Trust & Security

This page is maintained by Vocally Global Inc. to answer common security and privacy questions about Vocally. It describes the controls currently enabled in the product and is editable project content — not an independent certification or audit attestation.

Shared responsibility

Vocally runs on managed infrastructure: the API on Fly.io, the web application on Vercel, the database on Neon, and files in Cloudflare R2. Vocally Global Inc. is responsible for application logic, access rules, and how user data is handled inside the product. Customers (students and tutors) are responsible for protecting their own account credentials and the content they exchange.

Authentication & access

• Email-and-password and Google sign-in are supported.
• Sessions are managed by Vocally's own authentication service on the server.
• Admin accounts require two-factor authentication, and an admin session idle for 30 minutes must sign in again.
• Tutors, students and admins have separate roles, and role checks are enforced on the server for every request — never by the client alone.

Data protection

• Access rules are enforced on the server for every request: users can change only their own data and the lessons and conversations they take part in, and can see only what the product shows them, such as public tutor profiles and their own conversations and lessons; broader access is limited to admins.
• Sensitive tutor data — credential documents and review notes — is kept out of public pages and is readable only by the tutor and by admins.
• Data is encrypted in transit (TLS) between your browser, our servers, and the database.

Messaging & content controls

• Chat messages, booking and reschedule notes, reviews, tutor profiles, account names and lesson canvas titles are checked on the server for contact details (email addresses, phone numbers, outside links, social handles), including common disguises, to keep lessons and payments on Vocally. Chat messages and notes are also checked for outside payment methods. A chat file whose name carries contact details is renamed.
• Names are shown to others as the first name and the initial of the next name; full names are visible only to the person themselves and to administrators.
• Lessons take place in Vocally's built-in video room, provided by 8x8 JaaS (Jitsi, listed below); Vocally does not send students or tutors to outside meeting apps such as Zoom or Google Meet. Tutor intro videos are accepted only from YouTube and Vimeo and play in an embedded player.

Payments

Payments are processed by Stripe. Vocally does not store full card numbers on its servers. Lesson prices are recomputed server-side from each tutor's configured lesson price; client-supplied prices are not trusted.

Subprocessors

• Neon — database; Fly.io — API hosting; Vercel — web application hosting.
• Cloudflare R2 — profile photos, credential documents and chat attachments.
• Stripe — payments and tutor identity/tax verification.
• Resend — transactional email delivery.
• 8x8 JaaS (Jitsi) — embedded lesson video conferencing.
• Liveblocks — the shared lesson canvas.

Retention & deletion

When an account is deleted, its sessions end and a tutor's profile leaves search at once. After 90 days the account's name, email and photo are anonymized and the person's chat messages and files are removed; for a tutor, the display name is replaced, the public link stops working, and the bio, photos, intro video link, résumé and documents are removed. Records Vocally must keep, such as lessons, payments, credits, earnings, payouts and signed agreements, are retained as described in thePrivacy Policy.

Your privacy rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to withdraw consent for marketing communications. The Privacy Policy describes these rights and how to exercise them.

Reporting a security issue

If you believe you have found a security vulnerability in Vocally, please emailsecurity@vocallyglobal.com with a clear description and reproduction steps. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.

Contact

Privacy Officer: privacy@vocallyglobal.com
General support: support@vocallyglobal.com