Privacy Notice

What we collect

Account details you give us: your name, email address, the pathway you choose and, where a parent or school activates a child account, the relationship that authorises it.

Learning data the platform creates as you use it: placement results, lesson progress, review history, written and spoken submissions and the level the system calculates from them.

Payment records. Card details are handled by Stripe and never reach our servers; we keep the record of what was bought and when.

Technical records needed to run and secure the service: server logs containing IP address, request path, timestamp and user agent.

Why we process it, and on what basis

To provide the course you asked for, including placement, lessons, review and certificates: performance of our contract with you.

To keep accounts secure - sign-in, password reset, email verification, fraud prevention: our legitimate interest in a secure service, and our legal obligations.

To take payment and keep accounting records: performance of the contract, and legal obligation.

To meet safeguarding duties for learners under 18: legal obligation and substantial public interest.

We do not sell personal data. We do not use behavioural advertising. We do not profile children for advertising.

Who processes data on our behalf

Stripe, to take and record payments.

Resend, to send security and account emails such as password reset and email verification.

ElevenLabs, to generate lesson audio from lesson text.

DigitalOcean, which hosts the platform. Each of these acts on our instructions under a written processing agreement.

Where your data is held

The platform and its database run on DigitalOcean infrastructure in Frankfurt, Germany (region FRA1). As a UK controller placing data in the EEA, we rely on the UK adequacy regulations for the EEA. Where a supplier processes data outside the UK and EEA, the transfer relies on the UK International Data Transfer Addendum or an equivalent approved mechanism.

How long we keep it

Account and learning data: for as long as the account is open, and for 12 months after it is closed, then deleted.

Server logs: 14 days, then rotated out and destroyed.

Accounting records: six years, as UK tax law requires.

Safeguarding records: as long as the safeguarding duty requires, under restricted access.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask us to restrict it. Write to [email protected] and we will respond within one month.

If you are not satisfied with our response you can complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk.

Children

Learners must be at least six. A learner below the locally applicable age of independent digital consent may use IELPS only after a verified parent, guardian or authorised school activates the relationship. Child settings default to the highest privacy. Advertising, sale of child data, public profiles, precise location and session replay are prohibited on child accounts.

Analytics

The public site runs no analytics or advertising scripts. Traffic figures come from our CDN provider’s own edge logs, which we do not combine with account data. If analytics is ever added, this notice will be updated before it is switched on.