Privacy policy

1. Data controller

The controller of your data is the Operator named at the end of this document. For data-protection matters, write to the e-mail address in the "Contact" section.

2. What data we process

Account: your e-mail address, and with Google sign-in, your name and Google account identifier.

Using the App: your answers, results, attempts and history, the interface language you choose, and your answers to the three questions on your first visit: which exam you are preparing for, when it is and how much time you had to start. With each attempt we also record its course: when a block was opened and first answered, when the tab was hidden or closed, when the block was handed in or abandoned and how many answers it had then; in the Listening block, also when the recording started or stopped and at which point; afterwards, what was chosen on the result screen. Never what the answers say — so we know where the exam breaks off.

E-mail: your address, name, interface language and a short summary of your use — whether you have access running, how many sets you have completed in full, whether you have used up an exam's free sets and, if you answer the questions at the start, which exam you are preparing for and when it is — go to SendPulse. The welcome letter after sign-up is sent from there. E-mails with new sets and tips go out only if you tick a separate consent — when signing in, in a one-time question on the list of sets, or on the Account page, where you can also withdraw it; we record when and where it was given or withdrawn. Every e-mail has an unsubscribe link at the foot. Your answers and texts are not sent. Deleting the account also removes the address from that list.

Payment: Stripe passes us the status of a transaction and its identifier; we never see or store card details.

Technical: your IP address and basic server logs, needed for security and diagnostics.

Writing module: the text you write. To mark it we send it — without your e-mail address or account identifier — to OpenAI, together with the brief it answers. The marking comes back to us and stays with your attempt. This happens only when you press "Mark my text" yourself.

Analytics: which pages you open and when, roughly where you are (from your IP address), and which browser and device you use. This is collected through Google Tag Manager and Google Analytics, which store an identifier in your browser. We read it in aggregate — to see which pages get used — not to build a profile of you. When an account is created we also note where the first visit came from — the UTM tags in the address, the domain of the site that linked here, and the landing page — to see which channels bring people in. This only runs with your consent.

Session recordings: with your analytics consent, Microsoft Clarity records how you use the site — cursor movement, clicks, scrolling and the layout of the screen — together with the page address, roughly where you are, and your browser and device. What you type into a field — answers and texts — is masked and does not reach the recording. The rest of the screen, such as the task text and, on the Account page, your e-mail address, may be visible in it. We watch recordings one at a time to see where the interface gives people trouble; we do not build a profile of you from them.

Marketing: with your consent, Meta Pixel stores an identifier linking your visits to the App with your Meta ad account — to measure how well ads perform and show them to people who have already been here.

The marked oral exam: every answer you record is sent — without your e-mail address and without your account identifier — to ElevenLabs, which turns it into text. The recording itself is kept neither by us nor by them once the text is back. The text of your answers, with the tasks, goes to OpenAI, which writes the examiner’s questions, your partner’s turns in the discussion and the marking. The text and the marking stay with your session. This happens only in a session you start yourself.

Recordings from the unmarked speaking practice are made and kept only in your browser — they never reach the server and no one but you hears them.

3. Purposes and legal bases

Running your account and providing the App — performance of a contract (Art. 6(1)(b) GDPR). Handling payment and tax records — a legal obligation (point (c)). Keeping the service secure and answering enquiries — legitimate interest (point (f)). Analytics (Google Analytics, Microsoft Clarity) and marketing (Meta Pixel), like messages not needed to run the service, run only with your consent (point (a)).

4. Who we pass data to

Google (Firebase Authentication) — sign-in. Cloudflare — hosting the App and the database with your results. Stripe — handling payments. SendPulse — sending e-mail and the mailing list; we pass the address, name, language and the summary of use described above. OpenAI — marking the Writing module and the oral exam, only when you ask for it; we pass the text and the tasks, with nothing that identifies you. ElevenLabs — turning recorded oral-exam answers into text, and the examiner’s voice; we pass the recording alone, with nothing that identifies you. Google (Tag Manager, Google Analytics) — traffic analytics, only with your consent. Microsoft (Clarity) — session recordings with the content masked, only with your consent. Meta (Meta Pixel) — marketing, only with your consent. Each processes data on our instructions or as an independent controller within its own service. We do not sell data.

5. Transfers outside the EEA

Google, Cloudflare, Stripe, SendPulse, OpenAI, ElevenLabs, Microsoft and Meta may process data outside the European Economic Area. This is done under the Standard Contractual Clauses approved by the European Commission.

6. How long we keep data

Account data and results — until the account is deleted. Billing records — for the period required by tax law (as a rule, 5 years). Technical logs — short-term, for current diagnostics and security.

7. Your rights

You have the right to access your data and receive a copy of it, to have it corrected or erased, to restrict how it is processed, and to move it to another controller. You may also object to processing based on our legitimate interest, and any consent we ask for can be withdrawn at any time — withdrawing it does not undo what was done before.

Two of those rights you exercise yourself, immediately: the "Account" page hands back everything stored under your account as one file, and deletes the account with everything belonging to it. For anything else, write to the address in the "Contact" section — we answer within a month.

If you believe we are processing your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa).

8. Export and account deletion

On the "Account" page you can download everything stored under your account as a single file, and delete the account with everything attached to it. The file holds your answers and results — never the tasks themselves or the answers to them. Deletion cannot be undone.

9. Cookies

The App uses cookies needed for it to work, plus analytics cookies. See the Cookie policy for details.

10. Changes to this policy

We will announce any material change in the App or by e-mail. The date at the top of the page shows the last update.

11. Contact

For data-protection matters: