Privacy Policy

Effective date: October 8, 2026
Last updated: October 8, 2026

Spriggy is a child-focused speech-practice application operated by Merle Speech Technologies LLC ("Merle," "Spriggy," "we," "us," or "our"). This Privacy Policy describes how we collect, use, disclose, retain, and protect information when parents, legal guardians, speech-language pathologists, clinics, schools, educators, administrators, and children use the Spriggy application, related professional dashboard, website, and services (collectively, the "Services").

Spriggy is designed to help children practice speech activities selected or assigned by an authorized adult. Children may not independently create an account or provide personal information through Spriggy without authorization from a parent, legal guardian, school, clinic, therapist, or other adult legally permitted to provide that authorization.

1. Information We Collect

The information we collect depends on how the Services are used and which features are enabled.

Adult account information

When a parent, guardian, therapist, educator, clinic representative, or administrator creates or uses an account, we may collect:

Name and contact information, including email address and telephone number;
Professional role, credentials, organization, clinic, or school affiliation;
Login credentials, authentication records, and account settings;
Subscription, billing, and transaction information; and
Communications with Merle, including support requests and feedback.

Payments may be processed by an app store or payment processor. Merle does not receive or store complete payment-card numbers.

Child profile information

An authorized adult may create a child profile and provide:

A first name, nickname, initials, or another profile identifier;
Age, age range, grade, or birth year;
Parent, therapist, classroom, clinic, or organization association;
Target speech sounds, word positions, practice words, goals, and assignments;
Practice schedules and activity settings; and
Other information the authorized adult chooses to provide for the child's use of Spriggy.

We encourage adults to provide only the minimum information needed to support the child. Unless required by the responsible organization, adults should avoid entering a child's full legal name.

Voice recordings and speech-practice data

When microphone access is enabled and a child completes a speaking activity, we may collect:

Audio recordings containing the child's voice;
The target sound, word, phrase, or sentence;
Automated pronunciation, phoneme, or speech-recognition results;
Accuracy indicators and feedback generated from a speaking attempt;
The date, time, duration, and number of attempts;
Replays, completed assignments, and practice progress; and
Game progress, rewards, and character-customization choices associated with practice.

A child's voice recording is personal information. Depending on how Spriggy is provided and used, recordings and practice results may also constitute health information, student information, or education records.

Spriggy's automated results are intended to support practice and professional review. They are not a medical diagnosis and do not replace the judgment of a qualified speech-language pathologist or other healthcare professional.

Device, usage, and security information

We may automatically collect limited technical information necessary to provide, secure, and troubleshoot the Services, including:

Device type, operating system, browser type, and app version;
Internet Protocol address and session identifiers;
Login activity and authentication events;
Features accessed and dates and times of use;
Crash reports, performance data, and diagnostic logs; and
Security events, such as failed login attempts or suspected unauthorized access.

We do not use this information to track children across unrelated applications or websites.

Information we do not intentionally collect

Spriggy does not intentionally collect precise geolocation, address-book contacts, social-media profiles, or advertising identifiers from children. Spriggy does not allow children to publicly post personal information or communicate publicly with unknown users.

2. How We Use Information

We use information to:

Create and administer adult accounts and child profiles;
Provide speech-practice activities, games, assignments, and feedback;
Process speech recordings and generate pronunciation or phoneme-level results;
Display assignments, progress, and practice results to authorized users;
Allow parents, therapists, clinics, and schools to coordinate authorized practice;
Personalize assigned activities and maintain game progress;
Process subscriptions and maintain transaction records;
Respond to questions and provide customer support;
Operate, secure, troubleshoot, and improve the reliability of the Services;
Detect fraud, misuse, technical failures, and security incidents;
Comply with contracts, legal obligations, and lawful requests; and
Create aggregated or de-identified information that cannot reasonably be linked to a child or other individual.

We do not use children's personal information, voice recordings, or therapy information for targeted advertising. We do not use identifiable child data to train general-purpose artificial-intelligence models.

3. Speech Processing and Automated Results

Spriggy currently uses Microsoft Azure and Azure Speech Services to host portions of the Services, process submitted speech, and generate automated pronunciation or speech-recognition results. When a speaking attempt is submitted, the recording and related technical information may be securely transmitted to Microsoft for processing on our behalf.

Automated analysis may occasionally be inaccurate. Results can be affected by background noise, microphone quality, age, accent, dialect, speech differences, and other factors. Authorized adults and professionals should review results in context.

If Merle adds or replaces a provider that materially changes how children's information is collected, used, or disclosed, we will update this Policy and provide any notice or obtain any consent required by law.

4. How We Disclose Information

Merle does not sell personal information. We do not disclose personal information for cross-context behavioral advertising or targeted advertising.

We may disclose information in the following circumstances.

Authorized adults and organizations

A child's profile, assignments, recordings, and results may be accessible to the parent, guardian, therapist, clinic, school, educator, or administrator responsible for the child's account. Access is based on account roles, organizational instructions, and applicable agreements.

Service providers

We may provide information to vendors that help us operate the Services, such as:

Microsoft Azure for cloud infrastructure, data storage, speech processing, security, and related services;
Authentication and account-management providers;
App stores and payment processors;
Customer-support providers; and
Security, error-monitoring, and operational vendors approved for use with Spriggy.

These providers may process information only to perform services for Merle or as otherwise permitted by their agreements and applicable law. We select providers and configure access with privacy and security in mind. The applicable service agreements govern their processing.

Current core providers are Microsoft Azure (hosting, identity, database, recording storage, email delivery, operational monitoring, and Azure Speech processing), Stripe (adult website subscription payments, invoices, and billing management), and Apple (app distribution and in-app subscription transactions). The School checkout sends adult billing information and an account identifier to Stripe, not student names, recordings, or clinical details. Merle's marketing website also loads fonts from Google Fonts, which receives technical connection information when those fonts are requested. These providers' own privacy notices also describe processing they carry out independently.

The OpenAI comparison tool used in development is limited to separately authorized adult test recordings. It is not the provider for children's production speech scoring.

Legal, safety, and security reasons

We may disclose information when we reasonably believe disclosure is necessary to comply with applicable law or legal process; protect the safety, rights, or property of a child, user, Merle, or another person; investigate fraud, misuse, or security incidents; or enforce our agreements.

Business transfers

If Merle is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. Any recipient will be required to respect applicable privacy obligations. We will not materially expand the use of children's personal information without providing any notice or obtaining any consent required by law.

Spriggy is intended to comply with the Children's Online Privacy Protection Act ("COPPA") when COPPA applies.

Before collecting personal information directly from a child under 13, Merle will provide the required direct notice and obtain verifiable consent from a parent or legal guardian unless a legal exception applies. A general acceptance of this Privacy Policy is not, by itself, a substitute for verifiable parental consent.

Where permitted by law, a school may authorize collection on behalf of a parent when Spriggy is used solely for an educational purpose and the school has authority to provide that authorization. Merle does not rely on school authorization to use student information for advertising or unrelated commercial purposes.

Parents and guardians may:

Review the personal information collected from their child;
Request correction or deletion of that information;
Refuse further collection or use of the child's information;
Withdraw previously provided consent; and
Request closure of the child's profile.

To make a request, contact us using Section 16 below. We may take reasonable steps to verify the requester's identity and authority concerning the child. Withdrawing consent or requesting deletion may prevent continued use of features requiring voice recordings or other personal information.

6. Clinics, Healthcare Providers, and HIPAA

HIPAA does not automatically apply to every speech-practice or health application.

When Merle processes protected health information on behalf of a HIPAA-covered healthcare provider under a Business Associate Agreement, Merle will process that information in accordance with the applicable agreement and applicable HIPAA requirements. In those circumstances, the clinic or healthcare provider generally controls the information and determines how it may be used. Requests concerning provider-controlled information may need to be directed to that provider.

Information entered directly into a consumer account may not be protected by HIPAA. It remains subject to this Privacy Policy and other applicable privacy laws.

7. Schools and Student Information

When a school or educational organization provides Spriggy to students, the organization may control student information submitted through the Services. Merle uses school-provided student information only to provide and support the authorized educational service, follow the organization's lawful instructions, protect the Services, and meet legal obligations. We do not use school-provided student information for targeted advertising.

Schools are responsible for providing notices and obtaining permissions required under the Family Educational Rights and Privacy Act ("FERPA") and other applicable student-privacy laws. Parents seeking access to or correction of school-controlled records should generally contact the school first.

8. Audio and Data Retention

Merle retains personal information only for as long as reasonably necessary to provide the Services, follow the instructions of the responsible adult or organization, maintain security, and comply with legal obligations.

Our retention schedule is designed to keep information only for the purpose it was collected:

Scoring-only audio: used to assess an attempt, then deleted after scoring, with a cleanup target within 24 hours.
Optional review audio: kept for parent or therapist review for up to 30 days from recording, or until an authorized user requests earlier deletion.
Practice records: kept to deliver assignments and show progress while the account is active, with deletion targeted within 30 days after account closure, except for organization-controlled records described below.
Security and diagnostic logs: kept for operational troubleshooting and security for 30 days. Recordings, passwords, and full speech transcripts should not be included. A specific security investigation may require limited records to be preserved longer.
Protected backup copies: targeted to expire within 35 additional days after information is deleted from active systems.
Adult account, billing, and transaction records: kept as needed to administer subscriptions and meet tax, accounting, fraud-prevention, and legal obligations. Payment providers may retain their own records under their policies and legal obligations.

Implementation status: These are our approved retention targets. We are still verifying automated enforcement and backup expiry across the service; they are not a guarantee that every copy currently expires automatically on that schedule. Contact privacy@merlespeech.com to request deletion or confirm the handling of your information.

Closing a parent's account disconnects that parent's access. It does not automatically delete another guardian's account or records controlled by a school or clinic. Organization-controlled records follow that organization's lawful instructions, agreements, and applicable retention obligations. We will explain applicable exceptions when responding to a deletion request.

9. Security

Merle uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Access to personal information is intended to be limited according to user roles and legitimate operational needs.

No service can guarantee absolute security. Account holders should protect their credentials and promptly notify Merle of suspected unauthorized access. Merle will investigate and provide notices of qualifying security incidents as required by applicable law and contractual obligations.

10. Advertising, Analytics, and Tracking

Spriggy does not display third-party advertising to children and does not use children's information for targeted advertising. We do not permit third-party analytics providers to track children across unrelated apps or websites.

Any analytics used in child-facing portions of Spriggy will be limited to supporting internal operations, security, reliability, and product performance and will be configured to minimize the collection of personal information.

11. Account Controls and Deletion

Adult account holders may review or update certain account information through the Spriggy application or professional dashboard.

Users may request access, correction, deletion, withdrawal of consent, or a copy of eligible personal information by contacting privacy@merlespeech.com. Spriggy provides a deletion request screen at Parent settings → Delete my account. You can also request deletion by email if that screen is unavailable. Deleting an account does not cancel an Apple subscription; manage that subscription in your Apple Account settings. For Merle School, cancel renewal through the dashboard’s Plan & billing page before closing the account.

Some information may be retained when required by law or reasonably necessary for security, fraud prevention, recordkeeping, or legal claims. If information is controlled by a clinic, school, or other organization, we may refer the request to that organization.

12. State Privacy Rights

Depending on where a user lives, the user or an authorized representative may have additional rights concerning personal information, including rights to access, correct, delete, restrict, or obtain a copy of information and to appeal the denial of a request.

Merle does not sell personal information or use it for targeted advertising. To exercise an applicable privacy right, contact us using Section 16. We may verify the request and may deny or limit a request where permitted by law.

13. International Use

Spriggy is currently intended for use in the United States. If the Services are offered in another country, additional privacy notices, contractual terms, consent mechanisms, or age requirements may apply.

14. App Stores and External Services

Apple, Google, payment processors, and other external platforms may independently collect information when a user downloads Spriggy, makes a purchase, or uses their services. Their handling of information is governed by their own privacy policies.

Any external link, purchase opportunity, or account-management function intended for adults will be separated from child-facing activity by an age-appropriate parental gate where required. A parental gate is not a substitute for legally required parental consent to collect a child's personal information.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes to Spriggy, our information practices, or applicable law. We will post the revised Policy and update the "Last updated" date. If a change materially affects how we collect, use, or disclose children's personal information, we will provide additional notice and obtain renewed consent when required.

16. Contact Us

The operator responsible for information collected through Spriggy is:

Merle Speech Technologies LLC
915 N 500 W Apt 13
Provo, UT 84604
Email: privacy@merlespeech.com Telephone: 208-312-2227
Website: https://merlespeech.com

Parents and guardians may use this contact information to ask questions, review or delete a child's information, withdraw consent, or submit a privacy complaint.