NCLC Ready

NCLC Ready Biometric Information Policy

Effective September 23, 2026

Effective date: 2026-09-23 · Version 2026-09-23.1

Summary in plain language

  • NCLC Ready does not collect, capture, store, use or share biometric identifiers or biometric information, including voiceprints.
  • Speaking practice uses your phone's own speech recognizer on the device to turn your voice into text. The audio is discarded as you speak. It is never saved or sent.
  • We ask for a written release (you type your name) before the microphone is used, so you know exactly how voice practice works.
  • If biometric data were ever captured by mistake, we would destroy it immediately, and in any case within the time limits below. We would never sell it or profit from it.

1. Purpose and scope

This is our public written policy on biometric identifiers and biometric information. We publish it for transparency and to meet the laws that require such a policy or regulate biometric data, including the Illinois Biometric Information Privacy Act (740 ILCS 14, "BIPA"), Texas Business and Commerce Code § 503.001 ("CUBI"), Washington RCW 19.375, the Colorado Privacy Act's biometric provisions (C.R.S. § 6-1-1314) and similar laws. It covers the NCLC Ready app, our AI feedback server and our website, operated by the individual operator of NCLC Ready, operating under the Certloom Learning brand (the "Operator," "we," or "us"). Certloom Learning is a brand used by the Operator and is not represented as a corporation or separate legal entity.

2. Definitions

  • Biometric identifier: a retina or iris scan, fingerprint, voiceprint, or scan or record of hand or face geometry, and any other data these laws define as a biometric identifier.
  • Biometric information / biometric data: any information, however captured, converted, stored or shared, that is based on a biometric identifier and used to identify an individual, as defined in the applicable law.
  • A text transcript of what you said is not a biometric identifier: it records words, not the characteristics of your voice.

3. What we do and do not do

We do not collect, capture, purchase, receive, obtain, store, use, sell or disclose biometric identifiers or biometric information. Specifically:

  1. On-device transcription only. When you practise speaking, the speech recognizer built into your phone's operating system (Apple Speech on iOS, the on-device recognizer on Android) converts your voice to text on the device. The app requires on-device mode and is designed never to use online recognition. If on-device French recognition is unavailable, the app offers typed answers instead.
  2. No audio is kept. Audio is processed in memory while you speak and then discarded. The app does not write audio to storage, does not send audio to our server or anyone else, and does not create recordings.
  3. No voiceprints or speaker identification. The app does not create voiceprints, voice templates, or speaker or identity models. It does not identify or verify who is speaking. It does not score pronunciation or analyse the characteristics of your voice.
  4. What remains is text. The transcript stays on your phone. It is sent for AI feedback (to our server and to Google's Gemini models on Vertex AI) only if you give a separate consent, and only as text.

4. Written release

Before the app asks your phone for microphone and speech-recognition permission, it shows a written release describing points 1–4 above. You sign it by typing your full name, ticking a box and tapping I agree. Your typed name, the date and the release version are stored only on your phone, and you can view, export or delete them in Settings › Privacy Center. We ask for this release even though we collect no biometric data, so that your consent is informed and documented. You can withdraw it at any time in the Privacy Center, and you can turn off microphone access in your phone's settings.

5. Retention and destruction schedule

  • Normal operation: retention is zero. No biometric identifier or biometric information exists in our systems.
  • Accidental capture: if we ever discover that a biometric identifier or biometric information was captured or received in error (for example through a software defect or a message you send us), we will permanently destroy it immediately upon discovery, and in all cases within 30 days after discovery. It will never be kept past the earliest of:
    • the date on which the initial purpose for its collection is satisfied (for accidental data, the moment of discovery);
    • 1 year after the purpose for collecting it expires (Texas);
    • 45 days after we determine that keeping it is no longer necessary, and in any event 24 months after the individual's last interaction with us (Colorado);
    • 3 years after the individual's last interaction with us (Illinois).
  • How we destroy it: secure deletion from every system and copy under our control, including backups as soon as technically possible. We record the incident and its destruction in our confidentiality-incident register, without keeping the data itself.

6. No sale, profit or disclosure

We will not sell, lease, trade or otherwise profit from biometric identifiers or biometric information. We will not disclose or disseminate them to anyone, except where disclosure is required by law or by a valid warrant or subpoena. In that case we would disclose only what is legally required and, where the law allows, tell the person concerned.

7. Security

If biometric data were ever present despite this policy, we would protect it using a reasonable standard of care, at least as protective as the way we protect our other confidential and sensitive information, until its destruction under section 5.

8. Incident response

Accidental capture of biometric data is handled as a confidentiality incident under our incident-response plan. That includes assessment, containment, destruction, notification where the law requires it, and an entry in the incident register.

9. Service providers and platforms

  • Apple and Google provide the speech recognizers as part of the phone's operating system, under their own terms. The app requires on-device mode, so audio is not sent to them for recognition, and they send us no audio or voice data.
  • Google, as our AI provider (Gemini on Vertex AI), receives only text transcripts, and only with your separate consent for AI speaking feedback. It never receives audio from us.
  • None of our service providers receives biometric data from us.

10. Changes and review

We review this policy at least once a year and whenever the speaking features change. We will not introduce any feature that collects biometric identifiers or biometric information unless we first update this policy, give you a clear notice of the specific purpose and length of retention, and obtain your written release for that new feature.

11. Contact

Questions about this policy: certloomlearning@gmail.com · Person in charge of the protection of personal information: the Operator · NCLC Ready, operated under the Certloom Learning brand

Sources (accessed 2026-09-23)