Privacy Policy

1. Who we are

Navari Navian LLC ("we," "us," or "our") operates Dorola, including dorola.com, app.dorola.com, and the Dorola mobile applications (the "Services"). We are responsible for the personal information we process through the Services. This policy also covers information sent to our support and legal email addresses.

Our mailing address and contact details appear below. Third-party stores and services may have separate privacy policies for their own activities.

2. Information we process

Using Dorola without registering

In app versions that offer guest access, you can view subscription plans, purchase or restore a subscription, and use paid lessons without providing an email address or creating a password-based account. Dorola creates a random family identifier and a secure device session. Learner profiles, learning records, preferences, and subscription access are stored on our servers under that identifier. Guest access is not anonymous data collection: records and purchase information remain linked to the same family and learner identifiers.

A guest parent can protect family management with a parent PIN. We store a protected hash rather than the readable PIN. Optional account registration adds an adult email and password to the same family after verification so the adult can sign in on another device. Guest learning remains available while that optional verification is pending.

Without a registered account, continued access to the family's learning records depends on the saved device session. Reinstalling, clearing app storage, losing the device, or ending that session can make those records inaccessible. Restore Purchases restores eligible store access; it does not disclose or recover another family's learner records. Keep access to the original device or add an optional account before moving to another device.

Adult account and support information

When an adult registers, we process their name, email address, protected password credentials, email-verification status, account identifiers, and account dates. We also process sign-in sessions, security and recovery information, and information included in support messages. Please do not email passwords, payment-card details, or unnecessary information about a child.

Learner profiles and learning activity

A parent or adult can provide a learner display name or nickname, profile color, learning mode, daily goal, language or script preferences, timezone, and reminder preferences. A nickname is sufficient; a child's full legal name is not needed. We save lessons attempted or completed, exercise responses and results, vocabulary progress, practice dates, review schedules, and related session identifiers so learners can continue across sessions and parents can see progress.

Device, connection, and service information

We process information needed to operate and protect the Services, such as IP addresses, browser or device information, request times, app or operating-system version where supplied, error information, and sign-in or learner-device connection identifiers. These records can be associated with an account or learner. The app does not request access to contacts, precise location, or an advertising identifier.

Optional preferences and usage details

Where available, parents can choose learning preferences and separately enable "Share optional usage details." Optional usage sharing starts off. It can include screen and feature use, help requests, playback events, technical errors, and exercise timing. These first-party events use account or learner identifiers rather than copying names, email addresses, voice files, or raw answers into the optional event record. Saving ordinary exercise answers and progress does not depend on this optional setting.

Subscriptions and notifications

If purchases are available and you use them, we process plan and product identifiers, transaction or purchase records, entitlement status, trial and renewal dates, and cancellation or refund status. The purchasing store handles payment credentials; we do not receive your full payment-card number. If notifications are available and enabled, we process a device push token, the intended parent or learner, reminder choices, and delivery information.

3. How we use it

• Create and secure guest family sessions or optional adult accounts, and connect parent-authorized learner devices.
• Deliver lessons and recordings, save progress, schedule review, and produce family reports.
• Adapt available learning activities to saved progress and preferences.
• Verify subscriptions, restore access, and handle support, cancellations, or billing disputes.
• Send account-verification, security, and password-reset emails; provide enabled reminders and in-app messages.
• Maintain reliability, investigate misuse, understand aggregate learning patterns, and improve the Services. Optional detailed usage collection follows the parent's setting.
• Meet applicable legal obligations and protect users and our legal rights.

We do not use personal information for behavioral advertising, sell it, or share it for cross-context advertising. Dorola does not provide public learner profiles or public chat. Learning recommendations are not academic grades or decisions about eligibility for education, employment, or other essential services.

4. Children's privacy (COPPA)

This section is for parents and legal guardians of children under 13. Navari Navian LLC operates Dorola and is the contact for questions about children's information, including information maintained by our service providers. Our business address and email contacts are below.

What children's information is collected and why

• Learner profile: a nickname, account-linked learner identifier, color, learning mode, daily goal, script preference, timezone, and reminder settings. These identify the correct learner and their chosen learning experience. We do not require a child's full legal name, email, telephone number, home address, school, or date of birth.
• Learning records: lessons, exercise submissions and results, word-level progress, practice dates, review schedules, and session identifiers. These support practice, returning to a lesson, and private family reports. These records remain personal information when linked to a learner; using an identifier instead of a name does not make them anonymous.
• Technical identifiers: connection credentials, necessary network/security records, and, only for enabled notifications, push tokens and delivery records. A linked learner device accesses its assigned learner, not a public profile.
• Optional usage information, where available: the first-party events described in section 2. The parent's optional setting is separate from ordinary progress storage and is not, by itself, verifiable parental consent under COPPA.

Children do not have public profiles, public chat, or a way to publish their exercise responses to other users. An adult controls the family space, whether accessed through a guest device session or a registered account. A child does not need their own email or password. Please use a nickname and avoid entering identifying information into an exercise.

Parental notice and consent

COPPA requires direct notice to a parent and verifiable parental consent before collecting, using, or disclosing a child's personal information, unless a specific exception applies. Direct notice must describe the proposed collection, purposes, recipients, how the parent can consent, and how to refuse or withdraw permission. Posting this policy alone does not provide that consent.

Important: Dorola's adult email verification, adult-account checkbox, parent password or guest PIN, and device permissions are account controls, not a completed COPPA verification process. We are reviewing the separate parental-consent workflow. We do not represent an existing account or subscription as proof of verifiable parental consent. If required consent has not been obtained for your child, stop using the online learner profile and contact legal@dorola.com so we can address collection and existing records.

Sharing and optional features

The account's adult can see its learners' information. Authorized staff and the providers listed in section 6 process information needed for their functions. We do not sell children's information, use it for targeted advertising, or send children's microphone recordings to ElevenLabs. Where COPPA requires separate consent for a disclosure that is not integral to the service, that consent must be separate from consent for core learning. Optional usage sharing or reminders are not a condition of ordinary learning.

Your rights as a parent

You can review your child's personal information, request corrections or deletion, and refuse further collection or use. You do not have to purchase a subscription to make a privacy request.

1. Use Parent Space to review learner information and progress, manage optional settings, and remove learner profiles or connected devices.
2. For a copy of stored information, withdrawal of consent, or help deleting data, email legal@dorola.com from the adult account email if you have registered, or explain that you use guest access. State the learner nickname and whether you want access, correction, deletion, or to stop collection. Do not send passwords, a child's identity documents, or unnecessary sensitive information.
3. We verify identity and parental authority before releasing or deleting private information. We will explain any information reasonably needed for that verification. Privacy requests are not used for marketing.

Removing information necessary to provide a learner profile ends that profile's personalized online service. Revoking a device connection is not the same as deleting the learner or their saved history. Deleting a Dorola profile or account does not cancel an Apple or Google subscription; manage that separately with the store.

Children must not be required to provide more information than is reasonably necessary for an activity. The retention and deletion practices, including backup limitations, are described in section 8. For background, see the FTC's children's privacy resources.

5. Voice practice

Optional "record and listen back" exercises request microphone permission when you choose to record. In the current implementation, the recording is processed locally and is not uploaded to Dorola or ElevenLabs. The app attempts to discard it when it is replaced or the exercise is closed; temporary files may remain on the device after an interruption or operating-system failure. You can skip recording and still practice aloud.

Lesson pronunciation audio is different: our content tools use ElevenLabs to turn lesson text into prepared audio. These saved recordings are delivered to learners and may be cached on their devices. This process does not require sending a learner's voice to ElevenLabs. We do not create a voiceprint or identify learners by their voice.

6. Service providers and sharing

We use providers to perform specific functions, and disclose information needed for those functions:

• Contabo: hosts our website and application infrastructure, including stored account and learning data.
• Resend: delivers transactional emails, using the recipient address, message content, and delivery information.
• ElevenLabs: generates prepared lesson audio from content supplied by our editors, not learners' microphone recordings.
• RevenueCat, where billing is enabled: manages subscription records and entitlements using an adult account identifier, store transaction data, and technical information required by its SDK. See RevenueCat's privacy policy.
• Apple and Google: distribute apps, process store purchases, and may deliver device notifications. Their independent account and payment practices are governed by their own policies.
• Expo, where push delivery is enabled: routes notifications using push tokens, message payloads, and delivery receipts, with the relevant platform notification service.

Cloudflare provides domain/DNS services. Requests for websites, emails, and purchases can also pass through network and platform providers. Provider use can vary with the feature and app version.

We may disclose information when reasonably needed to comply with law or lawful process, investigate fraud or security issues, or protect people and rights. If our business is reorganized, acquired, or transferred, relevant information may be transferred with appropriate safeguards, notice, and consent where required. This does not authorize a buyer to ignore applicable children's privacy requirements.

7. Cookies and device storage

We use essential cookies or secure device storage for sign-in, account security, and linked learner access. The app also stores preferences, cached lessons or audio, and bounded offline queues needed to recover or synchronize activity. Where optional usage sharing is enabled, unsent optional events expire after seven days and the queue is cleared on sign-out or withdrawal of that setting.

The public website does not currently include third-party advertising or analytics trackers. Visiting it still creates ordinary hosting/security request records. Browser cookie restrictions or clearing app storage may sign you out or remove downloaded content. Because we do not sell or share information for targeted advertising, there is no such activity to opt out of through a browser signal. We do not use a "Do Not Track" signal to disable storage necessary for an account you choose to use.

8. Retention and security

Retention depends on the information's purpose:

• Accounts and learner progress: retained to maintain the account, learning history, and reports while needed for that service. Deleting an account or learner removes its associated records from the application's active database.
• Detailed analytics events, where available: retained for up to 90 days. This limit does not delete ordinary saved progress. Disabling optional usage sharing removes optional client events and clears optional details from retained server events.
• Local speaking recordings: temporary, as described in section 5. Cached lesson audio is not a recording of the learner.
• Security, support, and transaction records: kept as needed for their specific operational purpose or applicable legal, accounting, fraud-prevention, and dispute obligations.

Children's information must be retained only as long as reasonably necessary for the specific purpose for which it was collected, not indefinitely or for unspecified future use. A profile's continued existence is not by itself a reason to keep every detailed record. We are completing the operational schedule for inactive profiles, historical records, provider copies, and backups; this notice does not claim that a universal automated expiry is already active.

Deletion from the active service may not immediately remove copies in restricted backups or records held independently by a store. Backup copies remain subject to their backup lifecycle and are not intended for routine use. Any legally required preservation must be limited to the necessary records and purpose. Contact us for information about a particular record or deletion request.

We use safeguards designed to protect information, including encrypted connections, account authentication, and access restrictions. No internet service or storage system can be guaranteed completely secure. Keep account credentials and parent access codes private and tell us about suspected unauthorized access.

9. Your choices and rights

You can manage learner settings and available privacy/reminder controls in Parent Space. You can revoke microphone or notification permission in device settings. Turning off reminders does not stop necessary account-security emails. Optional usage sharing can be disabled without preventing ordinary learning.

For registered-account or guest-family deletion, open learner menu → Account → Settings → Account security, or follow the account and learner deletion instructions. Deleting a Dorola account or uninstalling the app does not cancel a store subscription. Manage that subscription separately with the purchasing store.

Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain a portable copy of information; restrict or object to certain processing; withdraw consent; appeal a decision about a privacy request; or complain to a privacy regulator. These rights can have exceptions. Email legal@dorola.com with your request or an appeal. We may verify identity and parental authority and will respond within the applicable legal period. We do not penalize you for exercising applicable privacy rights.

10. International users

Navari Navian LLC is based in the United States. Our infrastructure and providers may process information in the United States and other countries, whose privacy laws may differ from those where you live. Where applicable law requires a transfer safeguard, that requirement continues to apply; using the app does not waive it. Contact us for information about the safeguards relevant to your data.

Where a legal basis is required, we rely on performing our agreement with the adult account holder for requested account and subscription services, legitimate interests for proportionate security and service operation where permitted, consent for optional processing where required, and compliance with legal obligations. Children's information remains subject to additional consent and protection requirements.

11. Policy updates

We may update this policy as the Services or legal requirements change. The date above identifies the current version. We will provide additional notice of material changes and seek new consent where required, particularly before materially changing how children's information is used or disclosed. A policy update does not by itself authorize new processing that requires consent.