Privacy Policy

1. Who We Are

This Privacy Policy explains how [Legal entity name], trading as "English Tactics" ("English Tactics", "we", "us", or "our"), collects, uses, shares, and protects personal information when you use englishtactics.com, app.englishtactics.com, and our related Services. For the purposes of data-protection law, English Tactics is the controller of the personal information described here, except where we act as a processor for teachers and schools (see Section 12). Contact: hello@englishtactics.com. Registered address: [Registered address].

2. Scope

This Policy applies to all users of our Services worldwide. It should be read together with our Terms & Conditions and Cookie Policy. Additional notices may apply to specific features and will be provided at the relevant time.

3. Information We Collect

• Account and identity data: name, email address, password stored in hashed form by our authentication provider, and, if you sign in with Google, basic profile information such as your name and avatar.
• Profile and learning data: profession, English level, goals, areas to improve, interests, availability, time zone, and onboarding answers.
• Assessment data: your responses and the resulting CEFR level and diagnostic profile.
• Practice content: the text you write and the voice recordings and transcripts you submit during speaking and writing practice, scenarios, and lessons.
• Purchase and billing data: items requested, plan selected, your name, your WhatsApp number, and your chosen payment method. We do not collect or store full payment-card numbers.
• Communications: messages you send us by email, WhatsApp, or other channels.
• Usage, device, and log data: IP address, browser and device information, pages viewed, actions taken, and similar analytics data collected through cookies and similar technologies, as described in our Cookie Policy.
• Security data: limited records used to detect and prevent abuse, such as rate-limiting events, which may include IP address and are retained for a short period.
• Classroom data: where a teacher uses Classroom, information the teacher enters about pupils, such as pupil names and activity scores (see Section 12).

4. How We Use Information and Legal Bases

We use personal information to: provide, personalise, and improve the Services; generate plans, practice, feedback, and assessments; process and confirm purchases; communicate with you, including service messages and support; maintain security and prevent fraud and abuse; comply with legal obligations; and, with your consent where required, send marketing and measure advertising and analytics.

Where the GDPR or similar laws apply, our legal bases are: performance of a contract with you; our legitimate interests in operating, securing, and improving the Services; your consent, for example for non-essential cookies and marketing; and compliance with legal obligations.

5. Artificial Intelligence Processing

To provide practice and feedback, we send the text and voice recordings you submit, and related content such as lesson sources, to our AI provider (OpenAI) for processing, including speech-to-text transcription, text-to-speech, and the generation of feedback, exercises, and scores. This content is processed to deliver the feature you requested. We do not use your voice recordings to create a voice profile or to identify you, and we do not sell your content. Our providers process data under their own terms and security commitments.

6. Cookies and Similar Technologies

We use cookies and similar technologies for essential functions, such as signing you in and remembering your currency preference, and for analytics and advertising. Full details, including the specific providers and how to manage your choices, are in our Cookie Policy.

7. How We Share Information and Service Providers

We do not sell your personal information for money. We share it with service providers, or processors, who act on our behalf under contract, and otherwise as described below. Our key providers include:

• Supabase — authentication and database hosting.
• Vercel — application hosting and content delivery.
• OpenAI — AI processing, including transcription, speech, and generation.
• Resend — transactional email delivery.
• Cloudflare Turnstile — bot and abuse protection on sign-up and sign-in.
• Calendly — scheduling of one-to-one video sessions.
• EF SET — optional external English test, where you choose to take it.
• Analytics and advertising providers — Google Analytics, Microsoft Clarity, Meta, X (Twitter), Snapchat, TikTok, and LinkedIn, through the pixels described in our Cookie Policy.

We may also share information to comply with law, enforce our Terms, protect rights and safety, or in connection with a merger, acquisition, or sale of assets.

8. International Transfers

We and our providers may process your information in countries other than your own, including outside the United Arab Emirates, the European Economic Area, and the United Kingdom. Where required, we rely on appropriate safeguards, such as standard contractual clauses or an adequacy decision, to protect your information when it is transferred.

9. Data Retention

We keep personal information for as long as needed to provide the Services and for legitimate business and legal purposes, after which we delete or anonymise it. Account and profile data is kept while your account is active. Security logs, such as rate-limiting events, are kept only briefly. You may request deletion as described in Section 11.

10. Security

We use technical and organisational measures designed to protect personal information, including encryption in transit, access controls, and trusted infrastructure providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Rights

Depending on where you live, you may have rights to: access the personal information we hold about you; correct inaccurate information; delete your information; restrict or object to certain processing; receive a copy of your information in a portable format; and withdraw consent at any time.

If you are in the European Economic Area or the United Kingdom (GDPR), you also have the right to lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA and CPRA), you have the right to know, delete, and correct your information, and to opt out of the sale or sharing of personal information. We do not sell personal information for money; some advertising cookies may be considered sharing under California law, and you can opt out through the controls in our Cookie Policy and your browser. We will not discriminate against you for exercising your rights.

To exercise any right, contact us at hello@englishtactics.com. We will verify and respond as required by law.

12. Children and the Classroom

The Services are intended for users aged 16 and over, and we do not knowingly collect personal information directly from children under 16. School pupils do not create accounts. Where a teacher or school uses Classroom and enters information about pupils, the teacher or school is the controller of that information and English Tactics acts only as a processor, handling it to provide the Classroom features under the instructions of the teacher or school. Teachers and schools are responsible for providing notices and obtaining the consents required by law. If you believe a child has provided us personal information without authorisation, contact us and we will delete it.

13. Marketing

Where permitted, we may send you news and offers about the Services. You can opt out at any time using the unsubscribe link in our emails or by contacting us. We will still send essential service messages, such as receipts and security notices.

14. Third-Party Links

The Services may link to third-party sites and services that we do not control. This Policy does not apply to them, and we encourage you to review their privacy notices.

15. Changes to This Policy

We may update this Policy from time to time. We will update the "Last updated" date and, for material changes, provide additional notice where appropriate. Your continued use of the Services after changes take effect indicates acceptance.

16. Contact

[Legal entity name] [Registered address] Email: hello@englishtactics.com