Draft, pending founder approval. This text reflects our intended policy but has not yet been signed off by Joel (or Fiji-qualified counsel). We publish it now for transparency; the effective date and any final wording changes will be posted here on approval. Not a substitute for a signed contract.
Privacy Policy — Speak-Easy Services
Status: DRAFT v2.0 · rewritten 2026-10-15 to match the platform as built · awaiting Joel's approval and review by Fiji-qualified counsel before publication. Last updated: 2026-10-15 Effective date: TBD
1 · Who we are
Speak-Easy Services ("we", "us", "Speak-Easy") is a learning and language business founded and operated by Joel Kalubi, based in Suva, Fiji. We offer:
- Math tutoring for children — at home in the Suva area or online;
- Language lessons in French, English and Fijian — for adults, families and teams;
- Certified translation and interpretation for individuals, businesses and organisations.
Contact for privacy matters: contact@speakeasyservices.net (subject line: "Privacy") · +679 900 1498 · Lot 12, Niudamu, Tacirua East, New Sub, Suva, Fiji.
2 · What this policy covers
This policy explains how we collect, use, keep, share and protect personal information when you (i) visit our website, (ii) ask us for a tutor or a language teacher, (iii) book and attend tutoring or lessons, (iv) submit documents for translation or book an interpreter, or (v) communicate with us. It applies whether you are a parent or guardian, an adult learner, a corporate client, an authorised submitter for an organisation, or a visitor.
If a corporate client has signed a separate Data Processing Agreement (DPA) with us, the DPA prevails over this policy on any conflict.
3 · What information we collect
Information you give us
| Who you are | What we collect | Why |
|---|---|---|
| Any visitor who writes to us | Name, email or phone, the service you are asking about, and what you tell us in the form or message | To reply and prepare a proposal or quote |
| Parent or guardian booking math tutoring | Your name and contact details; your child's first name or nickname and age band or year level; subject, preferred days and lesson format; your address for in-person lessons (sent after you accept); anything you tell us about your child's needs | To match a tutor, schedule lessons and deliver them |
| Adult learner or family booking language lessons | Name and contact details; language, level and goals; placement conversation notes; for family bookings, the learner's first name and age band | To confirm a level, match a teacher and deliver lessons |
| Corporate client booking lessons for a team | Company details; the names, work contact details and language level of employees who attend | To organise lessons, invoice the company and report attendance and progress |
| Translation or interpretation client | Documents you upload; language pair, deadline and certification needs; event details for interpretation | To produce the translation or provide the interpreter |
| Everyone using the service | Messages with us, tutors, teachers or linguists; feedback, ratings and any concern or incident you raise | Service coordination and quality |
| Anyone who pays | Billing name and reference. Card payments are handled by Stripe — we never see or store your card number. Bank transfers: the transfer reference | To take payment and keep accounts |
Information created while we deliver the service
- Tutors and teachers log attendance and short session notes, and write progress reports for the parent, learner or employer.
- A record of each meaningful action on a booking or job (who did what and when), kept as a tamper-evident audit log. It records actions, not the content of your documents or messages.
Information we collect automatically
- We use no advertising or analytics trackers on our website.
- We set only the cookies described in Section 12.
- Our servers and error-monitoring tools record technical information (such as page, time and error type) to keep the site running. We configure error reports to leave out message and document text.
Information we do not collect
- Your child's date of birth (we ask only for an age band or year level).
- Marketing profiles, social-media data or purchased audience data.
- Anything beyond what you submit: we do not scrape, mine or repurpose your files or messages.
4 · How we use your information, and why
| Purpose | Basis |
|---|---|
| Deliver the tutoring, lessons, translation or interpretation you asked for; match you to a tutor, teacher or linguist | Needed to perform our agreement with you |
| Schedule, send reminders, report progress, handle replacements and changes | Needed to perform our agreement with you |
| Quote, invoice, take payment and keep accounts | Needed to perform our agreement; legal obligations |
| Review tutor quality using ratings, feedback and attendance; handle concerns and incidents | Our legitimate interest in running a safe, good-quality service |
| Keep a tamper-evident record for certified translation and for resolving disputes | Legal obligations; our legitimate interest |
| Keep the platform secure and working | Our legitimate interest |
| Send you service emails about your booking or job | Needed to perform our agreement |
| Anything optional that we ask you to agree to | Your consent, which you can withdraw at any time |
We do not sell your data. We do not use your documents, your messages or your child's information for advertising, and we do not use them to train AI models.
5 · Children
Tutoring for children is booked and paid for by a parent or guardian, who is our client and holds the account. We do not open accounts for children and do not send them marketing.
- We keep the minimum about each child: a first name or nickname, an age band or year level, the subject, attendance, tutor session notes and progress reports, and any notes you choose to give us.
- Progress reports go to the parent or guardian, not to third parties.
- A tutor can see only the children assigned to them.
- Parents and guardians can ask to see, correct or delete their child's information at any time (Section 8).
- Language lessons for under-18s are booked by a parent or guardian in the same way. If you believe we hold a child's information without a parent's or guardian's authority, contact us and we will remove it.
6 · The role of AI in our service
Translation. We use AI to accelerate parts of the translation process — optical character recognition (OCR) and a first-pass draft. Every certified translation is reviewed, edited as needed and certified by a human translator holding a current Fijian Ministry of Justice translator licence. The AI draft is never the final product.
Our AI provider is Mistral AI (France). We use Mistral's API under its terms for business customers, which do not allow our content to be used to train its models. After OCR we delete the uploaded file from Mistral's file store.
If you do not want AI used on your document, tell us before you submit it. We will tell you whether we can accommodate that and what it means for price and turnaround.
Tutoring and lessons. At the date of this policy we do not use AI on tutoring or language-lesson records. If that changes we will update this policy first and tell active clients.
7 · Who we share information with
We share information only where it is needed to deliver the service or to comply with the law.
People who work with us
- Tutors, teachers, translators and interpreters see only the bookings or jobs assigned to them — for tutoring, your child's first name, year level, subject, schedule and (for in-person lessons) the lesson address.
- Your employer, if lessons are arranged and paid for by your employer: attendance and progress reports.
Service providers (they act on our instructions and for our purposes only):
| Provider | What for | Based in |
|---|---|---|
| Railway | Hosting our website, application and database | United States |
| Mistral AI | OCR and first-draft translation (translation work only) | France |
| Resend | Sending and receiving service emails | United States |
| Sentry | Error monitoring | United States |
| BetterStack | Logging and uptime monitoring | Europe |
| Stripe | Card payments | Ireland / United States |
Banks process bank transfers. Mobile-money payments (M-Paisa, MyCash) will be added to this list if and when we offer them.
Government and legal. We disclose information when Fijian law, a court order or a lawful government request requires it, and only to the extent required.
We will update this list before we add a new provider that handles your information.
8 · How long we keep your information
| Item | What happens |
|---|---|
| Translation source files and working text | Deleted 30 days after delivery |
| Quote documents and enquiries (leads) | Deleted after 2 years |
| Email notification queue and card-payment event records | Deleted after 90 days |
| Sign-in links and session tokens | Removed once used or expired |
| Certified translations | Kept for 7 years from certification, so we can re-issue them and meet regulatory audit needs |
| Audit log | Kept for as long as the certified record it supports (at least 3 years). It contains no document or message content |
| Tutoring and lesson records (child or learner profile, bookings, attendance, session notes, progress reports) and account profile | Kept while your account is active. Automatic deletion for these records is being added; until then we delete them on request (Section 9) |
When a retention period ends, or when you ask us to delete something we are allowed to delete, we delete it securely or anonymise it. Where deletion would damage an unrelated record we must keep (for example, your name in the audit trail of a certified translation), we keep only what we must and tell you what and why.
9 · Your rights
You have the right to:
- Access the information we hold about you or your child;
- Correct information that is wrong or incomplete;
- Delete information, except where a legal retention duty applies (certified translations and their audit trail are kept for the period in Section 8; we will tell you what we keep and delete everything else);
- Export your information in a machine-readable format;
- Object to processing for any purpose in this policy (some objections, for example to billing, may mean we can no longer provide the service);
- Withdraw consent for anything that relies on your consent.
To use any of these rights, write to the privacy contact above. We handle these requests personally, do not charge for them, and respond within 14 calendar days. Parents and guardians may act on behalf of their child. We may need to confirm who you are first. If we cannot fully honour a request, we will explain why.
10 · How we protect your information
- Encrypted connections. The website and portal are served over HTTPS.
- Access limited by role, enforced in the database. Tutors see only their assigned students; translators only their assigned jobs; office staff see invoices and payments but not document contents, session notes or children's profiles; clients see only their own records.
- Careful sign-in. Clients sign in with a single-use email link that expires or with a password. Sign-in sessions are stored in an encrypted cookie.
- Tamper-evident audit log. Every meaningful action is recorded in a chain that shows any later change. Document text, message text and sign-in links are not written to it.
- Short-lived working copies. Source files are deleted from our provider's systems after processing and from ours after the period in Section 8.
- Error reports leave out content. We configure error monitoring not to capture message or document text.
No system is perfectly secure. We are adding further safeguards, including encryption of stored documents, two-factor sign-in for our own team, and an independent security test, and we will update this policy as each one is in place.
If a breach affecting your information occurs, we will tell you and the relevant authority without undue delay and, where feasible, within 72 hours of becoming aware of it, with as much detail as we can responsibly share.
11 · International transfers
We are based in Fiji. Some of our providers process data in the United States, France, Ireland or elsewhere in Europe (Section 7). These transfers are needed to deliver the service, and we use providers that commit to protecting the information they handle. If you have specific data-residency requirements, for example as part of a corporate compliance programme, tell us before you submit work and we will discuss what is possible.
12 · Cookies and analytics
Our website sets no advertising, tracking or analytics cookies. It sets only:
- a language preference cookie, so the site opens in the language you chose last; and
- for people who sign in to the portal, an encrypted session cookie that keeps you signed in.
13 · Changes to this policy
We may update this policy as our service, our providers or the law change. We will tell active clients by email at least 30 days before a material change takes effect. The "Last updated" date at the top is the date of the latest revision; earlier versions are kept and available on request.
14 · Questions and complaints
If you have a question or a complaint about how we handle your information, contact us first at the address above. We will respond within 14 calendar days.
If you are not satisfied with our response, you may complain to the data-protection or information authority in your jurisdiction (in Fiji, the Office of the Information Commissioner, where it has jurisdiction).
Draft prepared for Joel Kalubi by the Speak-Easy build team, rewritten October 2026. Not legal advice. Review with Fiji-qualified counsel before publication, in particular Section 8 (retention), Section 11 (international transfers) and the treatment of children's information in Section 5.