Departi — Privacy Policy
Last updated: 2026-07-24
This policy explains what personal data Departi collects, why, who it is shared with, how long it is kept, and your rights. It applies to departi.net, app.departi.net, and the Departi mobile app (the “Service”).
Controller: Departi Technologies Limited, company number 816617, 21 The Wood, Oldbridge Manor, Drogheda, Co. Meath, A92 AD9R, Ireland. Privacy contact: privacy@departi.net
Departi is established in Ireland, so the EU General Data Protection Regulation (GDPR) applies to all our processing. For users in Brazil, the Lei Geral de Proteção de Dados (LGPD) also applies.
1. Data we collect
Account and profile. Name, email address, password (stored only as a cryptographic hash), avatar; optional phone number; origin country, destination country and city, arrival and departure dates; language preferences. If you sign in with Google or Apple, we receive your account identifier and email from that provider.
Learning data. Lesson progress, XP, streaks, hearts, placement-test answers and estimated level, identified strengths and weaknesses, readiness-checklist status, Hub membership.
Your content.
- Voice recordings you make in speaking exercises, the placement test, and simulations — plus transcripts and AI feedback generated from them.
- CV data: the résumé text, files, and answers you provide to the CV builder, and generated CVs and cover letters.
- Documents you upload to your travel checklist (for example enrollment or visa-related documents).
- Messages you write in chat with Pip (our assistant) and practice exercises.
Purchases. Ticket (Passe) purchase status, price, currency, payment method, and flight date. Purchases are made on our website and card/Pix details are processed by Stripe — Departi never receives or stores your card number.
Usage and device data. Screens and features used, product events (for example lesson completed), device type, operating system, app version, language, and crash reports. Web analytics are collected only if you accept them via the consent banner. IP addresses are used transiently for security rate-limiting and are not stored in our database.
Push tokens. If you enable notifications, the device token needed to send them.
2. Why we process it (legal bases)
| Purpose | Legal basis (GDPR / LGPD) |
|---|---|
| Provide the Service: account, lessons, placement, simulations, CV builder, Hubs, readiness | Performance of a contract (Art. 6(1)(b) / Art. 7 V) |
| Grade your speaking and writing, transcribe recordings, power AI chat and CV generation | Performance of a contract |
| Process Ticket purchases, prevent fraud, keep accounting records | Contract; legal obligation (Art. 6(1)(c) / Art. 7 II) |
| Send transactional email (confirmation, password reset, purchase receipts) | Contract |
| Send WhatsApp study messages | Consent — off by default, opt-in in onboarding/settings (Art. 6(1)(a) / Art. 7 I) |
| Product analytics and session replay (masked) | Consent on web (cookie banner); on the app, legitimate interest with an opt-out toggle in Settings (Art. 6(1)(f) / Art. 7 IX) |
| Error monitoring and security | Legitimate interest (keeping the Service working and safe) |
| Service announcements and material changes | Legitimate interest / legal obligation |
We do not sell personal data, do not use it for third-party advertising, and do not do profiling that produces legal effects.
3. AI processing — read this
Departi’s core features use artificial-intelligence providers. When you use them, relevant data is sent to the provider to produce the result:
- Speaking assessment and simulations: your voice recording (and/or its transcript) is sent to Google (Gemini) and/or Groq (transcription) for grading and feedback.
- Chat with Pip, CV generation and refinement, writing feedback: your text is sent to the configured AI provider — Google (Gemini), Groq, OpenAI, or Anthropic (Claude).
- Lesson and scenario audio you listen to is synthetic voice generated from our own scripts (ElevenLabs / Fish Audio) — no personal data of yours is involved.
These providers process the data on our instructions to deliver the feature. They are based in the United States — see section 5 on international transfers. We send the minimum needed for the feature (your recording/text and the exercise context), not your whole profile.
4. Who we share data with (processors)
| Provider | Role | Data |
|---|---|---|
| Railway (hosting) | Application and database hosting | All service data at rest |
| Cloudflare (R2) | File storage | Uploaded files, voice recordings, documents, generated media |
| Stripe | Payments (website) | Email, purchase details (card data handled by Stripe directly) |
| Google (Gemini), Groq, OpenAI, Anthropic | AI features (section 3) | Voice recordings, transcripts, chat/CV text as needed per feature |
| Meta (WhatsApp Business) | Optional study messages | Phone number, message content — only if you opt in |
| Resend | Transactional email | Email address, email content |
| PostHog (EU-hosted) | Product analytics, masked session replay | Usage events, user id, email, profile properties |
| Sentry | Error monitoring | User id and technical error data only (no request bodies) |
We have data-processing terms with these providers, and they may not use your data for their own purposes except as described in their agreements.
4b. Schools and agencies (recipients, not processors)
If you sign up through a partner school or agency — by their invitation or using their coupon — that organization can see your preparation progress in its own dashboard: your name, your English level and your readiness score. They use this to follow the students they referred.
These organizations are not processors: they do not handle your data on our behalf, but for their own purposes. That is why they are listed separately from the providers in section 4.
We do not share your Pip conversations, your voice recordings, your uploaded documents, or your individual answers with them.
We tell you at signup when a coupon belongs to a school or agency, and you can sign up without the coupon if you would rather not share. If you have already signed up and want this to stop, write to privacy@departi.net.
5. International transfers
Our database and analytics are hosted in the EU/EEA region where available (PostHog is EU-hosted). Some processors — including the AI providers, Stripe, and Cloudflare — process data in the United States. Where data leaves the EEA, we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework (for certified providers) and/or Standard Contractual Clauses. For Brazilian users, these safeguards also serve as the transfer mechanism required by LGPD Art. 33.
6. How long we keep data
| Data | Retention |
|---|---|
| Voice recordings (speaking, simulations) | Deleted automatically after 60 days (feedback/transcripts remain with your account) |
| Pip chat messages | Deleted automatically after 90 days |
| Account, profile, learning data, CV data, documents | Until you delete your account |
| Purchase records | As required by tax/accounting law (typically 6 years in Ireland) |
| Analytics | Per PostHog project retention; deleted on account-deletion request |
Account deletion is available in the app (Settings → Delete account) and on the web, or by emailing privacy@departi.net. It permanently and irreversibly deletes your account and associated data (profile, progress, CVs, documents, recordings). Records we must keep by law (for example purchase/tax records) are retained in minimised form for the legally required period.
7. Your rights
Under GDPR (and equivalently LGPD Art. 18) you can, at any time and free of charge:
- access the data we hold about you and get a copy (portability);
- correct inaccurate data;
- delete your data (right to erasure);
- restrict or object to processing based on legitimate interest;
- withdraw consent (WhatsApp messages, analytics) without affecting prior processing;
- not be subject to purely automated decisions with legal effects — we don’t make any.
To exercise any right, email privacy@departi.net; we respond within 30 days (15 days for LGPD requests where it applies). You can also complain to a supervisory authority: the Irish Data Protection Commission (dataprotection.ie) — our lead authority — your local EU authority, or the ANPD (gov.br/anpd) in Brazil.
8. Children
The Service is for users aged 16 or older. Users under 18 need parental or guardian consent (see Terms of Use). We do not knowingly process data of children under 16; if you believe a child under 16 has an account, contact privacy@departi.net and we will delete it.
9. Cookies and analytics choices
- Web: we use a consent banner. Analytics (PostHog, including masked session replay) run only if you accept. Strictly necessary storage (your session token, language, consent choice) does not require consent. You can change your choice anytime via the “Cookies” link shown on the sign-in and sign-up pages.
- Mobile app: analytics help us fix and improve the app; text inputs and images in session replay are masked. You can turn analytics off in Settings → Privacy.
- We answer “do not track” by simply not tracking: no advertising cookies, no cross-site tracking, no data sale.
10. Security
Data is encrypted in transit (TLS). Passwords are hashed (bcrypt). Mobile sessions are stored in the device Keychain/Keystore. Access to production data is restricted and logged. Payment card data never touches our servers. No system is perfectly secure — if a breach affects your data we will notify you and the authorities as required by GDPR Art. 33/34 and LGPD Art. 48.
11. Changes
We may update this policy. Material changes will be announced in the product or by email at least 15 days before taking effect. The “Last updated” date always reflects the current version.
12. Contact
Departi Technologies Limited · 21 The Wood, Oldbridge Manor, Drogheda, Co. Meath, A92 AD9R, Ireland · Company no. 816617 · privacy@departi.net