Privacy Policy
Auris Tech Limited
Last updated 2026-09-10
1. About this policy
This is the Privacy Policy of Auris Tech Limited (“Auris Tech“, “we”, “our”, “us”). It explains how we handle personal data across everything we do: our websites, the Fonetti application, and our related services.
This policy is the single source of truth for the things that are true for everyone. Because we serve several different kinds of customer, and the data we handle differs depending on which one you are, this policy is accompanied by an addendum for each relationship. Most people need this policy plus one addendum.
1.1 Find your addendum
| If you are… | Read this policy, and… |
|---|---|
| A parent or guardian with a family or individual Fonetti account | Home Users addendum |
| A school, academy trust, local authority or other education setting using Fonetti with pupils | Schools addendum |
| A parent or guardian registering a child for the National Read Aloud Challenge | Home Users addendum and Challenge addendum |
| A school registered for the National Read Aloud Challenge | Challenge Schools addendum |
| Only visiting our websites | This policy is sufficient. |
More than one addendum can apply to you. Children take part in the Challenge through a parent’s own account, so the Challenge addendum builds on the Home Users one. A school can be registered for the Challenge and use the Fonetti School Platform, which are separate arrangements with separate addenda.
If an addendum ever conflicts with this policy, the addendum takes precedence for the relationship it covers.
1.2 What we mean by “Fonetti” and “Auris Tech”
Fonetti means the features, functions and services provided through the Fonetti application and its associated web services.
Auris Tech means Auris Tech Limited, the company that provides Fonetti and is responsible for deciding how personal data is handled, except where an addendum says that a school is responsible instead.
1.3 The law we work to
We comply with the UK GDPR and the Data Protection Act 2018, and with any legislation replacing or amending them, the Privacy and Electronic Communications Regulations (PECR) for cookies and electronic marketing, and the Information Commissioner’s Office (ICO) Age Appropriate Design Code, which sets standards for online services likely to be accessed by children.
2. Who we are and how to contact us
Auris Tech Limited Registered in England and Wales, company number 09443035 Registered office: 2a The Quadrant, Epsom, Surrey, KT17 4RH, United Kingdom Registered with the Information Commissioner’s Office, registration number ZB037837
| Purpose | Contact |
|---|---|
| Privacy questions, data protection rights requests, complaints | dpo@auris.tech |
| Product help, account changes, account deletion | support@fonetti.com |
2.1 Data Protection Officer
Mail to the privacy address above reaches our own team first, so that requests such as erasure can be actioned straight away. We have appointed an external Data Protection Officer, and you may ask for a matter to be referred to them at any time.
If you ask our support team to do something that is in fact a data protection rights request (to delete your data, for example) we treat it as one from the day it arrives, and the response times in section 14 apply.
3. Our role: controller or processor
Data protection law distinguishes between a controller (who decides why and how personal data is used) and a processor (who acts on a controller’s instructions).
| Relationship | Our role |
|---|---|
| Website visitors | Auris Tech is the controller |
| Home user accounts (parents and their children) | Auris Tech is the controller |
| Pupil data in the Fonetti School Platform | The school is the controller; Auris Tech is the processor |
| School billing, account administration, platform security, developing and improving our products for children’s reading or literacy, and our marketing to school staff | Auris Tech is the controller |
| The National Read Aloud Challenge | Auris Tech is the controller |
The relevant addendum sets out what this means in practice for you.
3.1 Two different kinds of school
- Schools using the Fonetti School Platform hold accounts for their pupils and use Fonetti as part of teaching. They are the controller of their pupils’ data, and the Schools Data Processing Agreement they hold with us governs our processing for them.
- Schools taking part in the National Read Aloud Challenge do not create or hold pupil accounts. Children enter the Challenge through a parent’s own account, and a parent may choose to link their child to a school. Auris Tech is the controller for Challenge data, and the Challenge Schools addendum governs our relationship with the school.
A school can be both. They remain separate arrangements.
4. Where personal data comes from
Most personal data we hold comes from you: what you enter when you create an account, what your child’s reading sessions generate, and what you tell us when you contact us. We also receive technical, usage and diagnostic data automatically from the device being used, and confirmation from our payment provider that a subscription is active.
Where we hold personal data about you, or about your child, that did not come from you, this policy or the addendum for your relationship says where it came from.
We do not buy personal data about children or families. We do not purchase consumer contact lists, we do not use data brokers for parent or pupil data, and we do not build profiles from social media. Where a school staff member’s work contact details reach us from a source other than them, section 10.3 says so.
5. How Fonetti processes speech
Fonetti listens to a child reading aloud and analyses their speech in real time in order to follow the text with them, respond to what they read, and produce a reading-progress report.
5.1 Audio is not recorded or stored
Fonetti does not record or store audio. Speech is processed as a live stream while a reading session is in progress. When the session ends, the audio stream ends. We do not write audio files to storage, and we do not retain voice data after a session. The only thing kept from a reading session is the reading-progress data, which contains no audio.
Speech is analysed by our own patented speech recognition service, built and run by Auris Tech.
A child’s voice is not sent to Google, OpenAI or any other third-party speech or AI service. Our own service does the listening, on servers we run at Amazon Web Services, which hosts them and provides no speech or AI service to us.
5.2 Legacy voice recordings
Until we retired our native apps in June 2025, a parent could opt in to their child’s voice being used to help improve Fonetti, most often when registering for the National Read Aloud Challenge. Where that was agreed, recordings were made as the child read.
We still hold some of them. The current app cannot record audio, and no recordings have been made since.
If it may affect your child, email support@fonetti.com. We will tell you whether we hold anything for your child, send you the addendum that covers these recordings, and help you exercise your rights.
6. Automated decision-making and profiling
Fonetti does not make automated decisions about anyone. Nothing it does has a legal or similarly significant effect, and it is not used to decide anything about a child’s education, placement or attainment. Reading reports go to the parent or the school for them to interpret.
What it does is follow a child as they read, adjust the difficulty of what it offers them, and report their progress.
We also learn from how children read as a whole. Looking at what works across all our readers is how the app improves: how accurately it follows a child, how well it judges reading level, and what it suggests reading next. We work from individual children’s reading records to find patterns across many children, and what we learn goes back into the app.
We do not use recordings of children’s voices for this.
Fonetti works out roughly what a child can read, so it can offer them books they can manage. That is a judgement about which book to offer next, not about the child. We never use it to say what a child is capable of, or to single a child out.
Our lawful basis for this is legitimate interests: ours in a product that keeps improving, and the children’s in a reading app that gets better at helping them read. We give particular weight to the fact that our readers are children. For a child using Fonetti through their school we are the controller for this work and the school is not, which the Schools Data Processing Agreement records and section 5 of the Schools addendum explains.
Whatever we learn this way, there are things we will never do with it. We do not use personal data for behavioural advertising, we do not profile children for marketing purposes, and we do not sell, rent or trade personal data.
We will not use pupil data to train or develop any general-purpose artificial intelligence model, or to build anything other than a product for children’s reading or literacy, and for school pupils that is a contractual commitment in the Schools Data Processing Agreement their school holds with us.
If you are completing a risk assessment or procurement questionnaire: the above is profiling in the legal sense, because Fonetti automatically analyses how a child reads, and it is not an optional feature that can be switched off, because it is the service. The improvement work uses machine learning trained on reading-performance data, never on audio. No model output decides anything about an individual. It is not a significant decision based solely on automated processing under Articles 22A to 22D of the UK GDPR: a parent or teacher interprets every result, there is no legal or similarly significant effect on any child, and no special category data is involved.
7. Children’s privacy and the Age Appropriate Design Code
Where the code applies. It governs services children themselves use, which for us means the Fonetti Read-Aloud app. The Fonetti Parent Portal and the Fonetti School Platform are tools for an adult managing an account or a class. A child’s data is protected the same way wherever we hold it.
The code sets 15 standards. Here is where we stand on each, in the code’s own order.
- Best interests of the child. Where a design choice trades a child’s privacy against something else, the child’s interests come first.
- Data protection impact assessments. We have carried out a data protection impact assessment for Fonetti, and we review it at least once a year and whenever we change something material.
- Age appropriate application. Where an adult sets up a child’s profile, we ask for an age or year of birth, so that we can offer books at the right reading level. We do not check it, and we do not use it to decide what privacy protections someone gets. Verifying age would add friction out of proportion to the risk, and it would mean collecting more personal data, not less. So rather than sorting people by age, we apply every standard here to everyone who uses the Fonetti Read-Aloud app, whatever their age.
- Transparency. We write in plain language, and we address it to the adult who holds the account, because every choice about a child’s data is theirs to make: nothing in the app asks a child to agree to anything, and the account and its settings sit with the adult.
- Detrimental use of data. We do not use children’s data in ways that are against their wellbeing.
- Policies and community standards. We keep to the policies we publish, and this one applies to everything we run.
- Default settings. Nothing that shares, publishes or exposes a child’s data is on by default. Where signing up a particular way switches something on, the addendum for your relationship says so, and you can see and change it at the time.
- Data minimisation. We ask for the least we need. A child’s profile does not depend on a real or full name; a pseudonym works just as well.
- Data sharing. We do not sell, rent or trade children’s personal data, and we do not disclose it for anyone else’s marketing. Beyond that, a child’s data reaches someone outside our service providers only where this policy or your addendum says so. That covers what an adult has asked us to do, what a school has instructed us to do, and the limited circumstances in section 8.4.
- Geolocation. Fonetti does not track a child’s location, and there is no location-sharing feature a child could switch on.
- Parental controls. The adult holds every control, a parent or guardian, or the school where the school holds the account. What the adult sees is the child’s own reading record, so nothing is gathered about a child beyond what they are knowingly doing: reading aloud to the app.
- Profiling. Fonetti analyses how a child reads, which is profiling and cannot be switched off because it is the service; what it suggests next comes from our own curated library, and section 6 explains the rest.
- Nudge techniques. We do not use design that pushes a child or parent towards sharing personal data or making weaker privacy choices.
- Connected toys and devices. Fonetti is not a connected toy or device. We do not passively collect data.
- Online tools. You do not have to write to us to exercise a right. A parent, or a school for its pupils, can view, correct and delete a child’s data directly, as section 14.1 sets out. A child old enough to understand what they are asking can also ask us themselves, which section 14 says and does not depend on an adult asking for them.
8. Service providers, storage and international transfers
8.1 Where we store personal data
Our primary data stores are in the United Kingdom and the European Economic Area. Accounts, reader profiles and reading-progress data are held encrypted at rest in those regions, in data centres operated by our hosting provider.
8.2 Service providers
We use a small number of third parties to run the service and the business: hosting, email delivery, customer support, error monitoring, payment processing, website analytics and internal operational tools. They act on our instructions under written data protection terms, and may only use personal data to provide their service to us.
The principal ones are Amazon Web Services, which hosts the service, Zoho, which we use for support, contact records and email, and Google Analytics on our websites.
We keep a record of every provider: what it does, where it processes personal data, and the transfer mechanism that applies to it. Ask us and we will tell you which ones apply to you, because that depends on how you use Fonetti.
8.3 International transfers and remote access
Some of our service providers have support and engineering teams in other countries, and a small number process limited data outside the UK and EEA. Data protection law treats access from outside those regions as a transfer, so safeguards are in place whether or not any access happens.
Where personal data is transferred to, or accessible from, a country not covered by UK or EU adequacy regulations, we put appropriate safeguards in place, such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it. Ask us about any provider and we will tell you what applies to it and how you can see it.
8.4 Other disclosures
We may disclose personal data where we are legally required to do so, where it is necessary to establish, exercise or defend legal claims, to prevent fraud or protect the security of the service, or to protect someone from harm. If we are involved in a merger, acquisition or sale of assets, personal data may transfer as part of that transaction, and we will notify affected users and explain their options.
Our websites and app may link to third-party sites and services. We are not responsible for their privacy practices, and we suggest reading their own policies before giving them personal data.
9. Security
We protect personal data, and children’s data in particular, with the measures below. These are the principal ones rather than a full inventory, and a school receives our security schedule with its processing agreement.
- Encryption in transit. Traffic between your device and our services is encrypted using TLS.
- Encryption at rest. Personal data in our databases, file storage and backups is encrypted.
- Access scoped by function. Staff are given access to our administrative tools according to their role.
- Secure hosting with a major cloud provider in the UK and EEA. See section 8.1.
- Checks on service providers covering how they protect personal data, where they process it, and what they may use it for.
- Staff data protection training.
- Breach response. If a personal data breach occurs that is likely to result in a risk to people’s rights and freedoms, we notify the ICO within 72 hours of becoming aware of it, and notify affected individuals (or, for school-managed data, the school) where the law requires it.
10. Website visitors, cookies and marketing
10.1 Our websites
| What we process | Why | Lawful basis |
|---|---|---|
| Technical and browsing data, including IP address and request data, from server logs, content delivery services and cookies. | To deliver the site, keep it secure, and diagnose faults | Legitimate interests, running and protecting our own website |
| The same data, for analytics that use cookies | To understand which content is useful and improve the site | Consent, given through the cookie banner |
| Technical, device and interaction data when we use automated abuse-prevention tools | To distinguish genuine visitors from automated traffic, prevent abuse and protect our website and forms | Legitimate interests, protecting our website and services |
| Page views and feature use, counted without cookies or identifiers and without keeping IP addresses (Fathom Analytics) | The same, without identifying anyone | Legitimate interests, improving our own service |
| Enquiry, demo request and support form details | To respond to your enquiry | Legitimate interests, responding to someone who has contacted us |
| Your answers to a survey or feedback form, and the name and email you give with them | To understand how Fonetti is working and where to improve it | Legitimate interests, improving our own service |
| A school staff member’s name, work contact details, role and access permissions | To create and run their account, authenticate them, and keep the service secure | Legitimate interests, providing the service the school has asked for to the people it has named |
| Billing and contract records for a school subscription | To take payment, meet our tax and accounting obligations, and manage the relationship | Legal obligation for the accounting records; legitimate interests for the rest |
| Newsletter sign-up details and preferences | To send you what you asked for | Consent |
10.2 Cookies
Non-essential cookies are set only with your consent, which you can withdraw at any time through the cookie settings on our websites.
We use no advertising or behavioural targeting cookies anywhere.
What each site and product stores on your device, and why, is in the Cookie Policy.
10.3 Marketing
If you hold a Fonetti account, whether as a parent or as a member of school staff, you choose at registration whether you want to hear from us. Where you said yes, we rely on your consent, and you can change your mind at any time using the unsubscribe link in any message.
We also contact education professionals about Fonetti where it is relevant to their professional role, relying on legitimate interests. PECR permits marketing to corporate subscribers on this basis. Some of those details reach us from a source other than you, such as an event organiser where you had a badge scanned, or someone else at your school. Ask us and we will tell you where we got yours, and you can ask us to stop at any time.
Every marketing email includes an unsubscribe link, and we keep a suppression record so that an opt-out stays honoured.
We do not send marketing to children. We may use what we know about how your child is getting on to make sure what we send you is relevant, which also means avoiding sending you something that is not for you. None of this changes what your child sees in the app, and you can turn marketing communications off at any time.
We may publish testimonials from customers, with their consent. We will not publish a child’s full name or image without separate, explicit parental consent.
11. Special category data
Some personal data is treated as especially sensitive under data protection law, health information for example.
Fonetti does not ask for it and does not need it to provide the service.
If we ever do need it for a specific, limited purpose, we will say so plainly in the addendum that covers that purpose, and explain how we handle it at the point we ask.
If you tell us something of that kind anyway, most often by mentioning a child’s diagnosis when asking our support team for help, we use it only to answer your query, we do not add it to your child’s profile, and you can ask us to delete it at any time.
12. How long we keep personal data
The addenda set out retention periods for the data specific to each relationship. The following apply to everyone:
| Data | Retention period |
|---|---|
| Website server logs | 7 days for fonetti.com. auris.tech server logs are kept by its hosting platform, on that platform’s own period |
| Your cookie choice | Stored in a cookie on your device, not kept by us |
| Website enquiry and contact form correspondence | 3 years from the last exchange |
| Survey and feedback form responses | 12 months after the survey closes |
| Newsletter subscription and marketing preferences | Until you unsubscribe; suppression records kept indefinitely so that an opt-out is honoured |
| Marketing consent records | 6 years, as evidence that consent was given |
| Backups | Deleted data persists in backups for up to 30 days, then is overwritten |
| Legal, accounting and tax records | 6 years |
| School staff account records | For as long as the school keeps the account open. Deleted when the school removes that member of staff, or when its subscription ends |
| Infrastructure and abuse-prevention logs | 30 days |
| Internal working files containing personal data, such as a spreadsheet of parents to post a Challenge prize to | Created only for a specific task, and our rule is that staff delete them once that task is done |
Where we say data is deleted, we mean it is removed from our live systems and expires from backups on the cycle above. In some cases we instead irreversibly anonymise data. Once it can no longer be linked to anyone, it is no longer personal data, and we may keep it for statistical purposes.
13. If we want to use personal data for a new purpose
We use personal data for the purposes set out in this policy and the addenda, each with the lawful basis stated alongside it, and for purposes compatible with them, which includes producing statistics and research about reading.
If we ever want to use personal data for a new purpose, we will tell you before we do it, explain the lawful basis we would rely on, and ask for your consent where consent is the basis we need. Where we collected the data with your consent in the first place, we will ask again rather than treat the new purpose as already covered. We will not use a quiet update to this policy to justify a materially different use.
14. Your rights
Whatever your relationship with us, you have the following rights over your personal data. A parent or guardian may exercise them on behalf of their child.
A child who is old enough to understand what they are asking can ask us themselves.
| Right | What it means |
|---|---|
| Access | Get a copy of the personal data we hold about you, and confirmation of how we use it |
| Rectification | Have inaccurate or incomplete data corrected |
| Erasure | Have your data deleted where there is no overriding reason for us to keep it |
| Restriction | Ask us to pause processing, for example while accuracy is checked |
| Objection | Object to processing based on legitimate interests, and to direct marketing at any time |
| Portability | Where processing is based on your consent or a contract and is carried out automatically, receive the data you gave us in a portable format, or have it sent to another provider |
| Withdraw consent | Withdraw consent at any time, where consent is the basis we rely on. Withdrawing stops what we do from then on; it does not make what we did beforehand unlawful |
| Complain | Complain to a supervisory authority (see section 15) |
14.1 How to exercise your rights
The quickest route is usually to do it yourself. You can view, correct and delete data directly:
| If you are | Where |
|---|---|
| A parent or guardian | The Fonetti Parent Portal at user.fonetti.com, or the Fonetti app at app.fonetti.com |
| A school | The Fonetti School Platform at schools.fonetti.com |
Otherwise, use the contact details in section 2.
We check requests against the account, rather than asking you for identity documents. If you hold a home account, send your request from the email address the account is registered to. Where a school holds the account, the request goes to the school.
If you no longer have access to the registered address, contact us and we will make reasonable efforts to find a safe route with you.
We respond within one month. If a request is complex, or you have made several, we may extend this by up to two further months and will tell you if we do.
There is no charge, except where a request is manifestly unfounded or excessive, when the law allows us to charge a reasonable fee or to decline. We would tell you why.
14.2 If a school holds your child’s data
Where your child uses Fonetti through a school account, the school is the controller, so please direct your request to the school. If you contact us instead, we will pass it on and support the school in responding.
We will not tell you which school holds a child’s account. We cannot confirm who is asking, and telling the wrong person where a child is could put them at risk.
15. Complaints
If you are unhappy with how we have handled your personal data, please tell us at dpo@auris.tech first.
We will acknowledge your complaint within 30 days and tell you what we are doing about it. We will keep you updated and tell you the outcome.
You also have the right to complain to a supervisory authority at any time. Ours is the Information Commissioner’s Office: ico.org.uk, helpline 0303 123 1113.
16. Changes to this policy
We review this policy at least annually and whenever we make a material change to the service.
When we make a change that materially affects how we handle personal data, we will publish the updated policy, update the date at the top, and notify affected users directly by email before or at the point the change takes effect.
Changes to our list of providers and to the Cookie Policy are made separately and do not require a new version of this policy. Schools receive advance notice of sub-processor changes, as their processing agreement with us requires.