That text is shown as live captions and is discarded when the lesson ends, unless you choose in Profile to keep transcripts for 7 or 30 days. You can delete saved transcripts at any time in Privacy & data. Session reports and learning results (for example, which words you used correctly) are kept as part of your learning history.
We send these requests with OpenAI's storage option turned off. OpenAI states that it does not use API data to train its models by default and may keep it for up to 30 days to detect abuse.
AI output can be wrong. Your progress is calculated by our own rules, not by the AI, but AI feedback, corrections and explanations may still contain mistakes.
During setup we ask whether you want to share usage analytics. Until you answer, nothing is sent. If you say yes, the app sends fixed events (such as "session completed") with counts and timestamps, linked to your account ID. They never contain lesson text, transcripts, audio, images, your email or payment details. If you say no or later switch analytics off in Profile, we stop collecting and delete the analytics events already linked to you. Analytics events are deleted after 13 months.
On the website, if you say yes, we also use Google Analytics to see which pages and campaigns work. It sets cookies in your browser and receives those same fixed events, without your account ID. Google Analytics is not loaded until you say yes, and saying no removes its cookies. The phone apps do not use Google Analytics.
We may test variations of features. Variants are assigned from your account ID; recording which variant you saw requires analytics consent.
We use service providers that process data for us under contract and only for the purposes below:
| Provider | Purpose |
|---|---|
| Supabase | Hosting, database, sign-in, account emails, file storage, server functions |
| OpenAI | AI tutor (voice and text), speech-to-text, image scans, pronunciation audio |
| RevenueCat | Managing subscriptions and purchases, linked to your account ID only |
| Apple and Google | App stores, payment processing, and "Sign in with Apple/Google" if you use it |
| Our cloud server host | A small server we run that tracks voice-call minutes; it never receives audio |
| Hostinger | Hosting the website and our email |
| Website analytics, only if you say yes |
Apple and Google process payments as independent controllers under their own privacy policies. We never see your card details. Reminder notifications are scheduled on your device; we do not use a push-notification service.
We may disclose data if required by law, to protect users or the service, or to a successor if Saam is sold or merged (with notice to you).
Our database is hosted in the European Union. OpenAI, RevenueCat and some of our other providers are based in the United States and may process data there or elsewhere. Where data leaves the EEA, the UK or Thailand, we rely on safeguards recognised by law, such as adequacy decisions (including the EU–US Data Privacy Framework where the provider is certified) or standard contractual clauses. You can ask us for details.
| Data | Kept |
|---|---|
| Account, learning history, imports | Until you delete your account |
| Voice audio, scanned images | Not stored by us (OpenAI: up to 30 days, as above) |
| Voice transcripts | Not kept by default; 7 or 30 days if you choose, or until you delete them |
| Analytics events | 13 months, or until you withdraw consent |
| Data export files | Download link valid for 5 minutes; file deleted within 7 days |
| Server logs (no lesson content) | Up to 7 days |
| Backups | Overwritten within 30 days |
| Deletion record | 3 years, as a one-way hash with no account data, to prove the deletion happened |
Learning data on your device is stored in the app and is erased when you delete your account in the app or uninstall it.
Depending on where you live, you can ask to access, correct, delete or download your data, restrict or object to processing, and withdraw consent at any time (this does not affect earlier processing). In the app:
For anything else, or if you cannot use the app, email hola@saamfluent.com from your account email. We answer within one month (45 days for California, 30 days for Thailand where required) and may need to confirm your identity. We do not make decisions with legal or similarly significant effects about you by automated means.
You can complain to your data protection authority, for example the Spanish AEPD (aepd.es), the UK ICO (ico.org.uk) or Thailand's PDPC (pdpc.or.th). We would appreciate the chance to help first.
Saam is not intended for children. You must be at least 16 years old to use it. If we learn that we hold data from someone under 16, we will delete it. Parents or guardians who believe this has happened can contact us.
We use encryption in transit, per-user access controls in the database, secure on-device storage for sign-in tokens, and keep AI and service keys on our servers only. On the web version, your sign-in session is kept in your browser's local storage; we use no advertising cookies, and analytics cookies only if you say yes. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.
In the last 12 months we collected: identifiers (email, account and installation IDs, IP address); commercial information (subscription records); internet or electronic activity (app usage, with consent, and technical logs); audio information (voice, processed live by OpenAI); inferences about your language level; and account login details. Sources and purposes are described above. We disclose these categories only to the service providers in section 6, for business purposes. We do not sell or share personal information (including for cross-context behavioural advertising) and do not use sensitive personal information except to provide the service. You have the rights to know, delete, correct and not be discriminated against for using them; an authorised agent may act for you with proof of authority.
We process personal data under the Personal Data Protection Act B.E. 2562 (2019) on the bases in section 2. Your rights include access, portability, objection, erasure, restriction, correction and withdrawal of consent. Contact hola@saamfluent.com.
We will update this policy when the app changes. We will show the new date above and tell you in the app before material changes take effect.
Daniel Roca · hola@saamfluent.com