Privacy Policy

1. Data controller

The data controller responsible for your personal data is:

We have not appointed a Data Protection Officer (DPO) as we do not meet the thresholds under GDPR Article 37. For all privacy matters, contact us directly at the email above.

2. What data we collect and why

Account data

Email address, first name, and hashed password (or OAuth token if you sign in with Google). Legal basis: performance of contract (GDPR Art. 6(1)(b)).

Subscription and payment data

Usage and progress data

Answers, results, practice history, and session activity. Legal basis: performance of contract (Art. 6(1)(b)) — required to grade your sets and track your progress.

Writing and speaking submissions

Texts you write and your speaking-task recordings are kept in private storage and sent to Google (Gemini API) for transcription and feedback. Legal basis: performance of contract (Art. 6(1)(b)).

Technical and device data

IP address (kept hashed for rate limiting), browser type, operating system, and referring URL. Legal basis: legitimate interest (Art. 6(1)(f)) — security, abuse prevention, and error diagnosis.

Attribution data

UTM parameters and ad-click identifiers captured at signup and checkout to understand which marketing channels are effective. Legal basis: legitimate interest (Art. 6(1)(f)).

Marketing communications

Creating an account enables emails with study tips, new features, and offers, and ad measurement. Legal basis: consent (Art. 6(1)(a)), recorded with the policy version and timestamp. You can withdraw consent at any time via the unsubscribe link, the cookie banner, or by contacting us.

Cookie and consent data

Your cookie choices and their timestamp. See our Cookie Policy for full details.

3. How long we keep your data

4. Who we share your data with

We do not sell your personal data. We share data only with the processors listed below, each bound by a Data Processing Agreement:

We may also disclose data if required by law, a court order, or to protect our legal rights, provided we notify you unless prohibited from doing so.

5. International data transfers

Google, ElevenLabs, Cloudflare, and Meta are based in the United States. We transfer personal data to these processors under the EU Standard Contractual Clauses adopted by the European Commission (GDPR Art. 46(2)(c)). Copies of these clauses are available upon request.

6. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Access (Art. 15): Request a copy of the personal data we hold about you.
• Rectification (Art. 16): Ask us to correct inaccurate data.
• Erasure (Art. 17): Ask us to delete your data, subject to legal retention obligations (e.g. 7-year payment records).
• Restriction (Art. 18): Ask us to pause processing in certain circumstances.
• Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Object (Art. 21): Object to processing based on legitimate interest, including profiling for direct marketing.
• Withdraw consent: Where processing is based on consent (marketing emails, Meta Pixel), withdraw it at any time without affecting prior lawful processing.

To exercise any right, email us at [email protected] with the subject "Privacy Request". We will respond within 30 days. There is no charge for reasonable requests.

7. Automated decision-making

We use AI to generate feedback on your writing and speaking submissions. This feedback is educational guidance only and does not produce legal effects or significantly affect you in a similar way. It is not automated decision-making in the sense of GDPR Article 22.

8. Complaints

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority (our lead authority) or, if you live in France, with the CNIL:

We ask that you contact us first so we can resolve any concern directly.

9. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or legal obligations. For material changes we will notify you by email at least 30 days in advance. The current version is always available at this URL.