Privacy Policy
1. Who we are
Antheo is a personal, sentence-based language-learning application. You record or type sentences from your own life, our service translates them, generates native-speaker audio, and lets you drill them until they become automatic.
The data controller responsible for your personal data is:
Greenlight Software LLC A limited liability company registered in Wyoming, USA Operations based in Barcelona, Spain Privacy contact: privacy@antheo.app
Greenlight Software LLC decides how and why your personal data is processed. The third-party providers listed in Section 6 act as our processors (or, in a few cases, independent controllers), processing data on our behalf or under their own terms as described.
If you have any question about this policy or wish to exercise your rights, contact us at privacy@antheo.app.
2. Who this policy applies to
Antheo is intended for adults and is not directed to children under 16. Child-specific accounts are not currently available. See Section 11 for details on children’s data.
This policy covers the Antheo application (web/PWA and, where applicable, iOS) and the marketing website at antheo.app. It does not cover third-party services we link to, which have their own privacy policies.
3. The data we process
We process two broad categories of data: information you provide and information collected automatically when you use the service.
Information you provide
| Data | Where it comes from | Why we process it |
|---|---|---|
| Email address and password | Account sign-up / login (Supabase Auth) | To create and secure your account and authenticate you. Passwords are stored in hashed form by our authentication provider; we do not see your plaintext password. |
| Sentence text (your source-language sentences) | Typed by you, or transcribed from a recording | Core feature, to translate and let you drill your sentences. |
| Translation text | Generated by AI, editable by you | Core feature. |
| Voice recordings (stored-recording path) | Your microphone, when you choose to keep your own recording as the playback audio | Stored as the source-language playback audio for sentences you create this way. |
| Generated audio (MP3) | AI text-to-speech (ElevenLabs) | Native-speaker playback audio for your sentences. |
| Decks, tags, sentence status, and preferences | Your actions in the app | To organise your library and run drilling/training modes. |
Information collected automatically
| Data | Source | Why we process it |
|---|---|---|
| Transient voice recordings (typed / AI-voice path) | Your microphone | When you use a recording only to produce text (e.g. speech-to-text), the audio is sent to a transcription provider, converted to text, and then discarded, never stored. |
| Usage analytics (if and when we add it) | A privacy-conscious analytics tool, loaded only with your consent where required | To understand product usage and improve the service. We do not currently run analytics. |
| Server logs and IP address | Our hosting and network providers (Vercel, Cloudflare, Supabase) | Security, abuse prevention, and reliable delivery of the service. |
| Transactional email events | Our email provider (if and when used) | To send essential account emails (e.g. verification) and confirm delivery. |
Special-category / sensitive data
Voice recordings can constitute sensitive data because the human voice is biometric-adjacent. We treat all voice data with particular care:
- On the stored-recording path, your recording is kept as your sentence’s playback audio until you delete it or close your account.
- On the transient path, your recording is used only to generate text and is then immediately discarded.
We do not use your voice to identify you and we do not create voiceprints or biometric templates.
4. How we use your data, and our legal bases (GDPR)
Where the EU/UK General Data Protection Regulation applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the service: translating, generating audio, storing your sentences, and running drilling/training modes | Performance of a contract (our Terms of Service) |
| Authenticating you and keeping your account secure | Performance of a contract |
| Security, abuse prevention, logging, and maintaining service integrity | Legitimate interests (keeping the service safe and reliable) |
| Analytics and any non-essential cookies | Consent |
| Marketing or coaching emails, if we ever send them | Consent |
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, you may object (see Section 9).
5. AI processing, an important disclosure
Antheo’s core features depend on third-party AI providers. You should read this section carefully.
To translate your sentences and generate audio, your sentence text and, on the stored-recording path, your audio are sent to third-party AI processors:
- Anthropic (Claude) receives your source text and translation text to produce translations.
- OpenAI (Whisper) receives a recording transiently to transcribe speech to text; the audio is not retained by us and is processed only to return text.
- ElevenLabs receives sentence text to generate native-speaker audio.
Some of these providers are located in the United States, so using these features involves an international transfer of your data (see Section 7). This includes the transient transcription step, in which a recording is briefly sent to a US-based provider before being converted to text and discarded.
We use these providers under their commercial/API terms, which provide that they do not use API data to train their models and apply limited retention windows for operational and abuse-monitoring purposes (typically on the order of weeks). We keep our subprocessor terms under review; if a provider’s terms change in a way that affects you, we will update this policy.
6. Who we share your data with (subprocessors)
We share data only with the providers needed to run the service. We do not sell your personal data.
| Provider | Role | Data it processes | Location |
|---|---|---|---|
| Supabase | Authentication, database, and file storage | Email, sentence text, stored audio | EU region |
| Vercel | Static hosting and serverless functions | Request data, IP address, and the text/audio passing through to AI providers | US / global edge |
| Anthropic (Claude) | Translation | Source and translation text | US |
| OpenAI (Whisper) | Speech-to-text | Recorded audio (transient) | US |
| ElevenLabs | Voice generation (text-to-speech) | Sentence text | US |
| Cloudflare | DNS, CDN, and proxy | IP address, request metadata | Global edge |
| Analytics provider (only if we introduce analytics) | Analytics | Pseudonymous identifiers, IP address, events, device data | Varies |
| Email provider (e.g. Resend) | Transactional email, if used | Email address, email content and delivery metadata | US |
| Apple / Google (in-app purchases, when introduced) | Payments and subscriptions | Purchase and receipt data (they, not we, hold your card details) | US |
We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and our service.
Each provider operates under its own privacy policy. We keep this subprocessor list current; whenever we add a provider that touches your data, we update this policy before that data flow goes live.
7. International data transfers
Your account data and stored sentences/audio are held in the EU (Supabase). However, several of our AI and infrastructure providers are located in the United States or operate globally, so your data is transferred internationally when you use the service.
For these transfers we rely on appropriate safeguards, namely the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, certification under the EU–US Data Privacy Framework. You can request more information about these safeguards at privacy@antheo.app.
8. How long we keep your data
- Sentences and stored audio: kept until you delete them or close your account.
- Transient recordings (transcription path): discarded immediately after transcription; never stored.
- Account data (email, preferences): kept for the life of your account.
- Server logs and analytics: kept for a limited period for security and product purposes, then deleted or anonymised.
If you stop subscribing to a paid tier in the future, your library may be locked rather than deleted, but “locked” never means “unextractable.” You can still export your data and request its permanent deletion at any time.
When you close your account, we delete your sentences and audio (our deletion cascades to remove associated audio files from storage), subject to any limited retention required for legal or security reasons.
9. Your rights
If the GDPR / UK GDPR applies to you
You have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data (“right to be forgotten”).
- Export / port your data in a portable format.
- Restrict or object to certain processing.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD); you may also contact the authority in your own country.
We support deletion through per-user data isolation and cascade-delete, and we provide data export on request (an in-app export option is being added).
If you are in California (CCPA/CPRA)
You have the right to:
- Know what personal information we collect and how we use it.
- Access and delete your personal information.
- Correct inaccurate personal information.
- Opt out of the “sale” or “sharing” of personal information, note that we do not sell or share your personal information as those terms are defined under California law.
- Non-discrimination for exercising your rights.
To exercise any right, email privacy@antheo.app. We will verify your request and respond within the timeframes required by applicable law (generally one month under GDPR, 45 days under the CCPA).
10. Microphone use
Antheo asks for microphone access only so you can record sentences. Recording is always initiated by you. There are two paths:
- Stored-recording path: you choose to keep your own recording as the playback audio; it is stored with your sentence.
- Transient path: your recording is used only to generate text (speech-to-text) and is then discarded; nothing is stored.
The app does not listen in the background or record without your action. This mirrors the purpose string shown on iOS when the app requests microphone permission.
11. Children
Antheo is not directed to children under 16, and we do not knowingly collect personal data from children. Child-specific accounts are not currently offered.
If we learn that we have collected personal data from a child without appropriate consent, we will delete it promptly. If you believe a child has provided us with personal data, contact privacy@antheo.app.
If we introduce child accounts in the future, we will update this policy and apply additional protections, including parental consent mechanisms required under GDPR (Article 8) and the US Children’s Online Privacy Protection Act (COPPA), and a strict non-retention rule for any child’s voice recording (transcribed, then discarded).
12. Security
We take reasonable technical and organisational measures to protect your data, including:
- Provider API keys held server-side; they are never exposed to your browser.
- Access to the service gated behind authentication.
- Per-user data isolation (row-level security) so users can only access their own data.
- Encryption of data in transit.
No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your data and to address vulnerabilities responsibly.
13. Cookies, analytics, and tracking
We use a small amount of storage on your device:
- Essential storage: your authentication session, app preferences, and an offline cache that lets downloaded content play without a connection. This is necessary for the service to work and does not require consent.
- Analytics: we do not currently use analytics or non-essential cookies. If we add analytics in the future, in the EU/UK it will load only after you consent via a cookie/consent banner, we will apply consent mode, and we will update this policy. You will be able to decline or withdraw consent at any time.
We do not use your data for cross-app or cross-site advertising and do not track you across other companies’ apps or websites.
14. Changes to this policy
We may update this policy as the service evolves or as we add or change providers. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Continued use of the service after an update means you accept the revised policy.
15. Contact
For any privacy question or to exercise your rights:
Greenlight Software LLC Email: privacy@antheo.app
If you are in the EU/UK and are not satisfied with our response, you may contact your local data protection authority (in Spain, the AEPD at www.aepd.es).