Privacy Policy

The controller of your personal data — the party that decides why and how it is processed — is:

We are a small operation and have not appointed a Data Protection Officer, which the law does not require of us. Privacy questions go straight to the address above and are answered by a person.

Information you give us

• Account details — your name, email address and a securely hashed password. We never store your password in readable form.
• Your answers — the responses you enter in exercises, including the text of Writing tasks and the text of Speaking answers. Where you use the microphone, your speech is converted to text by the speech-recognition feature built into your browser. Depending on the browser, that conversion may run on your device or on servers operated by the browser’s maker (for example Google for Chrome, Microsoft for Edge), under that company’s own privacy policy — it is a feature of your browser, not a service we operate, and you can always type instead of speaking. We never receive, record or store audio of your voice; only the resulting text reaches us.
• Messages you send us — anything you write to our support or privacy addresses.

Information created as you use the service

• Attempts and results — which exercise you took, when, how long it took, your answers, your score, and the feedback produced for you.
• Technical session data — your IP address and browser user-agent, stored with your login session for security purposes.

Payment information

When you buy access, checkout happens on Stripe’s pages and your card details go directly to Stripe, which acts as the merchant of record — the legal seller of the payment transaction. We never see or store your card number. Stripe issues your receipt and invoice, and for payment data it is an independent controller under its own privacy policy. What we keep is the record needed to run your access: which plan you bought, when, the Stripe transaction reference, and the date your access ends.

What we do not collect

We do not ask for and do not want special category data — health, beliefs, ethnicity or anything similar. Please do not include such information in Writing or Speaking answers if you would rather it were not processed; the topics never require it.

• To provide the service — running your account, saving your attempts, showing your history and progress, marking your answers. Basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To grant paid access and keep records of purchases — recording which plan you bought and until when it runs, and keeping the accounting records the law requires. Payment itself is taken by Stripe as merchant of record. Basis: performance of the contract, and compliance with a legal obligation for the accounting and tax records (Art. 6(1)(b) and (c)).
• To keep accounts secure — detecting suspicious logins, abuse, account sharing and fraud. Basis: our legitimate interest in protecting the service and our paying users (Art. 6(1)(f)).
• To answer your messages and handle complaints. Basis: performance of the contract, and our legitimate interest in supporting users (Art. 6(1)(b) and (f)).
• To improve the material — looking at which questions are answered wrongly far more often than expected, so we can find and fix bad items. We use aggregated statistics for this, not individual profiles. Basis: our legitimate interest in the quality of what we sell (Art. 6(1)(f)).
• To send service emails — security notices and material changes to the service or these policies. (Your purchase receipt and invoice come from Stripe, not from us.) Basis: performance of the contract and legal obligation. These are not marketing and you cannot unsubscribe from them while you hold an account.

We do not sell your personal data, and we do not use it for advertising or for automated decisions with legal effects. Automated marking produces feedback for you and never determines access, pricing, or anything with a legal consequence.

Writing and Speaking answers are assessed by an AI model operated by Anthropic PBC in the United States. This is the single most important disclosure on this page, so here is exactly what happens:

• What is sent: the text of your answer and the exercise instructions it responds to.
• What is not sent: your name, your email address, your account identifier, your payment details, or any audio.
• How it is used: only to produce your feedback and marks, which are returned to us and shown to you.
• Training: under our agreement with the provider, your submissions are not used to train their models.

If you would rather nothing you write were sent to an AI provider, you can still use the whole of the Reading, Use of English and Listening material, which is marked against an answer key on our own systems — simply do not request AI feedback.

We keep this list short on purpose. This is everyone who receives personal data when you use the service:

Vercel, Neon and Anthropic process data only on our instructions, under written data processing agreements, and may not use it for their own purposes. Stripe is different: as merchant of record it is the legal seller of your purchase, and it processes your payment data as an independent controller under its own privacy policy — not on our instructions.

We may also disclose data to our accountant, and to a public authority or court where the law requires it. If the business is ever sold or transferred, your data would pass to the buyer on the same terms, and we would tell you first.

Some of the companies above process data in the United States, as marked in the table. Those transfers are protected by the European Commission’s Standard Contractual Clauses, or by the provider’s certification under the EU–US Data Privacy Framework, together with technical measures such as encryption in transit.

You can ask us for a copy of the safeguards that apply to a particular transfer through our support form.

• Account details — while your account exists. Deleting your account — on the Access & account page, or by writing to us — removes them immediately and permanently.
• Attempts, answers and feedback — while your account exists, because your study history is the point of having one. You can have individual attempts deleted at any time by writing to us.
• Login sessions and the IP address stored with them — until the session expires or you sign out.
• Purchase and accounting records — 10 years from the end of the accounting period, as Czech tax law requires. We cannot delete these on request, and this is the one category that survives account deletion.
• Support messages — up to 3 years, so we have the context of an earlier problem if it recurs.

Under the GDPR you have the right to:

• access your personal data and receive a copy of it;
• correct anything inaccurate — write to us and we will fix it;
• delete your data (“right to be forgotten”) — you can delete your whole account yourself on the Access & account page — except where we must keep it, such as invoices;
• restrict or object to processing that we base on legitimate interests;
• portability — download everything as JSON from the Access & account page, or write to us to have it sent to another provider;
• withdraw consent at any time, where processing is based on consent, without affecting what was done before.

To use any of these, contact us through our support form, from the email address on your account. We will respond within one month, free of charge. We may ask you to confirm your identity before we act, so that nobody else can request your data.

If you think we have handled your data badly, please tell us first — but you have every right to go straight to a supervisory authority. In the Czech Republic that is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz. If you live elsewhere in the EU, you may complain to the authority in your own country.

English Certificate Preparation is not intended for children under 15, and accounts may not be created by them. Purchases must be made by someone aged 18 or over.

If you are a parent or guardian and believe a child under 15 has given us personal data, contact us through our support form and we will delete the account and its data promptly.

Traffic to the site is encrypted with HTTPS. Passwords are stored only as salted hashes. Access to the production database is limited to the operator of the service. Our hosting and database providers hold recognised security certifications and keep the data encrypted at rest.

No system is perfectly secure. If a breach ever occurs that is likely to result in a high risk to you, we will tell you without undue delay and report it to the supervisory authority within 72 hours, as the law requires.

We use only what is necessary to keep you signed in and to remember your work on your own device. There are no advertising or tracking cookies. The detail is in our Cookie Policy.

We will update this page when what we do changes — for example if we add a new provider. The date at the top always shows the current version. If a change materially affects how we use your data, we will tell you by email before it takes effect.