Privacy policy

Who is responsible

Phonumi is run by Acadezone. Acadezone is the controller for the personal data described here, under the EU General Data Protection Regulation (GDPR) and Türkiye's Personal Data Protection Law No. 6698 (KVKK). When a school signs data-processing terms with us, the school is the controller for its teachers' data and we process it on the school's behalf.

For questions about privacy or your rights, email bilgi@acadezone.com.

What Phonumi is for

Phonumi helps teachers and reading specialists make decodable reading lessons. Accounts are for adults. Children don't sign in, and Phonumi doesn't need student names or records: reading groups are described by the sounds they have been taught. Please keep student names out of the texts and notes you write.

What we collect and why

• Account: your email address and sign-in records, to sign you in with an email link and run your workspace. Legal basis: our contract with you (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• Your content: lesson packs, texts, reading group profiles and the family links you create, to provide the service. Legal basis: contract.
• Usage records: which packs were made, how much of your plan's allowance is used and the AI usage behind it, to apply plan limits, prevent misuse and control costs. Legal basis: contract and our legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Billing: your plan, the status of your subscription and the customer and subscription identifiers from our payment provider. Card details go straight to Stripe; we never see them. Legal basis: contract and our duty to keep accounting records (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
• Requests: when you ask about a pilot or a school quote, the details you enter (email, name, school, role, team size, message), to answer you. Legal basis: steps before a contract, or our legitimate interest in answering.
• Technical data: the IP address, browser and time of each request, kept for a short time by our hosting provider for security and troubleshooting. Legal basis: legitimate interest.

You need an email address to have an account; everything else you give us is up to you. We don't sell personal data, use it for advertising or make automated decisions about you.

Children and families

Family links show one group's lesson to families without a sign-in. The family page sets no cookies and asks for nothing: it loads the lesson and its read-aloud audio, which leaves only the usual request records with our hosting provider. Phonumi isn't directed at children, and we don't knowingly collect personal data from children.

AI features

To draft lesson texts, we send your topic and objective, the group's sounds and word lists, and the draft to an AI model from Anthropic through Vercel's AI Gateway. When you ask for replacement words, we send the sentence and the word to replace. Read-aloud sends the approved lesson text the same way to a voice model from Microsoft; each audio file is made once, stored privately and reused for the same text. Phonumi never asks for student data, and we work with providers and settings that don't use this content to train their models.

Cookies and local storage

We use only the cookies needed to keep you signed in to the workspace. There are no advertising or analytics cookies. Your print choices, such as color or black and white, are remembered in your browser's local storage and don't leave your device.

Who processes data for us

These companies process data on our behalf, under contracts that limit them to the purposes above:

• Vercel Inc. (USA): hosting of the website and app; AI Gateway.
• Supabase Inc. (USA; data stored in the US East region): database, sign-in and private file storage.
• Stripe (USA and Ireland): payments and invoices.
• Resend (USA): sending sign-in emails.
• Anthropic PBC (USA): drafting lesson texts and suggesting replacement words. If Anthropic is unavailable, the same model can run on Google Cloud (Vertex AI) or Amazon Web Services instead.
• Microsoft Corporation (Azure, USA): read-aloud voices.

Transfers abroad

Our providers store and process data in the United States. Where the law requires it, these transfers rely on the safeguards it provides, such as standard contractual clauses or the EU–US Data Privacy Framework, and, for Türkiye, the safeguards in Article 9 of KVKK.

How long we keep data

• Account and content: while your account exists. When you ask us to delete your account, we delete it and its content, including its family links, within 30 days.
• Read-aloud audio files: they contain only lesson text and stay in our audio cache after an account is deleted, no longer linked to it.
• Billing records: as long as tax and commercial law require, up to 10 years.
• Requests: up to 24 months after our last contact.
• Request records at our hosting provider: a short time, usually a few days.

Backups are overwritten on their regular cycle.

Your rights

You can ask for access to your data, its correction or deletion, restriction of its use and a copy in a portable format, and you can object to processing based on legitimate interest. In Türkiye these include your rights under Article 11 of KVKK. Email bilgi@acadezone.com; we answer within 30 days. You can also complain to a data protection authority: in Türkiye the Personal Data Protection Authority, in the EU the authority where you live or work.

If you are in the United States

We don't sell or share personal information for targeted advertising. Phonumi doesn't need student education records, and teachers shouldn't enter them. You can use the rights described above wherever you live.

Security

Data is encrypted in transit. Each workspace's data is kept apart by access rules in the database, staff access is limited to what support needs, and admin sign-ins and changes are logged.

Changes

When our practices change, we update this page and tell signed-in users about significant changes. The date at the top shows the current version.